Under locks and keys

Critical infrastructure, critical security

Few industries are as critical to national and global economies as commercial banking. In Germany, it’s even considered critical infrastructure alongside power, water, and transportation.

NORD/LB, one of the country’s leading commercial banking entities, is well-known for its innovative lending solutions for the energy, aerospace, and real estate markets. But operating under the designation as one of the nationally system-relevant banks in Germany, the bank faces enormous pressure — from customers and the government alike — to protect highly sensitive data and systems at all costs.

“As a cloud-first bank operating with a hybrid infrastructure, we have our hands full with endpoint security, network security, and all points in between,” says Jannik Nolte, NORD/LB’s Information Technology Security Specialist. “We implemented HashiCorp Vault because effectively securing every point of potential vulnerability of today’s IT environment is a true team effort that can no longer be done using yesterday’s processes and technologies.”

End-to-end encryption across environments

Part of a small, select team of security specialists, Nolte plays a prominent role in keeping essential data and core systems secure. As the bank’s lead cryptographer, he’s responsible for cryptography across the entire organization and consults on cybersecurity implementation protocols on a wide variety of projects.

“If an app developer wants to join our environment, the first thing we do is check to see if it’s possible to deploy in Microsoft Azure, our public cloud of choice. If not, then we host the app on-premises,” he explains. “In either case, we need to be able to encrypt it in both environments because as a critical infrastructure entity, we don’t have the luxury of not complying with government data protection rules. Anything that risks exposing sensitive data also puts our ability to conduct business at risk.”

In the past, delivering that level of security and protection was a major challenge because encryption practices were decentralized and highly manual. Every department and team member had their own version of encryption and key management that involved first coordinating among several people to determine the algorithm and encryption method used, then entering the key into the central database by hand.

The process showed room for improvement because certain systems could be overlooked and not perfectly secured. A miskeyed encryption could lead to applications becoming unexpectedly unavailable and there was no software available to audit security protocols.

“We had been planning to adopt a KMS (key management system) solution for a while to replace the manual processes,” Nolte says. “The announcement of a new regulation requiring that all security keys be truly centrally managed accelerated that decision and made implementing a solution the top priority.”

NORD/LB uses HashiCorp Vault to centralize key management, automate encryption of highly sensitive data at rest and in transit across its hybrid IT environment, and comply with strict banking regulations that constantly evolve.