Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bank of England to crack down on 'secretive' cloud computing services

itnews.com.au

Post reply on HN
Print view View original

101–110 of 123 posts

Re: Bank of England to crack down on 'secretive' cloud computing services

#101

Post by fulafel »

asaikali wrote: post #77

I think a big risk is a cpu level security issue similar to meltdown or spectre that ends up weakening the hardware isolation between tenants to the point where it can be exploited on mass on the cloud providers to wreak havoc. The probability of something like this happening is very low but not zero, I would say same level of probability as datacenter fire or earthquake banks should be planning for how to handle thi…

We can be almost certain that there are sw and hw vulnerabilities that can be so exploited, given the rate of discovery and knowing what now-public hypervisor and cpu vulns a time traveler from today could exploit eg 5 or 10 years in the past.

Re: Bank of England to crack down on 'secretive' cloud computing services

#102

Post by tristor »

lbriner wrote: post #90
tristor wrote: post #88

Earlier quoted context omitted.

Definitely agree. Having worked extensively with some large banks I've found that they are absolutely cutting edge in technology in one area and one area only: credit card fraud analytics. That's because credit card fraud creates a material financial risk for the bank that they can't defer to someone else. Most other risks banks deal with are managed through complex financial hedging, government backstops, or insuran…

I think it is unfair to think that banks don't want to do things correctly but they suffer along with all other corporates of too many levels of management to be agile, systems that are far to risky to change/replace, legacy systems and a high turnover of staff. If I ran a bank, I suspect I would run it exactly the same way because I have to.

Perhaps I'm too close to the issue as I have worked with these businesses, but I disagree. This is intentional on their part, because banks first and foremost are about identifying and managing risk. If they can find a way to mitigate that risk or externalize it, then they no longer need to deal with it head-on. Most of the risks related to IT should be dealt with head-on because they grow over time as you stay still and technology moves further away from you, and it's impossible for anyone to accurately predict the future and therefore future risks.

Many banks and other financial institutions are finding this out now in their desperate bid to find competent COBOL programmers to continuing maintaining legacy critical applications running on mainframes when most COBOL programmers are retired or dead, and more are headed that way every day. It wouldn't shock me to find out that the effects of COVID being weighted towards worse outcomes for older people had a material effect on the human resource risk of using COBOL-based critical systems.

Banks will absolutely hold on to anything to avoid an unknown risk as long as they think they can hedge or mitigate known risks, and utterly fail to acknowledge the truth of unknown unknowns. This will ultimately be their downfall if governments ever let them follow standard business outcomes, otherwise they'll eventually absorb some upstart to keep hedging forever.

Re: Bank of England to crack down on 'secretive' cloud computing services

#103

Post by jollybean »

We need a better 'Open Stack' for cloud stuff.

So that you can just run a bunch of your own servers, lay over the 'Stack' and then get nice Lambdas, provisioning, and other things.

Imagine if you could just buy some hardware, and have some regular IT guys reproduce most of Amazon without the Amazon?

That would be a 'reverse revolution'.

National Regulators could also support strategic investment in the sector, i.e. 'financial ops have to be backed-up in-nation by a local provider' i.e. some kind of forced local diversity in the system by regulatory fiat. As an idea.

Re: Bank of England to crack down on 'secretive' cloud computing services

#104

Post by nobodyandproud »

feu wrote: post #72
nobodyandproud wrote: post #62

Earlier quoted context omitted.

Goldman’s payday is through bonuses, not the base salary.

Only if you're in a front office role, which the vast majority of SWEs aren't.

No? Even at entry level, you’re still getting $150k for base+bonus. You can expect at least 25% to be bonus if not more.

Maybe you and I have a different concept of payday.

What makes GS less than FAANG is the annual stock grant FAANGs throw at software engineers, and of course it Finance.

Re: Bank of England to crack down on 'secretive' cloud computing services

#105

Post by nobodyandproud »

nobodyandproud wrote: post #66

This is a good conversation to have. There are no meaningful guarantees that cloud providers won’t scrape data or ideas. Then there’s the cost: Cloud is extremely expensive over the long run; more-so than the equivalent on-prem. The long term solution here is to add better Internet in all regions, similar to our highway system today. Then any company of a large enough size can build out their own DCs on the cheap. It…

Some ups and downs, but cloud’s value isn’t really for its costs.

Re: Bank of England to crack down on 'secretive' cloud computing services

#106

Post by [deleted] »

JackFr wrote: post #44
jiriknesl wrote: post #27

Earlier quoted context omitted.

