How we secure Monzo's banking platform
1–10 of 148 posts
Re: How we secure Monzo's banking platform
#2Good to see some practices like default deny networking (ingress and egress) and very limited interactive production access being laid out here.
A couple of other areas that aren't mentioned, although perhaps they're still doing them are around container breakout risks.
There's no mention of what (if any)hardening is being done on the container runtime, either restrictive seccomp, Apparmor/SELinux policies or using something like gVisor/Firecracker. With this year's number of container breakout CVEs, seems like an important area.
A related one is whether container aware runtime security is being used to detect where an attacker might have got access to a single container and be trying to breakout to either the underlying platform or to other containers in the cluster.
Re: How we secure Monzo's banking platform
#3I think it's great that more companies are open about what they are doing for security. It makes it sound like they are confident in their abilities unlike other people who are nervous to mention things like "We use Octopus" or "We use AKS" because we are less confident that the information is not an invitation to a hacker!
Now all we need is to somehow capture some of this "best practice" and make it normal practice, enabled by default and documented well so that organisations don't set stuff up and then disable all the controls because it is too hard to understand.
Re: How we secure Monzo's banking platform
#4I think it's great that more companies are open about what they are doing for security. It makes it sound like they are confident in their abilities unlike other people who are nervous to mention things like "We use Octopus" or "We use AKS" because we are less confident that the information is not an invitation to a hacker! Now all we need is to somehow capture some of this "best practice" and make it normal practice…
One reason why companies would not do this is to give a little bit of protection against zero-days. When a zero-day is released all providers notice a huge scan for the vulnerability. Scanning huge blocks of the internet takes time but if a hacker has a list of companies using which tools and where it can be narrowed down a lot.
AWS/Azure/GCP/... for example have published IP-ranges of services. If a zero-day for any of those services is released a hacker can already narrow down the attack-range and gain a lot of time.
Re: How we secure Monzo's banking platform
#5Should banking really be on a cloud platform?
I do believe AWS is likely far more secure than any DIY computing environment but even so, should banking be on cloud infrastructure? I'm not saying I think this is a bad idea but it came to mind when I read this.
Also, is it really a good idea for a bank to be talking openly about its security strategy? Isn't an important part of security not to let on anything that might be used against you? For example if determined hackers know your systems then they can keep an eye out long term for vulnerabilities in those technologies and be ready to strike. Does this sort of thing matter or not?
Re: How we secure Monzo's banking platform
#6Good to see some practices like default deny networking (ingress and egress) and very limited interactive production access being laid out here. A couple of other areas that aren't mentioned, although perhaps they're still doing them are around container breakout risks. There's no mention of what (if any)hardening is being done on the container runtime, either restrictive seccomp, Apparmor/SELinux policies or using s…
Exactly. containers are not secure sandboxes by default and if one is breached all those K8s networking ACLs are worthless.
Re: How we secure Monzo's banking platform
#7Should banking really be on a cloud platform? I do believe AWS is likely far more secure than any DIY computing environment but even so, should banking be on cloud infrastructure? I'm not saying I think this is a bad idea but it came to mind when I read this. Also, is it really a good idea for a bank to be talking openly about its security strategy? Isn't an important part of security not to let on anything that migh…
I don’t see why banking shouldn’t be on a cloud platform, you’re not really giving any reason why we should question it either.
As to your second point, security through obscurity is generally believed to not be worthwhile.
Re: How we secure Monzo's banking platform
#8> more than 20,000 containerised workloads across more than 2000 microservices to date.
This is insane. What am I missing here that an organization is bragging about having 2000 moving parts?
Re: How we secure Monzo's banking platform
#9Should banking really be on a cloud platform? I do believe AWS is likely far more secure than any DIY computing environment but even so, should banking be on cloud infrastructure? I'm not saying I think this is a bad idea but it came to mind when I read this. Also, is it really a good idea for a bank to be talking openly about its security strategy? Isn't an important part of security not to let on anything that migh…
On the first point, I don't see any particular reason why banking shouldn't go with cloud. Obviously banking has regulatory hurdles and things like availability are important so it'll require a specific architecture to help achieve that, but in general shouldn't be a problem.
On the second point, I'd say it depends on the level of granularity and detail. Here they're describing general mechanisms and they're not saying that this is all they do, so I think it's a good thing.
In general relying on obscurity for your security is a bad idea, as attackers will often find a way to get that information. That said I wouldn't give attackers a complete schematic of my env. and every protection, no sense in making things easy for them :)
Re: How we secure Monzo's banking platform
#10> more than 20,000 containerised workloads across more than 2000 microservices to date. This is insane . What am I missing here that an organization is bragging about having 2000 moving parts?
Those moving parts are defined by the complexity of the business. Banking software with 20000 classes deployed in J2EE application server on a mainframe would not be much different.