On account of cloud security

Secrets here today, disappear tomorrow

Few industries require the level of privacy and security as banking. And few banks have as extensive security demands as ABN AMRO.

The bank provides a comprehensive line of products and services for its customers. But securing the systems, applications, and data that enable those services is a daunting task for the company's 400-person Corporate Information Security Office (CISO).

"Executing the access and identity governance across our various customer and backend business applications has been challenging but manageable with our existing security solutions, even as we've added thousands of new accounts and users," says Ton van Dijk, the bank's agile product owner in the identity and access space. "However, our legacy system required an additional module and hands-on monitoring to manage the ephemeral backend secrets and keys among our internal apps and infrastructure, so we decided to look for a more seamless, automated way to address such a critical element of our business."

Preventing a domino effect

Though the financial services industry has a reputation for requiring proven technologies that often makes early technology adoption challenging, ABN AMRO embraced a digital transformation to modernize and future-proof its business. Yet, while the multi-cloud IT strategy and containerized development environment provided a much-needed efficiency boost for its growing product portfolio, it also created a new set of complexities and challenges for the CISO team.

"Secrets management is a business-critical element of our work because if any of the secrets are compromised, they'll have a huge downstream effect," Van Dijk says. "Even a single compromised signing certificate can take an entire system offline, which means possibly losing access to online apps or exposing them to the risk of someone maliciously injecting something into the apps. There's really no room for error."

The bank's previous secrets management solution featured a number of out-of-the-box systems connectors that still required a good amount of programming to set up a new application. Worse, the self-managed platform didn't integrate well with the team's Kubernetes instance, which meant one of the team's engineers had to create a custom connector for new applications or containers that could take several days to reach a test-ready stage.

Additionally, ABN AMRO knew that they needed to prevent secrets sprawl. As many applications and platforms come with their own secrets engines, having that central oversight is critical to be able to quickly revoke secrets in case a serious compromise would happen. When secrets are spread across a multitude of solutions, that is going to be difficult to control.

"The whole process revealed to us that having an on-premise, self-managed secrets system that required third-party support for any type of change was a time-consuming and inefficient way to manage a crucial piece of our operations," Van Dijk explains. More broadly, "it became clearer by the minute that we needed a cloud-native environment that supported containerized development and emphasized automation — without having to undertake a complete and expensive replatforming or technology refresh."

ABN AMRO is using HashiCorp Vault to create a centralized secrets management system spanning its AWS, Azure, and other internal applications that automates secrets injection and API encryption for greater efficiency and fewer critical secrets errors.