How To Sign Kansas Banking Form

How to industry sign banking kansas form secure

I have the distinct pleasure of helping to kick off this afternoon and devstack ops days here at RSA this is going to be a really interesting presentation if you are in financial services if you have a gigantic organization that you have to manage if you have an organization that has the responsibility for moving billions of dollars and transactions around the world if you're operating in a highly governed organization with lots of policies and processes that you have to follow that are probably state local federal and everything in between this is part of how you live at the Federal Reserve Bank of New York these guys are going to share a lot of how they're using some common services and common infrastructure to minimize the vulnerability defect ratios within the Federal Bank of New York's application portfolio so defect density was talk or vulnerability defect density was talked a lot about this morning I think you guys are going to hear a little more of that this afternoon and what these guys are doing and I actually had the pleasure about 20 years ago of working with Collin wine when we were both back at HP now at the Federal Reserve and Johnathan DeRose his colleague as well that are going to share their story of their devstack ops journey so without further ado Colin and Jonathan take it away right thanks Derek ok so first thing you know I do work in a very heavily regulated environment so here's our legal disclaimer that the views we express here are our own and do not represent necessarily represent Bank of New York or the FRS right so this is an indication of the kinds of stuff that we talked about so hopefully everyone remembers your fifth grade civics and so the ferry's our system is unlike a lot of the other central banks around the world we're actually broken up into border governors that are actually government employees and then there's actually twelve independent legal entities there are technically nonprofits that are distributed around the country and that was set up a hundred years ago before technology so because of the legal structure and in the way that we actually operate and the way it was structure that makes Act a very interesting to try and do things like DevOps or even application development with a common kind of sets of tools because there's no one to escalate issues with right so there's nobody if I have an issue with say San Francisco about how they are operating there's no way for me to really escalate that because there's no common reporting structure unlike in typical kind of large company you know there's always a CEO here there's actually equivalent of 12 bank presidents and there's nobody really above them to kind of force communication so we spend a lot of our time kind of like herding cats right that's kind of the goal of what we are end up having to do a lot more communication and it gets a lot of interesting on on how different people operate and so we'll talk a little bit about some of that that we do so my name is Colin wine I'm responsible for the common services organization within the Farah of Bank of New York and we kind of act as the best way of describing is the little software house so we have I have half a dozen teams and a couple of them we're gonna really going to talk about today first one is the reuse team so we build reusable libraries and micro services that are embedded into large scale applications right so we go from your tiny application the cafeteria menu system all the way up to Fedwire and fatwa roughly does about a thousand trillion dollars a year in transaction volume right so we go from you know a few transactions a day on cafeteria menu system all the way up to systemically and poor our critical applications and all in between and so that really is where we get into you know a lot of concerns about security right so we talk about applications can't go down right fed water can't go down right so Fedwire roughly does I think the two thousand nine public they are about two to four trillion dollars a day so if we were to go down right that's a hit on the economy right so it's that level of criticality that we're talking about with the tools and the reuse that we do so what we've done with this reuse team is built a series of libraries and some micro services they're actually then embedded into these applications not just in New York but actually developers across the whole of the Federal Reserve System and then the other piece that we're going to talk about today is a standardized set of tools to allow everybody to build and then deploy our applications and again it doesn't really matter if it's a really small application or if it's a you know a very large and complicated application the idea is we want to treat all of them very similarly because of the risks and the the level of exposures that we are under so this pass it on to Jonathan and we can talk about the different types of applications great thanks so my name is Jonathan Rose I work with Colin in the common services organization and I'm gonna talk through some of what how we came to to be where we are so we started common services seven eight years ago and when we did we were looking at our application portfolio when we were looking at the landscape and we were looking how our applications being built first in New York and then we've slowly sort of expanded the view to across the system but what we saw was team making all the decisions in silos so their approach to security would be maybe maybe consistent for the team but certainly not beyond a team and hopefully a little consistent from app to app within that team same thing for the tooling how are they were doing builds how are they like what servers were they running on everything every sort of everything was a snowflake and what we sort of recognized was this was one tremendously inefficient but was also tremendously risky so because everything is different you have no no way to to measure and we and Colin didn't really introduce the next sort of topic we're gonna get into is the the tooling so we had very limited visibility into how everyone was doing everything so what we looked at was we could say alright let's let's build these different silos and let's figure out can we come up with standard ways to do these things and the standard doesn't mean exactly every application is going to be the exact same but it means we're gonna give a certain amount of guidance a certain amount of boundaries that a certain amount of services that will allow applications to to have that sort of consistency of approach so developers can really be focusing on that top level of building that business value and not reinventing authentication authorization for every single application so fast forward to today are very small reuse team accounts for roughly a third of the custom