3 ms·

None of what is described here is revolutionary or some novel form of security when dealing with PKI and root certs. Not sure how it opens up attacks or becomes

None of what is described here is revolutionary or some novel form of security when dealing with PKI and root certs. Not sure how it opens up attacks or becomes an invitation to be attacked. >banks don't use to describe openly the technologies or methodologies they use for good reasons I don't think it's "for good reasons". I think it's for "don't want to be found to still be using XP" reasons.

throwaway894345 5y ago
I agree that's a significant part of it (most banks don't actually do a very good job of security). The other part is that most banks' leadership are finance people, while Mongo's leadership is largely technical (and consequently are more open to discussing technology).
- 123pie123 5y ago
  Not sure what bank you're referring to but most finiance companies I've delt with in the past (in the UK) have extremely good technical people. most of the stuff is security using multple layers - which can be a pain to modify Any technical debt is evaluated as a risk and signed off by the business
  - throwaway894345 5y ago
    Having good people is necessary but not sufficient for good security. In many cases, management isn't even aiming for compliance much less actual security. This is based off of multiple close friends and family in the banking and bank auditing world in the US as well as my own experiences working on financial software (including the relevant regulatory and compliance bodies as well as the many banks who were our customers); can't speak to UK specifically.
    - 123pie123 5y ago
      From my past uk financial security experience - security personal can highlight and raise risks with any decision made by the business or other techies. the higher the risk the more hoops you need to jump through for security sign off (to the point where they will not sign it off) and higher the risk, the higher up the food chain of managment that is needed to sign it off obv if the execs are not bothered about security then anything can happen but if something goes wrong a big finger will be pointing at that person who signed it off - which seems in it self a massive deterrent

throwaway894345 5y ago

I agree that's a significant part of it (most banks don't actually do a very good job of security). The other part is that most banks' leadership are finance people, while Mongo's leadership is largely technical (and consequently are more open to discussing technology).

123pie123 5y ago
Not sure what bank you're referring to but most finiance companies I've delt with in the past (in the UK) have extremely good technical people. most of the stuff is security using multple layers - which can be a pain to modify Any technical debt is evaluated as a risk and signed off by the business
- throwaway894345 5y ago
  Having good people is necessary but not sufficient for good security. In many cases, management isn't even aiming for compliance much less actual security. This is based off of multiple close friends and family in the banking and bank auditing world in the US as well as my own experiences working on financial software (including the relevant regulatory and compliance bodies as well as the many banks who were our customers); can't speak to UK specifically.
  - 123pie123 5y ago
    From my past uk financial security experience - security personal can highlight and raise risks with any decision made by the business or other techies. the higher the risk the more hoops you need to jump through for security sign off (to the point where they will not sign it off) and higher the risk, the higher up the food chain of managment that is needed to sign it off obv if the execs are not bothered about security then anything can happen but if something goes wrong a big finger will be pointing at that person who signed it off - which seems in it self a massive deterrent