--- title: How to Make Trading Infrastructure Audit-Ready Across... description: High-frequency trading and quantitative fund infrastructure spans SSH-accessed bare-metal servers, Kubernetes clusters, production databases, and RDP-accessed... canonical: https://daily.dev/posts/how-to-make-trading-infrastructure-audit-ready-across-ssh-kubernetes-databases-and-rdp-vjff0labp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How to Make Trading Infrastructure Audit-Ready Across SSH, Kubernetes, Databases, and RDP | daily.dev og:description: High-frequency trading and quantitative fund infrastructure spans SSH-accessed bare-metal servers, Kubernetes clusters, production databases, and RDP-accessed... og:url: https://daily.dev/posts/how-to-make-trading-infrastructure-audit-ready-across-ssh-kubernetes-databases-and-rdp-vjff0labp og:image: https://api.daily.dev/og/posts/vJfF0LabP.png og:image:alt: How to Make Trading Infrastructure Audit-Ready Across SSH, Kubernetes, Databases, and RDP og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How to Make Trading Infrastructure Audit-Ready Across SSH, Kubernetes, Databases, and RDP **[Teleport](https://daily.dev/sources/teleport)** · 13 min read · 0 upvotes · 0 comments ## Summary High-frequency trading and quantitative fund infrastructure spans SSH-accessed bare-metal servers, Kubernetes clusters, production databases, and RDP-accessed Windows systems, each producing audit logs that cannot tie actions to individual identities due to shared credentials, service accounts, and standing SSH keys. This fragmentation forces compliance teams to manually correlate IdP logs, cloud audit trails, and bastion host records during PCI DSS, SOC 2, and ISO 27001 assessments. Teleport is presented as a solution issuing short-lived per-session X.509 certificates, unifying session recording across all four protocols into one structured audit log, capturing full command-level activity, and exporting logs to SIEM platforms like Splunk or Datadog, with a case study on Exness using it across hundreds of clusters. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why can't I tell which engineer ran a command when multiple people share the same SSH key or database account? Shared SSH keys, kubeconfigs, and database accounts authenticate as a single identity, so logs only record the credential used, not the individual person behind it. An auth.log entry shows a key was accepted for an account like deploy from an IP address, but provides no proof of which specific person initiated that session, making incident attribution impossible without additional correlation. _Anyone hardening credential and identity practices can track these audit patterns on daily.dev._ ### How does Kubernetes audit logging fail to identify who ran a kubectl exec command in production? Kubernetes API audit events reference the service account or credential used for authentication rather than the human or machine identity behind it, so a kubectl exec event only shows an entry like system:serviceaccount:trading:deploy-bot instead of the actual engineer. When kubeconfigs are shared across a platform team, any holder authenticates as the same identity, making it impossible to answer who accessed a pod during an incident. _Engineers debugging Kubernetes access control gaps can follow this topic on daily.dev._ ### What capabilities should trading firm audit logs include to satisfy PCI DSS or SOC 2 auditors? Audit logs need a unified trail across SSH, Kubernetes, databases, and RDP, strong identity attribution rather than shared credentials, full session recording down to individual commands, and exportability to SIEM tools like Splunk or Datadog. Short-lived per-session certificates that expire when a session ends help ensure every action is tied to a specific person or machine identity for regulators. _Teams preparing for compliance audits can follow infrastructure and security best practices on daily.dev._ ## Similar posts on daily.dev - [Updates to Kubernetes audit logging, network flow logs, and SSH records](https://daily.dev/posts/updates-to-kubernetes-audit-logging-network-flow-logs-and-ssh-records-p1hc5y2bj) · Tailscale · 3 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#compliance](https://daily.dev/tags/compliance) [View this post on daily.dev](https://daily.dev/posts/how-to-make-trading-infrastructure-audit-ready-across-ssh-kubernetes-databases-and-rdp-vjff0labp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How to Make Trading Infrastructure Audit-Ready Across SSH, Kubernetes, Databases, and RDP","url":"https://daily.dev/posts/how-to-make-trading-infrastructure-audit-ready-across-ssh-kubernetes-databases-and-rdp-vjff0labp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-to-make-trading-infrastructure-audit-ready-across-ssh-kubernetes-databases-and-rdp-vjff0labp"},"datePublished":"2026-08-23T12:22:59.422Z","dateModified":"2026-08-23T12:52:22.965Z","description":"High-frequency trading and quantitative fund infrastructure spans SSH-accessed bare-metal servers, Kubernetes clusters, production databases, and RDP-accessed...","image":"https://media.daily.dev/image/upload/s--58gMhC4P--/f_auto/v1722860399/public/Placeholder%2012","thumbnailUrl":"https://media.daily.dev/image/upload/s--58gMhC4P--/f_auto/v1722860399/public/Placeholder%2012","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-to-make-trading-infrastructure-audit-ready-across-ssh-kubernetes-databases-and-rdp-vjff0labp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,compliance","timeRequired":"PT13M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"How to Make Trading Infrastructure Audit-Ready Across SSH, Kubernetes, Databases, and RDP"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-to-make-trading-infrastructure-audit-ready-across-ssh-kubernetes-databases-and-rdp-vjff0labp#faq","mainEntity":[{"@type":"Question","name":"Why can't I tell which engineer ran a command when multiple people share the same SSH key or database account?","acceptedAnswer":{"@type":"Answer","text":"Shared SSH keys, kubeconfigs, and database accounts authenticate as a single identity, so logs only record the credential used, not the individual person behind it. An auth.log entry shows a key was accepted for an account like deploy from an IP address, but provides no proof of which specific person initiated that session, making incident attribution impossible without additional correlation. Anyone hardening credential and identity practices can track these audit patterns on daily.dev."}},{"@type":"Question","name":"How does Kubernetes audit logging fail to identify who ran a kubectl exec command in production?","acceptedAnswer":{"@type":"Answer","text":"Kubernetes API audit events reference the service account or credential used for authentication rather than the human or machine identity behind it, so a kubectl exec event only shows an entry like system:serviceaccount:trading:deploy-bot instead of the actual engineer. When kubeconfigs are shared across a platform team, any holder authenticates as the same identity, making it impossible to answer who accessed a pod during an incident. Engineers debugging Kubernetes access control gaps can follow this topic on daily.dev."}},{"@type":"Question","name":"What capabilities should trading firm audit logs include to satisfy PCI DSS or SOC 2 auditors?","acceptedAnswer":{"@type":"Answer","text":"Audit logs need a unified trail across SSH, Kubernetes, databases, and RDP, strong identity attribution rather than shared credentials, full session recording down to individual commands, and exportability to SIEM tools like Splunk or Datadog. Short-lived per-session certificates that expire when a session ends help ensure every action is tied to a specific person or machine identity for regulators. Teams preparing for compliance audits can follow infrastructure and security best practices on daily.dev."}}]} ```