Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bank of England to crack down on 'secretive' cloud computing services

itnews.com.au

Post reply on HN
Print view View original

41–50 of 123 posts

Re: Bank of England to crack down on 'secretive' cloud computing services

#41

Post by twic »

bob1029 wrote: post #3

We do business in the US financial sector, and the sentiment we are getting with regard to cloud vs on-prem seems to be growing into a bimodal distribution. I would say it's nearly a 50/50 split until we have conversations about how our product actually works and the incredibly sticky problem that is PII... Once the risks are reviewed in open and honest ways, we find that virtually all of our clients would prefer to…

Does "on prem" ever include (a) on your own hardware, but in a third-party colo and (b) on rented hardware, where only you have root? Where do those sit between full cloud and traditional servers-in-the-basement?

To look at it another way, how much of the risk is about the physical location of machines, and how much is about who operates them?

Re: Bank of England to crack down on 'secretive' cloud computing services

#42

Post by oliwarner »

pwarner wrote: post #29
bob1029 wrote: post #3

We do business in the US financial sector, and the sentiment we are getting with regard to cloud vs on-prem seems to be growing into a bimodal distribution. I would say it's nearly a 50/50 split until we have conversations about how our product actually works and the incredibly sticky problem that is PII... Once the risks are reviewed in open and honest ways, we find that virtually all of our clients would prefer to…

How is the problem of PII better solved on premises?

What's the worst that can happen in a on-premises attack, Vs the worst that could happen if AWS was hacked?

The amount of financial data that could be exploited at once is magnitudes larger in a popular cloud. I don't think it's strange that a regulator might look at that failure point with some trepidation.

Re: Bank of England to crack down on 'secretive' cloud computing services

#43

Post by bob1029 »

garethmcc wrote: post #34
jiriknesl wrote: post #27

Earlier quoted context omitted.

Well, I guess you are speaking about companies who don't know what they do. But this article speaks about banks, who have hundreds of servers, ability to recover anything, full-time employed ops teams, monitoring & automation in place for 20 years already. Moving to cloud provides very little advantage (definitely not financially) to such companies. They are not SaaS who might need to double their infrastructure over…

Its not as simple as that. Just because its the case of "we have lots of old stuff" doesn't mean you need to ignore the new stuff. Building solutions with traditional data centers and staff, even if you have a lot of it, is often a lot slower. You can spin up entire fleets of servers (or even use services such as AWS Lambda, API Gateway and DynamoDB so you never use servers) and get a solution out in much less the ti…

> Traditional financial services organisations are notoriously slow to adapt to changes in the market. Using cloud resources alongside the legacy infrastructure is one way to try and remain competitive.

Or, you could have a single executive action revamp IT resource acquisition policies. Simply mandate that internalized self-service resource provisioning capabilities be developed.

It is not rocket science to put a web dashboard around vmware or some other virtualization solution. Most of them already sell something like this as part of their feature set.

You could set something like this up in a week if you had enough buy-in. There are no excuses if you want to win at this kind of game. The bad guys are way more patient in aggregate.

A 2nd perspective - One of our customers has a "traditional" process for setting up new IT workloads, and we were still able to get 3 servers provisioned within 8 hours along with 3 new publicly-routable IPv4 addresses and matching DNS+TLS certs. Anything less than this in 2021 for any organization is indicative of sheer incompetence IMO. We do have some customers that are really slow, but they are also really small. I don't think any F500 is taking weeks to provision SQL Server anymore.

Re: Bank of England to crack down on 'secretive' cloud computing services

#44

Post by JackFr »

jiriknesl wrote: post #27
matheusmoreira wrote: post #23

Earlier quoted context omitted.

> Once the risks are reviewed in open and honest ways, we find that virtually all of our clients would prefer to keep our solution on-prem. I hope this kind of risk assessment becomes more common. I'm used to people not caring until things blow up on their faces.

Well, I guess you are speaking about companies who don't know what they do. But this article speaks about banks, who have hundreds of servers, ability to recover anything, full-time employed ops teams, monitoring & automation in place for 20 years already. Moving to cloud provides very little advantage (definitely not financially) to such companies. They are not SaaS who might need to double their infrastructure over…

> Moving to cloud provides very little advantage (definitely not financially) to such companies.

As someone who has worked as a software developer for big NY banks for the past 25 years, that's simply not true.

The answer is, it's complicated. JPMorganChase for instance has a $12 billion annual IT spend. They do a LOT of different things. Admittedly certain things are best left on prem for regulatory audit points (more with respect to resilience/business continuity rather than security.) But a substantial portion of it could be moved to the cloud at some cost savings.