written code in the organization and it's about it's less than a percent of the overall development size so tremendous tremendous impact in hundreds of applications so then what we started to do is we said all right how can we share this across the system and so the idea was let's let's take this and we'll form a virtual team right so so as Colin was alluding we have members working out of our team from San Francisco from the Federal Reserve Bank of Kansas City folks in Atlanta folks in Minneapolis and really sort of building that that cross district model because again we don't have a way to to sort of raise the you know you can't raise issues yet at the same time you're inextricably linked if there's a vulnerability if there's if there's you know there's a lot of talk of Equifax this morning if there's an Equifax situation in the Federal Reserve Bank of Chicago the entire Federal Reserve that that distinction of that was Chicago will be certainly lost with the general public and and is not where we want to be so we are in extra extra be linked with organizations that again we don't have a line of reporting up to so it's an interesting challenge that we've been going on for the past couple years to build these virtual teams to get sort of sort of the the horses marching in the same direction and but we're getting there and so it's a really really exciting place to be so so we've got we've got libraries for security we've got the standard tooling we've got we built a reference architecture I think four years ago that was that was a that was a wonderful new thing for the Federal Reserve System so just on and on basically our goal is to say at each one of these levels how can we have teams be able to on board so again greenfield applications it's easy you just take the whole stack but one of the other things we had to really be mindful of is within any one of these layers we've got a lot of long-lived applications right and so when we started this people would say oh we can't we can't use your authorization component we've got our own and you know our apps our apps working fine and so how do you account for that how do you adjust for that and how do you how do you build into teams sort of portfolio to upgrading and maintained over time and so where we sort of got with this was a bigger focus on technical debt and labeling and introducing and and sort of pushing that through the organization and through the system in terms of thinking about you need so as we think of ourselves as a small little software house you you think of this as open as the equivalent of open source so the idea of doing that culture ship to have everyone think of I have to update my internal code the same way I have to update my open source code whether it was led to some success with that so with that I think I'm gonna pass it back to Colin right into for counter or three categories but here you go okay so the whole idea what we've started to build and you know this is always an ongoing process is is a set of tools that lor developers then our operations to actually look at what's actually going on in our pipeline and be able to have a look at it from for example from a quality perspective so if you remember your typical application that we see has a lot of open-source components in it so we're always worried about vulnerabilities in the open source you know as Equifax found out but you know we have that level of concern is what are the libraries we're using what are the libraries that we are look to using and making sure that they're gonna be backed by some level of support so we never really want to take on you know the latest greatest you know JavaScript library that Jewel and his garage put together over the last few weeks and it might have a really neat feature but you know there's no kind of tenure to it and there's no kind of visibility across a lot of the industry so we actually look at a lot of the open source libraries we want to try and see okay is this gonna be long-lived is this gonna actually have some level of support behind it so that as it evolves it's gonna evolve in a direction that we really want to see and then you know is what happens if there is an issue right can we actually get a patch for it very quickly and all of that so you know we we actually go to our developers right and we'll actually say no no you can't use this really cool widget you know happens all the time with JavaScript pythons other great languages we're and there's lots of really cool libraries that come out and then six months later you know that they'll disappear and we really can't afford that that level of risk being able to use some really cool features and then have it disappear because that application one you know might be critical and to you know a lot of our applications are long-lived just because of the nature of what we do so how do you evolve that quickly so we want to take all on a tremendous amount of technical debt by picking up at the latest and greatest library now we want to be leading but but not bleeding edge and that's kind of our philosophy so we also look at you know things like how do we actually build and automate our builds right there's lots of vendors that can do that and the idea is we want to enable our developers to build anytime and we basically process you know hundreds of bills per day you know across you know our application infrastructure and the same thing with that the other thing that we're very paranoid about is testing right so if you've got very large critical applications how did you actually run through your automated regression tests in a timely fashion and how did you actually you know develop that hand-in-hand with our applications again a lot of applications are gonna be long-lived so we can actually invest in a lot more higher quality testing than a lot of other other groups as well and so we kind of break this into you know really five areas so the one is how do we actually make our developers really productive so how do we actually keep them in the IDE of their choice how do we offer them the right level of plugins so they can actually look and debug their code they can actually understand the quality of their code and a timely fashion so you know it's a bit of a painful mantra but we really want to keep people sitting down or developers in they're actually coding away and and not have them contact switching to other tools again and again because that really reduces their productivity as well as what we found out is actually increases you know the likelihood of getting issues inserted into the code if they're always context switching to another place the other thing that we do is you know we love our quality we really try and look at what's the level of quality of the code that these developers are actually producing and we actually have as you our elevator we actually have a nice you know dashboard