Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How we secure Monzo's banking platform

monzo.com

Post reply on HN
Print view View original

11–20 of 148 posts

Re: How we secure Monzo's banking platform

#11

Post by chrisseaton »

Narkov wrote: post #8

> more than 20,000 containerised workloads across more than 2000 microservices to date. This is insane . What am I missing here that an organization is bragging about having 2000 moving parts?

Not sure they're bragging about it - they're just stating it as context for their blog post.

And is 2000 moving parts too many? How many moving parts do you need to run a bank? I can imagine they're having to comply with ~2000 legislation clauses, for example. Isn't that just the complexity of their domain?

Re: How we secure Monzo's banking platform

#12

Post by nly »

ivan_gammel wrote: post #10
Narkov wrote: post #8

> more than 20,000 containerised workloads across more than 2000 microservices to date. This is insane . What am I missing here that an organization is bragging about having 2000 moving parts?

Those moving parts are defined by the complexity of the business. Banking software with 20000 classes deployed in J2EE application server on a mainframe would not be much different.

That's not really true, since microservices involve what boils down to RPC over a network. There are so many more failure modes involved when you have 2000 asynchronous processes talking to one.

Re: How we secure Monzo's banking platform

#13

Post by tluyben2 »

andrewstuart wrote: post #5

Should banking really be on a cloud platform? I do believe AWS is likely far more secure than any DIY computing environment but even so, should banking be on cloud infrastructure? I'm not saying I think this is a bad idea but it came to mind when I read this. Also, is it really a good idea for a bank to be talking openly about its security strategy? Isn't an important part of security not to let on anything that migh…

When cloud computing started, our banking clients said ‘never’ to the cloud. Now it is fairly normal depending on the region. In some countries in Asia and the Middle East, it is not allowed yet.

Re: How we secure Monzo's banking platform

#14

Post by NamTaf »

Narkov wrote: post #8

> more than 20,000 containerised workloads across more than 2000 microservices to date. This is insane . What am I missing here that an organization is bragging about having 2000 moving parts?

How is it insane? Do you think factories don't have 2000 total pieces of equipment that go into manufacturing widgets?

Quantity of moving parts is a nearly worthless metric on its own without describing the scale and complexity of those moving parts.

Re: How we secure Monzo's banking platform

#15

Post by Milner08 »

Narkov wrote: post #8

> more than 20,000 containerised workloads across more than 2000 microservices to date. This is insane . What am I missing here that an organization is bragging about having 2000 moving parts?

They seem to be operating very well with the 2000 services (the number doesn't seem to have changed much in the last few years which is interesting, despite them adding new features, etc).

The domain is obviously very complex as its not just a ledger, but risk, loans, overdrafts, savings, etc as well as premium offerings, interacting with different payments networks like FasterPayments and Mastercard. Then there are the budgeting features, payments between friends, support system (Which is probably quite complex in its self), card issuing, internal dashboards and metric services, etc, etc, etc. I can easily see how this gets to 2000 services and I didn't even begin to think about the business accounts, US accounts, etc.

Re: How we secure Monzo's banking platform

#16

Post by andrewstuart »

carnitine wrote: post #7
andrewstuart wrote: post #5

Should banking really be on a cloud platform? I do believe AWS is likely far more secure than any DIY computing environment but even so, should banking be on cloud infrastructure? I'm not saying I think this is a bad idea but it came to mind when I read this. Also, is it really a good idea for a bank to be talking openly about its security strategy? Isn't an important part of security not to let on anything that migh…

I don’t see why banking shouldn’t be on a cloud platform, you’re not really giving any reason why we should question it either. As to your second point, security through obscurity is generally believed to not be worthwhile.

>> I don’t see why banking shouldn’t be on a cloud platform

What if AWS gets cracked/hacked/compromised?

I know it's not happened yet, but it's not impossible.

Re: How we secure Monzo's banking platform

#17

Post by eicnix »

raesene9 wrote: post #9
andrewstuart wrote: post #5

Should banking really be on a cloud platform? I do believe AWS is likely far more secure than any DIY computing environment but even so, should banking be on cloud infrastructure? I'm not saying I think this is a bad idea but it came to mind when I read this. Also, is it really a good idea for a bank to be talking openly about its security strategy? Isn't an important part of security not to let on anything that migh…

On the first point, I don't see any particular reason why banking shouldn't go with cloud. Obviously banking has regulatory hurdles and things like availability are important so it'll require a specific architecture to help achieve that, but in general shouldn't be a problem. On the second point, I'd say it depends on the level of granularity and detail. Here they're describing general mechanisms and they're not sayi…

All you need is a single disgruntled ex-employee to be bribed by hackers to reveal your complete security design.

Re: How we secure Monzo's banking platform

#18

Post by tokamak-teapot »

Narkov wrote: post #8

> more than 20,000 containerised workloads across more than 2000 microservices to date. This is insane . What am I missing here that an organization is bragging about having 2000 moving parts?

What’s insane about it? Tooling provides what’s needed to build, test, scan, deploy, manage and monitor.

Re: How we secure Monzo's banking platform

#19

Post by tome »

andrewstuart wrote: post #16
carnitine wrote: post #7

Earlier quoted context omitted.

I don’t see why banking shouldn’t be on a cloud platform, you’re not really giving any reason why we should question it either. As to your second point, security through obscurity is generally believed to not be worthwhile.

>> I don’t see why banking shouldn’t be on a cloud platform What if AWS gets cracked/hacked/compromised? I know it's not happened yet, but it's not impossible.

I guess there are two important questions:

* For individual banks and their customers, is it more likely that an AWS-wide exploit will compromise an AWS-hosted bank, or is it more likely that a self-hosting-specific exploit will compromise a self-hosted bank?

* For society, is it better that security efforts are concentrated in on centralised providers like AWS, or is it better that security efforts are distributed, on individual hosting entities?

Re: How we secure Monzo's banking platform

#20

Post by dmitriid »

andrewstuart wrote: post #16
carnitine wrote: post #7

Earlier quoted context omitted.

I don’t see why banking shouldn’t be on a cloud platform, you’re not really giving any reason why we should question it either. As to your second point, security through obscurity is generally believed to not be worthwhile.

>> I don’t see why banking shouldn’t be on a cloud platform What if AWS gets cracked/hacked/compromised? I know it's not happened yet, but it's not impossible.

That's more or less the same question as "what if the data center/servers operated by the bank gets compromised".

In reality it's always about tradeoffs: who to delegate to and who to trust.

Post reply on HN