Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How we secure Monzo's banking platform

monzo.com

Post reply on HN
Print view View original

31–40 of 148 posts

Re: How we secure Monzo's banking platform

#31

Post by JMS2021 »

andrewstuart wrote: post #27

The biggest security hole for every organisation is its remote work from home workers. I'd be interested to hear how this Monzo bank addresses the problem of someone walking in the home of one of their programmers and lifting access keys to AWS whilst that person is at the supermarket, and leaving with no-one the wiser. Or installing a keylogger USB device onto their keyboard cable.

You wouldn't run or develop code locally. AWS keys would be secrets managed by Vault or something.

If you have AWS keys on staff laptops at home, you've already failed.

We don't allow any code at all on local machines.

Re: How we secure Monzo's banking platform

#32

Post by chrisseaton »

csmpltn wrote: post #30
chrisseaton wrote: post #25

Earlier quoted context omitted.

I don't think this is the bottomless pit that you think it is. A virtualised instance is a lot more secure than a container, and it's probably fine to stop at virtualised instances.

A lot more secure? In what ways?

Containers are really a kind of process-isolation - you still share a kernel. You can find a lot of people saying that containers aren’t enough for running untrusted user code.

If you run a fully virtualised instance you get your own kernel and aren’t relying on process isolation.

Would you be happy if your cloud provider was running your containers on the same virtual I stance as someone else’s? Most people wouldn’t be.

Re: How we secure Monzo's banking platform

#33

Post by raesene9 »

csmpltn wrote: post #30
chrisseaton wrote: post #25

Earlier quoted context omitted.

I don't think this is the bottomless pit that you think it is. A virtualised instance is a lot more secure than a container, and it's probably fine to stop at virtualised instances.

A lot more secure? In what ways?

So I'll start by saying that security is always relative and what's ok for one environment won't be for another :)

The challenge with Linux containers as used by Docker/Containerd/CRI-O et al, is that containers run against a shared Linux kernel. The Linux kernel has a very large attack surface, so it's easier for attackers to find some way to bypass the restrictions it tries to enforce. If you look at this year there have been several Local Privilege Escalation issues in the Linux Kernel, some of which have allowed for container breakout.

If you compare this to a hardened hypervisor (e.g. Firecracker) there is a much smaller attack surface visible from inside the container. It obviously could have a breakout vuln. but there is a lower chance of that occurring.

Re: How we secure Monzo's banking platform

#34

Post by vladvasiliu »

andrewstuart wrote: post #27

The biggest security hole for every organisation is its remote work from home workers. I'd be interested to hear how this Monzo bank addresses the problem of someone walking in the home of one of their programmers and lifting access keys to AWS whilst that person is at the supermarket, and leaving with no-one the wiser. Or installing a keylogger USB device onto their keyboard cable.

I'd say the keylogger can be an issue if they're able to be alone with the computer for a while. I'm not sure that all laptops can detect that they've been opened (my HP Elitebook and previous Probooks don't), but I'd assume it unlikely that the attacker wouldn't leave other traces in the house.

But other than that, enforcing session auto-locking should work fairly well. Of course, if this is combined with some kind of agent that checks whether you're doing something that the employer defeated with a mouse jigger, all bets are off...

They can also enforce using MFA for AWS (and probably for GCP and Azure, too, but I don't use those) and not use plain access keys.

Re: How we secure Monzo's banking platform

#35

Post by madjam002 »

JMS2021 wrote: post #31
andrewstuart wrote: post #27

The biggest security hole for every organisation is its remote work from home workers. I'd be interested to hear how this Monzo bank addresses the problem of someone walking in the home of one of their programmers and lifting access keys to AWS whilst that person is at the supermarket, and leaving with no-one the wiser. Or installing a keylogger USB device onto their keyboard cable.

You wouldn't run or develop code locally. AWS keys would be secrets managed by Vault or something. If you have AWS keys on staff laptops at home, you've already failed. We don't allow any code at all on local machines.

