3 ms·

The risk Bank of England doesn't like comes with the territory, and everybody who uses public cloud is subject to it. The only difference is that smaller compan

by dsign 5y ago

The risk Bank of England doesn't like comes with the territory, and everybody who uses public cloud is subject to it. The only difference is that smaller companies don't have a big megaphone or the clout that they have, and must either accept the terms and shut up or find an alternate solution. If Bank of England wants to use their power constructively, they can literally go shopping for data center and IT companies to serve their needs.

pjc50 5y ago
> risk Bank of England doesn't like comes with the territory The BoE is the central bank; to a great extent they get to define the territory. Especially with regard to risk. Basel III and that kind of thing. > they can literally go shopping for data center and IT companies to serve their needs. No, it's not about what they themselves buy, it's about what all the banks in the UK buy. A situation where all the banks are using the same cloud provider(s) is unacceptable because of the high risk of correlated failure. It's bad enough when one bank goes down and its ATMs stop working; if EU-west-1 goes down and takes out all the banks, that's a disaster, and the BoE is rightly taking steps to prevent it.
- dsign 5y ago
  Ahh, I stand corrected.
PeterisP 5y ago
What BoE can say is that certain risks are unacceptable for UK banks, period. It's not BoE shopping for data centers, it would be BoE setting the rules for every bank shopping for data centers. If BoE does not like some risk that really does come with the territory and everybody who uses public cloud is subject to that risk, oh well, then that would imply that UK banks have to keep out of that territory and can't use public cloud for their key services - it is a bit drastic, but certainly something that BoE has the right to rule if it really wanted. On the other hand, if there's a way to use public cloud and meet the requirements, but current major vendors are simply not offering it, then BoE can make up arbitrary requirements, followed by the major UK banks going to the major cloud vendors with a proposal "meet these requirements or we won't use your services, because we'd be prohibited to".
cameronh90 5y ago
The risk that they're concerned with is if every bank is using AWS, then AWS goes down, the entire UK economy crashes until it's back up. Even if AWS itself is more reliable than every bank's on-prem solution, that's no good if it goes down for everyone simultaneously and I can't just use a backup credit card.
- thedougd 5y ago
  Exactly, they're concerned with the systemic risk. As an example, there's no visibility or processes in place to ensure that all these banks aren't sharing the same availability zone. They're likely only looking for ways to mitigate these risks, not necessarily a complete return to self-hosting.

by dsign 5y ago

pjc50 5y ago

> risk Bank of England doesn't like comes with the territory The BoE is the central bank; to a great extent they get to define the territory. Especially with regard to risk. Basel III and that kind of thing. > they can literally go shopping for data center and IT companies to serve their needs. No, it's not about what they themselves buy, it's about what all the banks in the UK buy. A situation where all the banks are using the same cloud provider(s) is unacceptable because of the high risk of correlated failure. It's bad enough when one bank goes down and its ATMs stop working; if EU-west-1 goes down and takes out all the banks, that's a disaster, and the BoE is rightly taking steps to prevent it.

dsign 5y ago
Ahh, I stand corrected.

PeterisP 5y ago

What BoE can say is that certain risks are unacceptable for UK banks, period. It's not BoE shopping for data centers, it would be BoE setting the rules for every bank shopping for data centers. If BoE does not like some risk that really does come with the territory and everybody who uses public cloud is subject to that risk, oh well, then that would imply that UK banks have to keep out of that territory and can't use public cloud for their key services - it is a bit drastic, but certainly something that BoE has the right to rule if it really wanted. On the other hand, if there's a way to use public cloud and meet the requirements, but current major vendors are simply not offering it, then BoE can make up arbitrary requirements, followed by the major UK banks going to the major cloud vendors with a proposal "meet these requirements or we won't use your services, because we'd be prohibited to".

cameronh90 5y ago

The risk that they're concerned with is if every bank is using AWS, then AWS goes down, the entire UK economy crashes until it's back up. Even if AWS itself is more reliable than every bank's on-prem solution, that's no good if it goes down for everyone simultaneously and I can't just use a backup credit card.

thedougd 5y ago
Exactly, they're concerned with the systemic risk. As an example, there's no visibility or processes in place to ensure that all these banks aren't sharing the same availability zone. They're likely only looking for ways to mitigate these risks, not necessarily a complete return to self-hosting.