Upgrade to Pro — share decks privately, control downloads, hide ads and more …

DevOps Exchange London – Network Security at Monzo

Avatar for Oliver Beattie Oliver Beattie
January 26, 2017
Technology
0
240

DevOps Exchange London – Network Security at Monzo

Avatar for Oliver Beattie

Oliver Beattie

January 26, 2017
Tweet

More Decks by Oliver Beattie

See All by Oliver Beattie
Anatomy of a Production Kubernetes Outage – Kubecon EU 2018
Avatar for Oliver Beattie obeattie
4
4.6k
Building a Bank with Kubernetes – Kubecon 2016
Avatar for Oliver Beattie obeattie
1
580
Building a Bank with Kubernetes – Kubernetes London Meetup, Autumn 2016
Avatar for Oliver Beattie obeattie
10
47k

Other Decks in Technology

See All in Technology
american aa airlines®️ USA Contact Numbers: Complete 2025 Support Guide
Avatar for jackal5647 aaguide
0
500
Delta airlines Customer®️ USA Contact Numbers: Complete 2025 Support Guide
Avatar for michal deltahelp
0
1.1k
第64回コンピュータビジョン勉強会「The PanAf-FGBG Dataset: Understanding the Impact of Backgrounds in Wildlife Behaviour Recognition」
Avatar for Tatsuya Suzuki x_ttyszk
0
190
VS CodeとGitHub Copilotで爆速開発！アップデートの波に乗るおさらい会 / Rapid Development with VS Code and GitHub Copilot: Catch the Latest Wave
Avatar for Yusuke Yamada yamachu
2
350
SRE不在の開発チームが障害対応と 向き合った100日間 / 100 days dealing with issues without SREs
Avatar for katsukamaru shin1988
2
1.5k
ポストコロナ時代の SaaS におけるコスト削減の意義
Avatar for izzii izzii
1
290
ゼロからはじめる採用広報
Avatar for Yuta Horii yutadayo
4
1k
〜『世界中の家族のこころのインフラ』を目指して”次の10年”へ〜 SREが導いたグローバルサービスの信頼性向上戦略とその舞台裏 / Towards the Next Decade: Enhancing Global Service Reliability
Avatar for kohbis kohbis
3
1.1k
全部AI、全員Cursor、ドキュメント駆動開発 〜DevinやGeminiも添えて〜
Avatar for Masaya Hayashi rinchsan
4
2.5k
アクセスピークを制するオートスケール再設計: 障害を乗り越えKEDAで実現したリソース管理の最適化
Avatar for M-Yamashita myamashii
1
340
敢えて生成AIを使わないマネジメント業務
Avatar for Kazuki Maeda kzkmaeda
2
510
マルチプロダクト環境におけるSREの役割 / SRE NEXT 2025 lunch session
Avatar for sugamasao sugamasao
1
430

Featured

See All Featured
Site-Speed That Sticks
Avatar for Harry Roberts csswizardry
10
700
Designing for humans not robots
Avatar for Tammie Lister tammielis
253
25k
Testing 201, or: Great Expectations
Avatar for Joseph Mastey jmmastey
43
7.6k
A designer walks into a library…
Avatar for Paul Jervis Heath pauljervisheath
207
24k
How to Create Impact in a Changing Tech Landscape [PerfNow 2023]
Avatar for Tammy Everts tammyeverts
53
2.9k
BBQ
Avatar for Matthew Crist matthewcrist
89
9.7k
Practical Tips for Bootstrapping Information Extraction Pipelines
Avatar for Matthew Honnibal honnibal
PRO
20
1.3k
The Power of CSS Pseudo Elements
Avatar for Geoffrey Crofte geoffreycrofte
77
5.9k
Faster Mobile Websites
Avatar for Dean Hume deanohume
307
31k
Building Better People: How to give real-time feedback that sticks.
Avatar for Will Jessup wjessup
367
19k
Balancing Empowerment & Direction
Avatar for Lara Hogan lara
1
440
CoffeeScript is Beautiful & I Never Want to Write Plain JavaScript Again
Avatar for Sam Stephenson sstephenson
161
15k

Transcript

  1. Oliver Beattie @obeattie Head of Engineering, Monzo

  2. None
  3. None
  4. None
  5. None
  6. None

  7. Pre-application 9 months Application 6 months Mobilisation 4–8 months

  8. Isolation Authentication

  9. Isolation Authentication

  10. k8s-master Availability Zone A Availability Zone B Availability Zone C

    admin user data k8s-worker dmz

  11. k8s-master Availability Zone A Availability Zone B Availability Zone C

    k8s-worker dmz
  12. None
  13. None

  14. +

  15. apiVersion: extensions/v1beta1 kind: NetworkPolicy metadata: name: com.monzo.mastercard.proxy spec: podSelector: matchLabels:

    stage: prod routing-name: com.monzo.mastercard.proxy ingress: - from: - podSelector: matchLabels: stage: prod routing-name: com.monzo.mastercard.processor ports: - protocol: tcp port: 80

  16. “Cluster-aware” netfilter/iptables under the hood Filtering at “both ends” No

    control over egress Only understands TCP/UDP Proxies

  17. Isolation Authentication

  18. Host A Host B Service A linkerd Service B linkerd

  19. Host A Host B Service A linkerd Service B linkerd

  20. Host A Host B Service A linkerd Service B linkerd

    CA CA CA Vault

  21. Secret management Message signing Transaction authorisation Secure build Audit logging

    WAN tunnels

  22. IPSec StrongSwan (IPSec) Hardware VPN device Services Services Services AWS

    Co-location Third parties

  23. monzo.com/careers

  24. & Questions

  25. @obeattie