Where is the codebase kept then? Do you have to remote desktop in to your development environment?

Re: How we secure Monzo's banking platform

#36

Post by Bombthecat »

andrewstuart wrote: post #5

Should banking really be on a cloud platform? I do believe AWS is likely far more secure than any DIY computing environment but even so, should banking be on cloud infrastructure? I'm not saying I think this is a bad idea but it came to mind when I read this. Also, is it really a good idea for a bank to be talking openly about its security strategy? Isn't an important part of security not to let on anything that migh…

To say it with the words of some guys in management why they picked alicloud: it was cheap :)

Re: How we secure Monzo's banking platform

#37

Post by dwb »

mocko wrote: post #28

Disgruntled former Monzo customer here. Do they still have a haywire fraud detection system that randomly freezes innocent people's accounts? It's happened to countless users and the customer experience when they do it ("we refuse to tell you why" and in some cases holding onto their money for months) is a kafkaesque nightmare. https://www.vice.com/en/article/bvg7n3/monzo-freezing-closin... https://www.reddit.com/r/U…

https://monzo.com/blog/2019/04/04/why-we-block-freeze-close-...

Re: How we secure Monzo's banking platform

#38

Post by MaxBarraclough »

mocko wrote: post #28

Disgruntled former Monzo customer here. Do they still have a haywire fraud detection system that randomly freezes innocent people's accounts? It's happened to countless users and the customer experience when they do it ("we refuse to tell you why" and in some cases holding onto their money for months) is a kafkaesque nightmare. https://www.vice.com/en/article/bvg7n3/monzo-freezing-closin... https://www.reddit.com/r/U…

> "we refuse to tell you why" and in some cases holding onto their money for months

I don't know anything about Monzo specifically, but perhaps anti-money-laundering laws might be the reason. Monzo is presumably obligated to take steps against money laundering, under UK law, where it's essentially an offence to say Our system has flagged you as a potential money-launderer. [0] Freezing your account without comment may be their safest course of action.

edit I see this explanation was mentioned in the reddit thread.

[0] https://www.lawsociety.org.uk/en/topics/anti-money-launderin...

Re: How we secure Monzo's banking platform

#39

Post by YawningAngel »

mocko wrote: post #28

Disgruntled former Monzo customer here. Do they still have a haywire fraud detection system that randomly freezes innocent people's accounts? It's happened to countless users and the customer experience when they do it ("we refuse to tell you why" and in some cases holding onto their money for months) is a kafkaesque nightmare. https://www.vice.com/en/article/bvg7n3/monzo-freezing-closin... https://www.reddit.com/r/U…

No UK bank will ever tell you why your account is frozen, and this is why: https://www.cps.gov.uk/legal-guidance/money-laundering-offen....

Source: used to work on Monzo's financial crime team.

Re: How we secure Monzo's banking platform

#40

Post by jl6 »

carnitine wrote: post #7
andrewstuart wrote: post #5

Should banking really be on a cloud platform? I do believe AWS is likely far more secure than any DIY computing environment but even so, should banking be on cloud infrastructure? I'm not saying I think this is a bad idea but it came to mind when I read this. Also, is it really a good idea for a bank to be talking openly about its security strategy? Isn't an important part of security not to let on anything that migh…

I don’t see why banking shouldn’t be on a cloud platform, you’re not really giving any reason why we should question it either. As to your second point, security through obscurity is generally believed to not be worthwhile.

> As to your second point, security through obscurity is generally believed to not be worthwhile.

Security only through obscurity - sure.

But obscurity as an additional layer, as part of a defence in depth strategy, still has some value.

It’s rare for any large org to publicly discuss any details of its security design, let alone a bank. Monzo must be supremely confident in their system to go public with this information, or judge that the marketing/recruitment benefit outweighs any potential risk.

Post reply on HN