Well, I guess you are speaking about companies who don't know what they do. But this article speaks about banks, who have hundreds of servers, ability to recover anything, full-time employed ops teams, monitoring & automation in place for 20 years already. Moving to cloud provides very little advantage (definitely not financially) to such companies. They are not SaaS who might need to double their infrastructure over…

> Moving to cloud provides very little advantage (definitely not financially) to such companies. As someone who has worked as a software developer for big NY banks for the past 25 years, that's simply not true. The answer is, it's complicated. JPMorganChase for instance has a $12 billion annual IT spend. They do a LOT of different things. Admittedly certain things are best left on prem for regulatory audit points (mo…

[deleted]

Re: Bank of England to crack down on 'secretive' cloud computing services

#107

Post by oliwarner »

lbriner wrote: post #87
oliwarner wrote: post #42

Earlier quoted context omitted.

What's the worst that can happen in a on-premises attack, Vs the worst that could happen if AWS was hacked? The amount of financial data that could be exploited at once is magnitudes larger in a popular cloud. I don't think it's strange that a regulator might look at that failure point with some trepidation.

On the other hand, at least AWS, Azure etc. all have a vested interest in doing things well and securely. At a bank, most employees know nothing and care nothing about the HW and SW systems, they just use and abuse them.

Why do you think banks don't have vested interest?

And I don't expect my cleaner to service my car. Banks have DBAs, network and physical security experts on tap (just like cloud providers do).

Re: Bank of England to crack down on 'secretive' cloud computing services

#108

Post by bob1029 »

wolverine876 wrote: post #76
bob1029 wrote: post #39

Earlier quoted context omitted.

Think about it more abstractly from the perspective of trust and # of actors involved. If you run 100% of your IT workload on-prem, the ability to control the flow of data can be boiled down into a physical exercise of following fiber channel cables in your own datacenter. Having a unified set of firewall rules that define your entire public interface also helps a lot. You can actually make deterministic guarantees t…

> You can actually make deterministic guarantees to your customers that not only your own systems are secure, but also that the systems of your vendors and other 3rd parties are as well. You can make a "deterministic" guarantee, whatever that is, that your systems are secure? That's seems pretty bold and probably dangerous, no?

> That's seems pretty bold and probably dangerous, no?

Its not dangerous in my experience. The more dangerous angle for me is this belief that it is impossible (or hopelessly difficult) to build a secure system.

The reality is that it is only possible if you are willing to take total ownership of the entire vertical. If you control every single byte that enters and exits your enterprise, you can prove that things are secure. Is it practical to do this in all cases? No. Is it feasible in theory and in certain cases? Absolutely.

If you buy into the 3rd party hosting game, you instantly lose control over the critical variables you would need to in order to create the opportunity for these sorts of guarantees to exist in the first place. You (and your customers) will be stuck wondering about side channel damage and human factors that you have no direct control over. When you own the hardware and the real estate it is parked on top of, you can start to reel these things back in really quickly with powerful policy frameworks (2-person rules for critical changes, mandatory checklists, etc). These sorts of policies seem to work really well for very tricky areas like keeping our nuclear weapons from doing inappropriate things.

Re: Bank of England to crack down on 'secretive' cloud computing services

#109

Post by delfinom »

marcosdumay wrote: post #74
bob1029 wrote: post #39

Earlier quoted context omitted.

Think about it more abstractly from the perspective of trust and # of actors involved. If you run 100% of your IT workload on-prem, the ability to control the flow of data can be boiled down into a physical exercise of following fiber channel cables in your own datacenter. Having a unified set of firewall rules that define your entire public interface also helps a lot. You can actually make deterministic guarantees t…

> If we are being honest with ourselves, a lot of shops that are 100% on-prem probably have worse security practices than AWS, et. al. Does it matter? You have the same freedom to fuck security up setting your AWS infrastructure as you have setting your on-prem infrastructure. All the very competent AWS staff is able to do is add less risk, they can't save you from anything.

Good ol IAM basically being an incoherent Json programming language documented in gibberish.

Re: Bank of England to crack down on 'secretive' cloud computing services

#110

Post by delfinom »

lbriner wrote: post #86
tablespoon wrote: post #47

Earlier quoted context omitted.

> I suppose the infamous Equifax breach was due to a secret fiber optic cable running out of their datacenter? No, of course not. But when you're dealing with physical infrastructure you can actually touch, it's much clearer and more certain what you're dealing with.

I don't think that is as true as you make it sound. I have managed on-prem and cloud infrastructure and am much more confident that my cloud servers are secure because a whole lot of stuff is done by the provider who know a lot more than me between them. Even on a really simple on-prem scenario, you have switches to configure, vlans to setup, hardware drivers, a gazillion updates to make all the time and a tonne of e…

For one, at a certain scale you shouldn't be running an inhouse DC solo, you can get away with it more in the cloud but at a certain ace again you want more manpower for review/auditing and brain/man power. Most of what you described aren't actually principle attack vectors either. The primary vectors are the same between on premise and cloud. Misconfigured VPNs, stolen VPN credentials, poor network segmentation (Cloud absolutely does not fix this for you, you still need brain power and auditing to find accidental misconfigs).
Post reply on HN