Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bank of England to crack down on 'secretive' cloud computing services

itnews.com.au

Post reply on HN
Print view View original

81–90 of 123 posts

Re: Bank of England to crack down on 'secretive' cloud computing services

#81

Post by DrBazza »

throwaway_2047 wrote: post #55
DrBazza wrote: post #20

One of the (legal ?) requirements we had to meet back in the 00s was that financial software (quant code, options trading) was "reproducible" for some length of time (7 years?). That meant: version control (SCCS, CVS, svn), archiving OS versions (SunOS, Solaris), and kit (Sun workstations and servers). I have no idea if the last 2 ("OS", hardware) is even achievable in 2021. I can always get my source code from git,…

What about having regulations updated instead of bending the industry backward to fit the outdated regulations?

I can't testify to my statement being 100% true without a lot of tedious searching on the UK FSA/SFA/FCA/whatever they are now's website. But that's what I have a vague recollection of.

It's similar to HMRC's "we can come after you for unpaid tax for 7 years", but you can only go after the HMRC for 5 years for overpaid tax.

The rules are ultimately for the benefit of long term investigations such as the LIBOR rigging, and Guinness trials.

https://www.theguardian.com/business/2016/jul/04/libor-riggi...

https://en.wikipedia.org/wiki/Guinness_share-trading_fraud

Re: Bank of England to crack down on 'secretive' cloud computing services

#82

Post by selfhoster11 »

DrBazza wrote: post #20

One of the (legal ?) requirements we had to meet back in the 00s was that financial software (quant code, options trading) was "reproducible" for some length of time (7 years?). That meant: version control (SCCS, CVS, svn), archiving OS versions (SunOS, Solaris), and kit (Sun workstations and servers). I have no idea if the last 2 ("OS", hardware) is even achievable in 2021. I can always get my source code from git,…

OS is reproducible with artifact repositories for OS and library packages. Hardware perhaps less so, but I guess a custom deal could be worked out with the right supplier. That, or go with emulation.

Re: Bank of England to crack down on 'secretive' cloud computing services

#83

Post by andrewzah »

wolverine876 wrote: post #78
surfingdino wrote: post #40

One secretive group used to dictating their own terms unhappy about another secretive group used to dictating their own terms...

The Bank of England is under the democratic control of the people of England.

*In theory. However, in practice...

Re: Bank of England to crack down on 'secretive' cloud computing services

#84

Post by davidgerard »

asaikali wrote: post #77

I think a big risk is a cpu level security issue similar to meltdown or spectre that ends up weakening the hardware isolation between tenants to the point where it can be exploited on mass on the cloud providers to wreak havoc. The probability of something like this happening is very low but not zero, I would say same level of probability as datacenter fire or earthquake banks should be planning for how to handle thi…

Separate hardware for your stuff is a standard AWS product, for example - you can just buy this.

Re: Bank of England to crack down on 'secretive' cloud computing services

#85

Post by peteretep »

Cloud computing feels like one area we have fantastic competition in, even if there are only 3 major players (with one or two smaller ones). Feature and price competition between AWS and Azure is fierce, and if you’re dumb enough to have any trust at all in Google as a supplier then there’s even GCP.

Re: Bank of England to crack down on 'secretive' cloud computing services

#86

Post by lbriner »

tablespoon wrote: post #47
whatshisface wrote: post #46

Earlier quoted context omitted.

> the ability to control the flow of data can be boiled down into a physical exercise of following fiber channel cables in your own datacenter I suppose the infamous Equifax breach was due to a secret fiber optic cable running out of their datacenter?

> I suppose the infamous Equifax breach was due to a secret fiber optic cable running out of their datacenter? No, of course not. But when you're dealing with physical infrastructure you can actually touch, it's much clearer and more certain what you're dealing with.

I don't think that is as true as you make it sound. I have managed on-prem and cloud infrastructure and am much more confident that my cloud servers are secure because a whole lot of stuff is done by the provider who know a lot more than me between them.

Even on a really simple on-prem scenario, you have switches to configure, vlans to setup, hardware drivers, a gazillion updates to make all the time and a tonne of employees making it all very difficult. The fact I can see it physically doesn't realy help me that much.

Re: Bank of England to crack down on 'secretive' cloud computing services

#87

Post by lbriner »

oliwarner wrote: post #42
pwarner wrote: post #29

Earlier quoted context omitted.

How is the problem of PII better solved on premises?

What's the worst that can happen in a on-premises attack, Vs the worst that could happen if AWS was hacked? The amount of financial data that could be exploited at once is magnitudes larger in a popular cloud. I don't think it's strange that a regulator might look at that failure point with some trepidation.

On the other hand, at least AWS, Azure etc. all have a vested interest in doing things well and securely. At a bank, most employees know nothing and care nothing about the HW and SW systems, they just use and abuse them.

Re: Bank of England to crack down on 'secretive' cloud computing services

#88

Post by tristor »

game_the0ry wrote: post #50

I worked in a brand-name bank, so I am familiar with the goings in the tech side of finance. Call me crazy, but I would trust aws, microsoft, and google with my PII and finances before I would trust Wells, BofA, JPMC, Goldman, et al. The cloud giants pay their engineers more and technologists are second-class citizens at the financial institutions - infer what you want from that.

Definitely agree. Having worked extensively with some large banks I've found that they are absolutely cutting edge in technology in one area and one area only: credit card fraud analytics. That's because credit card fraud creates a material financial risk for the bank that they can't defer to someone else. Most other risks banks deal with are managed through complex financial hedging, government backstops, or insurance schemes and so they invest very little in doing anything "correctly". Rather, almost everything about banking compliance is driven by checkbox tickers and not by experts.

Re: Bank of England to crack down on 'secretive' cloud computing services

#89

Post by lbriner »

asaikali wrote: post #77

I think a big risk is a cpu level security issue similar to meltdown or spectre that ends up weakening the hardware isolation between tenants to the point where it can be exploited on mass on the cloud providers to wreak havoc. The probability of something like this happening is very low but not zero, I would say same level of probability as datacenter fire or earthquake banks should be planning for how to handle thi…

I don't see that this risk is any different than a similar apocolyptic failure happening to your on-prem equipment. There's not much you can do about it differently than the cloud just add some extra controls and hope for the best.

I very much doubt that anyone would not use the cloud because of a theoretical de-isolation bug.

Also, by the time you found out, it would probably already be too late anyway if you were a victim. If not, you just switch it off.

Re: Bank of England to crack down on 'secretive' cloud computing services

#90

Post by lbriner »

tristor wrote: post #88
game_the0ry wrote: post #50

I worked in a brand-name bank, so I am familiar with the goings in the tech side of finance. Call me crazy, but I would trust aws, microsoft, and google with my PII and finances before I would trust Wells, BofA, JPMC, Goldman, et al. The cloud giants pay their engineers more and technologists are second-class citizens at the financial institutions - infer what you want from that.

Definitely agree. Having worked extensively with some large banks I've found that they are absolutely cutting edge in technology in one area and one area only: credit card fraud analytics. That's because credit card fraud creates a material financial risk for the bank that they can't defer to someone else. Most other risks banks deal with are managed through complex financial hedging, government backstops, or insuran…

I think it is unfair to think that banks don't want to do things correctly but they suffer along with all other corporates of too many levels of management to be agile, systems that are far to risky to change/replace, legacy systems and a high turnover of staff. If I ran a bank, I suspect I would run it exactly the same way because I have to.
Post reply on HN