3 ms·
I’m not super familiar with the full content of their regulations but in my experience working with banks that maintain a presence there, Singapore control requ
by jcims 5y ago
I’m not super familiar with the full content of their regulations but in my experience working with banks that maintain a presence there, Singapore control requirements tend to be fairly specific, opinionated and far reaching. For example, in developing OS security standards, I found myself having to actually incorporate requirements specifically for the Monetary Authority of Singapore that bled into operations in North America.
These requirements extend into resiliency as well. I’m curious how well DBS has been fairing in audits.
- qsi 5y agoA few months from now the headline will be that MAS (Monetary Authority of Singapore) slaps DBS with a hefty fine.
- cameronh90 5y agoMAS requirements are incredibly specific. However, I wonder if that opinionatedness could sometimes make things worse. We had to do a lot of work to convince MAS that AWS was safe enough for our tiny operation out there, for example. Whereas, if we'd gone for a local colo, it would have been much easier - despite having worse resilience and likely worse security.
- jcims 5y agoIn my case it 100% made things worse because there is was no room for contextual interpretation of the rules. The MAS requirements went too far in one direction and prevented us from developing more granular and observable control strategies. We essentially wound up stuck with security paradigms from the 90's. I was able to compartmentalize most of it to in-country workloads but some of it ultimately leaked back into our global builds because it was going to be too costly to maintain a total snowflake.