Upgrade to Pro — share decks privately, control downloads, hide ads and more …

DevOps Exchange London – Network Security at Monzo

Sponsored · SiteGround - Reliable hosting with speed, security, and support you can count on. →
Avatar for Oliver Beattie Oliver Beattie
January 26, 2017
Technology
270
0

DevOps Exchange London – Network Security at Monzo

Avatar for Oliver Beattie

Oliver Beattie

January 26, 2017

More Decks by Oliver Beattie

See All by Oliver Beattie
Anatomy of a Production Kubernetes Outage – Kubecon EU 2018
Avatar for Oliver Beattie obeattie
4
4.7k
Building a Bank with Kubernetes – Kubecon 2016
Avatar for Oliver Beattie obeattie
1
610
Building a Bank with Kubernetes – Kubernetes London Meetup, Autumn 2016
Avatar for Oliver Beattie obeattie
10
47k

Other Decks in Technology

See All in Technology
AI for Science時代を切り開く、政府の次世代HPC戦略の展望
Avatar for GPU UNITE gpuunite_official
0
130
【GCC2026】TrueHDRIを用いたルックデブ環境とライティングテクニック
Avatar for Bandai Namco Studios Inc. bandainamcostudios
PRO
0
140
Software Supply Chain Attackからクラウド環境を守るためにできること
Avatar for LHazy lhazy
2
290
AI時代のアウトプット――変わったこと、変わらないこと / Devsumi 2026 Kansai #devsumi
Avatar for Junichi Ito jnchito
0
370
三人寄ればチューリング完全
Avatar for Takumi Sueda puhitaku
4
2k
ハッカソンで入賞した話 @ Findy LT
Avatar for asari asari194617
0
1.4k
LanceDB入門
Avatar for Tomoko Uchida mocobeta
9
650
Head First モブプログラミング / Head First Mobprogramming
Avatar for TAKAKING22 takaking22
10
12k
AI-DLC実践録_フルサイクル開発への挑戦
Avatar for Miyuki miyuc
0
320
Eight Engineering Unit 紹介資料
Avatar for Sansan, Inc. sansan33
PRO
3
8.2k
Adding Right-to-Left support to your web
application with CSS logical properties — Lessons from Redmine
Avatar for MAEDA Go vividtone
0
160
形式手法特論：Hyperproperty とモデル検査 #kernelvm / Kernel VM Study Tokyo 19th
Avatar for y_taka_23 ytaka23
0
370

Featured

See All Featured
How to Align SEO within the Product Triangle To Get 
Buy-In & Support - #RIMC
Avatar for Aleyda Solis aleyda
2
1.8k
Leadership Guide Workshop - DevTernity 2021
Avatar for David Neal reverentgeek
1
340
For a Future-Friendly Web
Avatar for Brad Frost brad_frost
183
10k
From π to Pie charts
Avatar for Rasagy Sharma rasagy
0
310
Rebuilding a faster, lazier Slack
Avatar for samanthasiow samanthasiow
85
9.6k
How To Stay Up To Date on Web Technology
Avatar for Chris Coyier chriscoyier
790
250k
Getting science done with accelerated Python computing platforms
Avatar for Jacob Tomlinson jacobtomlinson
2
440
State of Search Keynote: SEO is Dead Long Live SEO
Avatar for Ryan Jones ryanjones
0
250
Producing Creativity
Avatar for Steve Smith orderedlist
PRO
348
40k
エンジニアに許された特別な時間の終わり
Avatar for watany watany
108
250k
Fantastic passwords and where to find them - at NoRuKo
Avatar for Phil Nash philnash
52
3.8k
HDC tutorial
Avatar for Michiel Stock michielstock
2
800

Transcript

  1. Oliver Beattie @obeattie Head of Engineering, Monzo

  2. None
  3. None
  4. None
  5. None
  6. None

  7. Pre-application 9 months Application 6 months Mobilisation 4–8 months

  8. Isolation Authentication

  9. Isolation Authentication

  10. k8s-master Availability Zone A Availability Zone B Availability Zone C

    admin user data k8s-worker dmz

  11. k8s-master Availability Zone A Availability Zone B Availability Zone C

    k8s-worker dmz
  12. None
  13. None

  14. +

  15. apiVersion: extensions/v1beta1 kind: NetworkPolicy metadata: name: com.monzo.mastercard.proxy spec: podSelector: matchLabels:

    stage: prod routing-name: com.monzo.mastercard.proxy ingress: - from: - podSelector: matchLabels: stage: prod routing-name: com.monzo.mastercard.processor ports: - protocol: tcp port: 80

  16. “Cluster-aware” netfilter/iptables under the hood Filtering at “both ends” No

    control over egress Only understands TCP/UDP Proxies

  17. Isolation Authentication

  18. Host A Host B Service A linkerd Service B linkerd

  19. Host A Host B Service A linkerd Service B linkerd

  20. Host A Host B Service A linkerd Service B linkerd

    CA CA CA Vault

  21. Secret management Message signing Transaction authorisation Secure build Audit logging

    WAN tunnels

  22. IPSec StrongSwan (IPSec) Hardware VPN device Services Services Services AWS

    Co-location Third parties

  23. monzo.com/careers

  24. & Questions

  25. @obeattie