so a big TV screen shows you know who are the you know the top quality apps we also have you know a Wall of shame of you know basically the bottom quality applications and one day will will will start showing names of people that broke the build but but you know that's an idea of we want to actually share a lot of the quality and will actually escalate issues to managers to say okay you know this code is is great but it's it's got a lot of issues you probably need to look at your developers maybe you've got some new developers maybe you've hired some you know consulting our contractors you don't quite understand you know how we want to do application development and so you know you need to go and drill down maybe do some education and what are the tools that we can help you with that the other thing that we are big into is compliance right we have an enterprise reference architecture how are we actually developing code that adheres to that enterprise reference architecture and doing a such a fashion that it's automated so how do we actually check we want to basically check to see if people are actually using you know for example or reusable libraries and if not why not it's not a simple example you know we have a standard way of doing audit logging now if you think of it from an Operations perspective you know we want everyone to do the same audit log and log the same way you know day in day out and so one of the the simple libraries that we wrote was an audit log because what we found when we did the research you know we actually had more debug logs and audit logs and applications so what that meant was you know in our code base what we found is multiple people over time and actually added their own multiple different audit logs and debug logs into the application not from an Operations perspective makes it really hard so if you think about it right if you're in operations you might be using a tool log log monitoring tool like Splunk for example right you don't want your operations people spending their time right configuring the applications because there's different logging formats and logging standards each application we basically want it all automated so that you know you launch an application into production basically Splunk and then be automatically configured cuz it knows where to look on what the audit log where is and the format is so it all gets pulled into Splunk and then we can generate reports our information security people can then query the the Splunk database for example and all of that kind of w rks seamlessly so that's the value-add of a lot of the tools and all of the monitoring that we have and so i'm going to pass it off to jonathan for the last slide actually i'm gonna go back for one quick second all right so along those lines of talking through training one of the other big pieces that we've done is we've built a thing we call common services university so you've got both a week-long course we call that the core curriculum and that's where we have those developers that might might need to they might need shoring up or just somebody coming into the organization or you know anywhere in between basically where we sort of sort of indoctrinates how you how you go about leveraging all these different services whether it's the the security common components or the tooling or the the that and within the tooling what is a for an example an IQ server report looked like or what do we care about in for example sonar so really this in this continuous learning and continuous feedback is really about how we really should start to shape the culture so we've been doing the the CI CD for you know seven eight years now is starting smaller and getting up over time but really where we were getting stuck was really the culture of the whole organization it's great to have the the automated capability but when we weren't you know when we weren't working with the operations folks when we didn't have our information security all lined in it was really you know that's the education in there and a continual work together is really what we've been shifting for there so last just sort of talk about back into the reuse and sort of how we think about it right so so one of the other challenges of working in sort of this federated environment is the concept of you know there's always the concept of competition I'll say and so and so how do we how do we work against that or how do we how do we sort of break that down and we really do it by sort of articulating our vision of where we fit and we're you know where the rest of the world is and how you can work together and how all these different approaches are complementary so open we start of course with the base of open source software that's the the majority of what we're gonna pull down for any particular application and so it's absolutely instrumental and it solves very very broad problems if some of the Federal Reserve Bank was writing their own you know something to handle HTTP requests as part of their standard business that we'd have a problem right so then you you you take it up a level and you say alright so what are what are the things that we can decide on as an enterprise that we can make an agreement and and that really pays dividends to reuse that code so I talked a little bit about authentication authorization and authentication is really a bit of a misnomer because if infrastructure more or less authenticates and then we collected and presented and put it contextualize it for the news but but conceptually that's what it is and we don't want every team focusing on authenticating and authors i authorized a no on and so forth and then you can go you go up to the next level which is your team level reused so within an application and you know every report that that application is gonna spit out wants the same header or the same footer that's not where this enterprise team sits and then lastly it's the the the very business specific code we want our developers spending as much time up there as possible so that's where you're moving the the trillions of dollars or telling what's on sale at the CAF so so you know it's our whole mantra is pushing developers to be as innovative as possible up top leveraging as much as they can from what's lower in this stack so if they can get something go as low as you can go and then one of the other pieces we did back to that culture piece is really focusing on having an inner source model to sort of allow feedback allow folks from around the system to can tribute to - you know proposed patches and and really become effectively co-owners so really treating ourselves like a little open-source shop our little open-source wing of our shop I should say and so that's where we're at so I think I think well at a time so I you know we'll be here you know floating around if you have any questions so thanks a lot for your time [Applause]