Additionally the brittleness of the service and database infrastructure is a pathology of the on-prem environment rather than an argument for it. Cohorts of SA's and DBA's are wasting their time doing work which in a modern environment would be scripted and more flexible.

Re: Bank of England to crack down on 'secretive' cloud computing services

#45

Post by JackFr »

pmlnr wrote: post #6
MrBuddyCasino wrote: post #4

> But big providers could dictate terms and conditions - as well as prices - to key financial firms. What exactly is the concern here? Cloud compute is becoming cheaper over time due to market forces. Its not like Amazon is cornering the market for CPUs.

> What exactly is the concern here? Top of the article: > Concentration of compute could threaten financial stability. If BigCloud goes down, so does banking, and banking doesn't seem to like that - and I'm with them.

If the ATM stops working because of an AWS outage, I will very much be disappointed in my banking regulator.

Re: Bank of England to crack down on 'secretive' cloud computing services

#46

Post by whatshisface »

bob1029 wrote: post #39
pwarner wrote: post #29

Earlier quoted context omitted.

How is the problem of PII better solved on premises?

Think about it more abstractly from the perspective of trust and # of actors involved. If you run 100% of your IT workload on-prem, the ability to control the flow of data can be boiled down into a physical exercise of following fiber channel cables in your own datacenter. Having a unified set of firewall rules that define your entire public interface also helps a lot. You can actually make deterministic guarantees t…

>the ability to control the flow of data can be boiled down into a physical exercise of following fiber channel cables in your own datacenter

I suppose the infamous Equifax breach was due to a secret fiber optic cable running out of their datacenter?

Re: Bank of England to crack down on 'secretive' cloud computing services

#47

Post by tablespoon »

whatshisface wrote: post #46
bob1029 wrote: post #39

Earlier quoted context omitted.

Think about it more abstractly from the perspective of trust and # of actors involved. If you run 100% of your IT workload on-prem, the ability to control the flow of data can be boiled down into a physical exercise of following fiber channel cables in your own datacenter. Having a unified set of firewall rules that define your entire public interface also helps a lot. You can actually make deterministic guarantees t…

> the ability to control the flow of data can be boiled down into a physical exercise of following fiber channel cables in your own datacenter I suppose the infamous Equifax breach was due to a secret fiber optic cable running out of their datacenter?

> I suppose the infamous Equifax breach was due to a secret fiber optic cable running out of their datacenter?

No, of course not. But when you're dealing with physical infrastructure you can actually touch, it's much clearer and more certain what you're dealing with.

Re: Bank of England to crack down on 'secretive' cloud computing services

#48

Post by xeromal »

pwarner wrote: post #29
bob1029 wrote: post #3

We do business in the US financial sector, and the sentiment we are getting with regard to cloud vs on-prem seems to be growing into a bimodal distribution. I would say it's nearly a 50/50 split until we have conversations about how our product actually works and the incredibly sticky problem that is PII... Once the risks are reviewed in open and honest ways, we find that virtually all of our clients would prefer to…

How is the problem of PII better solved on premises?

Smaller surface area to guard for one.

Re: Bank of England to crack down on 'secretive' cloud computing services

#49

Post by bob1029 »

whatshisface wrote: post #46
bob1029 wrote: post #39

Earlier quoted context omitted.

Think about it more abstractly from the perspective of trust and # of actors involved. If you run 100% of your IT workload on-prem, the ability to control the flow of data can be boiled down into a physical exercise of following fiber channel cables in your own datacenter. Having a unified set of firewall rules that define your entire public interface also helps a lot. You can actually make deterministic guarantees t…

> the ability to control the flow of data can be boiled down into a physical exercise of following fiber channel cables in your own datacenter I suppose the infamous Equifax breach was due to a secret fiber optic cable running out of their datacenter?

No it was due to the officially-endorsed fiber optic cables sitting in plain sight and the fact that they do business with so many other parties.

I work with some intermediate vendors in this space (they have direct access to the credit bureau data), and their security mechanisms are of concern. I am under some very strict NDA constraints, but I can say that there are serious problems and I am not surprised that breaches occur with regular frequency.

You can barely trust your own in-house developers to get these things right. How can you possibly hope to trust many other additional parties to get it right simultaneously as well?

Re: Bank of England to crack down on 'secretive' cloud computing services

#50

Post by game_the0ry »

I worked in a brand-name bank, so I am familiar with the goings in the tech side of finance.

Call me crazy, but I would trust aws, microsoft, and google with my PII and finances before I would trust Wells, BofA, JPMC, Goldman, et al.

The cloud giants pay their engineers more and technologists are second-class citizens at the financial institutions - infer what you want from that.

Post reply on HN