Upgrade to Pro — share decks privately, control downloads, hide ads and more …

DevOps Exchange London – Network Security at Monzo

Avatar for Oliver Beattie Oliver Beattie
January 26, 2017
Technology
270
0

DevOps Exchange London – Network Security at Monzo

Avatar for Oliver Beattie

Oliver Beattie

January 26, 2017

More Decks by Oliver Beattie

See All by Oliver Beattie
Anatomy of a Production Kubernetes Outage – Kubecon EU 2018
Avatar for Oliver Beattie obeattie
4
4.6k
Building a Bank with Kubernetes – Kubecon 2016
Avatar for Oliver Beattie obeattie
1
610
Building a Bank with Kubernetes – Kubernetes London Meetup, Autumn 2016
Avatar for Oliver Beattie obeattie
10
47k

Other Decks in Technology

See All in Technology
背中から、背中へ /paying forward to community
Avatar for naiban naitosatoshi
0
220
飲食店もAIで。レジ締めやハンディシステムをつくってる話 / Using AI for restaurant management
Avatar for VTRyo vtryo
0
240
AI時代のエンジニアキャリアについて今一度考える
Avatar for Sakamoto sakamoto_582
1
1.2k
AWS Summit の片隅で、体育座りしながらコミュニティがにぎわう理由を考えた
Avatar for Kazuki Adachi k_adachi_01
2
350
完全自律ロボットを作りたくて、先に開発を自律させた話(ROS Japan UG #63 LT)
Avatar for ありさん ( ari-san ) rryz09
0
230
ZOZOTOWNの進化と信頼性を両立する負荷試験
Avatar for ZOZO Developers zozotech
PRO
0
110
「ちゃんとやっている」は独りよがりだった ― 不安に寄り添うインシデント対応へ / Towards incident response that addresses anxieties
Avatar for mekka chmikata
1
850
どうして今サーバーサイドKotlinを選択したのか
Avatar for Nealle nealle
0
200
プライバシー保護の理論と実践
Avatar for LINEヤフーTech (LY Corporation Tech) lycorptech_jp
PRO
1
240
Claude Code 珍プレー好プレー
Avatar for Shinya Saita shinyasaita
0
250
“全部コピーしない”ファイルデータの活用 ： — FSx for ONTAP × S3 Tables × Icebergで作るメタデータカタログ
Avatar for Yoshiki Fujiwara yoshiki0705
0
450
Docker Desktop不要の時代が来る？ WSL標準の「wslc」で Linuxコンテナを動かしてみた.
Avatar for ueponx ueponx
0
700

Featured

See All Featured
The Cult of Friendly URLs
Avatar for Andy Hume andyhume
79
6.9k
Templates, Plugins, & Blocks: Oh My! Creating the theme that thinks of everything
Avatar for Michelle Schulp Hunt marktimemedia
31
2.8k
The browser strikes back
Avatar for Jono Alderson jonoalderson
0
1.4k
Large-scale JavaScript Application Architecture
Avatar for Addy Osmani addyosmani
515
110k
Agile Actions for Facilitating Distributed Teams - ADO2019
Avatar for Mark Kilby mkilby
0
220
svc-hook: hooking system calls on ARM64 by binary rewriting
Avatar for Akira Moroo retrage
2
330
Chrome DevTools: State of the Union 2024 - Debugging React & Beyond
Avatar for Addy Osmani addyosmani
10
1.2k
Between Models and Reality
Avatar for mayunak mayunak
4
360
Are puppies a ranking factor?
Avatar for Jono Alderson jonoalderson
1
3.7k
Stewardship and Sustainability of Urban and Community Forests
Avatar for Eric Wiseman pwiseman
0
250
Breaking role norms: Why Content Design is so much more than writing copy - Taylor Woolridge
Avatar for UX Y'all uxyall
0
340
Building a A Zero-Code AI SEO Workflow
Avatar for Ian Lurie portentint
PRO
0
620

Transcript

  1. Oliver Beattie @obeattie Head of Engineering, Monzo

  2. None
  3. None
  4. None
  5. None
  6. None

  7. Pre-application 9 months Application 6 months Mobilisation 4–8 months

  8. Isolation Authentication

  9. Isolation Authentication

  10. k8s-master Availability Zone A Availability Zone B Availability Zone C

    admin user data k8s-worker dmz

  11. k8s-master Availability Zone A Availability Zone B Availability Zone C

    k8s-worker dmz
  12. None
  13. None

  14. +

  15. apiVersion: extensions/v1beta1 kind: NetworkPolicy metadata: name: com.monzo.mastercard.proxy spec: podSelector: matchLabels:

    stage: prod routing-name: com.monzo.mastercard.proxy ingress: - from: - podSelector: matchLabels: stage: prod routing-name: com.monzo.mastercard.processor ports: - protocol: tcp port: 80

  16. “Cluster-aware” netfilter/iptables under the hood Filtering at “both ends” No

    control over egress Only understands TCP/UDP Proxies

  17. Isolation Authentication

  18. Host A Host B Service A linkerd Service B linkerd

  19. Host A Host B Service A linkerd Service B linkerd

  20. Host A Host B Service A linkerd Service B linkerd

    CA CA CA Vault

  21. Secret management Message signing Transaction authorisation Secure build Audit logging

    WAN tunnels

  22. IPSec StrongSwan (IPSec) Hardware VPN device Services Services Services AWS

    Co-location Third parties

  23. monzo.com/careers

  24. & Questions

  25. @obeattie