Transfer Stripe Account Ownership: A Guide for Organizations

IAM Roles are temporary identities that can be assumed by users to gain permissions without long-term credentials. Roles contain two key components: trust relationships (defining who can assume the role) and permissions (defining what the role can do). Users can 'switch' to a role to temporarily gain those permissions, which is useful for cross-account scenarios or temporary access to production resources. Roles are particularly valuable for development environments where users need temporary access to different resources. Key terminology includes: Resources (IAM users, groups, roles, policies), Identity IDs (principals that can be granted permissions), Entities (authentication mechanisms like IAM users or federated users), and Principal (the entity making requests to AWS, which can be humans, applications, or AWS services).

IAM manages who can do what on which resources. It consists of: Principal (who - users, groups, or service accounts), Role (what permissions they have), Resource (which assets they can access), and Policy (binding between principal, role, and resource). Best practices include the least privilege principle - giving only minimum necessary permissions, using view access unless edit is required, and never sharing service account keys.

An IAM role is an identity that you create with specific permissions, but unlike users, roles do not have traditional credentials such as passwords or keys. Instead, roles can be temporarily assumed by trusted entities (such as EC2 instances, Lambda functions, or human users) who receive temporary security credentials automatically. This allows entities to perform actions within their defined permissions without requiring long-term credentials to be stored or managed.

IAM Users are created through the IAM service and can be granted credentials or console login access. Unlike Root Users, IAM Users can have permissions revoked immediately if compromised. Roles are permission containers that users can assume to gain access. When a user has no permissions, they can assume a role (represented as a 'hat') containing necessary permissions. For example, a user can assume a 'Finance Team Role' for financial operations or a 'Developer Role' for development tasks. The permissions belong to the role, not the user, providing flexible and secure access management.

Groups organize users and apply permissions collectively. Instead of attaching policies to each user individually, you create a group, attach policies to the group, and add users to the group. This is more efficient for teams needing identical access. Roles are assigned to AWS resources (like EC2 instances) rather than people. When an application hosted on an EC2 instance needs to access S3, you create a role with S3 permissions and attach it to the instance. The application can then use the role's credentials without hardcoding access keys. Roles are temporary credentials automatically managed by AWS.

Corporate governance requires bylaws (internal rules not filed with government), shareholder elections of directors, and annual meetings. Directors make major decisions like loans and appoint officers. Officer roles (President, Treasurer, Secretary) have state-specific requirements—some states allow single individuals to serve all positions. Professional corporations require all owners to hold relevant licenses and are mandatory for licensed professionals like clinical social workers. They provide legitimacy for international business dealings and protect against employee misclassification. Initial share structure impacts future flexibility—issuing more authorized shares provides options for raising capital. Operating agreements govern LLC internal operations regardless of tax classification, covering member roles and profit distribution.

Companies are legal structures established under the Corporations Act, with private companies (proprietary limited) having specific characteristics. Companies have officers including directors and secretaries. Directors make decisions for the entity as a separate legal person, with at least one director required. Director appointments significantly impact asset protection and control, as both spouses as directors may face joint court involvement. Two directors create 50/50 control requiring unanimous decisions, potentially causing deadlock. Secretaries, if appointed, must be Australian residents and handle administrative functions. The Corporations Act governs corporate authority, allowing a sole director, two directors, or a director-secretary combination to sign documents, facilitating timely transactions like auctions.

Business owners must fulfill core responsibilities to maintain legal viability. This includes staying compliant with state and federal requirements (filing statements of information annually or biennially depending on entity type), choosing the right business entity for liability protection (e.g., professional corporations for licensed professionals in California), and maintaining proper corporate governance. The primary purpose of business structures is liability protection - creating a firewall between personal assets and lawsuits. Even with the right entity, failure to follow governance rules can compromise protection through 'piercing the corporate veil.'

Corporations require formal governance structures including organizational documents filed with the Secretary of State. Shareholders elect a board of directors who oversee the company, and directors hire officers (such as president, vice president, and treasurer) who handle day-to-day operations. Even a single-owner corporation must follow these formalities, including holding board meetings and properly documenting all corporate actions.

This segment covers corporate governance principles and the responsibilities of company officers. The instructor explains the roles of directors, auditors, and experts within company structures, emphasizing their specific duties and accountability. The content discusses the fit and proper person requirement, ensuring officers meet necessary qualifications. The segment also addresses member participation requirements, share capital thresholds, and the importance of proper governance procedures. The instructor highlights how effective corporate governance protects shareholder interests and maintains organizational integrity.

Cyber awareness is annual IT security training reinforcing muscle memory across three dimensions: behavioral differences between personal and work contexts, technological factors including data privacy and evolving threats, and demographic variations where generations like Millennials and Baby Boomers have different security perspectives. Multi-factor authentication (MFA) verifies identity through three factors: what you know (passwords), what you have (phones, banking PIN systems), and who you are (biometrics). Evolution progressed through SMS codes, time-based one-time passwords, and biometric authentication. MFA contributes to cyber security awareness by conditioning individuals to verify caller identities and think critically about information sharing. The industry is at an inflection point regarding passwordless authentication using biometrics combined with machine learning.

Multi-Factor Authentication (MFA) is a critical cybersecurity measure that requires users to provide two or more verification factors (such as something they know like a password, something they have like a smartphone, and something unique to them like a fingerprint) to access online accounts, making it significantly harder for attackers to compromise accounts even if one credential is stolen, and should be enabled on all digital accounts including email, social media, banking, and gaming platforms.

Mobile devices implement lockout mechanisms after failed login attempts, progressively increasing delays to deter brute force attacks. Two-factor authentication (2FA/MFA) requires two fundamentally different credentials: something you know (password) and something you have (phone, token, biometric). This dramatically reduces unauthorized access risk. Password managers solve the human limitation of remembering multiple strong passwords by generating and storing complex, unique passwords for each account. The primary trade-off is that discovering the master password grants access to all stored accounts. Together, these mechanisms represent a progression from simple password protection toward layered security architectures that recognize the limitations of human memory and the persistent threat of credential theft.

Cybersecurity protects computer systems, networks, and data from cyber attacks through practices, technologies, and processes. Common attacks include ransomware, phishing, and denial of service, which can affect anyone regardless of organization size. The 2021 Facebook breach exposed 500 million users' data, and the 2023 average data breach cost reached $4.45 million. Multi-Factor Authentication (MFA) adds a critical security layer by requiring at least two identification forms beyond passwords, such as codes from SMS, email, or authentication apps. MFA reduces account compromise risk by up to 99% because attackers need both the password and the second factor. Common vulnerabilities include password reuse, weak passwords, and storing credentials in browsers.

General cybersecurity defenses include antivirus (detects, blocks, and removes malware using signature-based and heuristic-based detection), MFA (Multi-Factor Authentication requiring multiple identity proofs like passwords, tokens, or biometrics), encryption (transforms readable plaintext into unreadable ciphertext using keys for data at rest and in transit), password managers (generate, store, and protect complex passwords), and backups (data copies for recovery after loss, damage, or attacks like ransomware). Offline backups protect against network-based malware, while online backups enable quick restoration.