Timeline for What processes or tools enable Segregation of Duties when engineers both deploy and run code?
Current License: CC BY-SA 3.0
19 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 18, 2020 at 8:28 | history | edited | CommunityBot |
Commonmark migration
|
|
| Oct 12, 2018 at 9:19 | answer | added | fgeorgatos | timeline score: 0 | |
| Jan 17, 2018 at 12:38 | vote | accept | Richard Slater | ||
| Mar 21, 2017 at 18:06 | answer | added | fgeorgatos | timeline score: 0 | |
| Mar 20, 2017 at 20:25 | answer | added | Pierre.Vriens♦ | timeline score: 8 | |
| Mar 20, 2017 at 9:48 | answer | added | Tensibai | timeline score: 6 | |
| Mar 18, 2017 at 19:31 | comment | added | Richard Slater | @Pierre.Vriens yes the broad question is in the title, I have tried to expand upon it by making some assumptions. Roles are likely to be part of the solution as are things like Break-Glass and Privileged Account Management. Roles and Responsibilities are an interesting concept in DevOps/Agile as where once upon a time you had a Java Developer, F/E Developer, Designer, PM, Build Engineer, Release Manager and Ops Engineer - now you have a group of people who can wear multiple hats - cross-functional teams made up of "Engineers" who may specialise but ultimately share responsibility,. | |
| Mar 18, 2017 at 19:30 | comment | added | Tensibai | I'll try to expand the first comment in an answer Monday :) | |
| Mar 18, 2017 at 19:27 | comment | added | Richard Slater | @Tensibai in some cases it becomes all of the above, Barclays has to comply with 220 individual statutes from 17 countries. Other banks with a large global footprint will have to comply with a far greater number, some banks operate in 50+ countries. | |
| Mar 18, 2017 at 19:25 | history | edited | Richard Slater | CC BY-SA 3.0 |
Added some assumptions.
|
| Mar 18, 2017 at 19:18 | comment | added | Tensibai | Not that much, the regulation enforcement is more on investment handling (benefits, loans) than on individuals accounts (for what I know of US rules, French one are a little different, U.K. One fairly different and I'm not even sure which one Barclays has to follow at all) | |
| Mar 18, 2017 at 19:14 | comment | added | Richard Slater | @Tensibai agreed "Public Web Site" is broadly marketing material and thus doesn't need the same level of rigour, interestingly some financial institutions do apply the same level of rigour to the "Public Website" and for example "Internet Banking" - that I believe is more out of a desire to have a single global standard. Interestingly Barclays seem from an external perspective to be following a You Build It, You Run It approach to their mobile application which includes the ability to "move money" something which certainly requires closer scrutiny than the Public Web Site. | |
| Mar 18, 2017 at 17:24 | comment | added | Pierre.Vriens♦ | I adore these kind of questions, especially when 'Sarbanes Oxley' is part of it (since about a decade or so I believe, no?). Based on my SCM-background I could write a book to answer/address these challenges. Am I right that your actual question is as in your title (some sites don't consider the title as part of the actual question ...)? Also, should "roles" not be part of your question also? Or is it OK to just add "roles" as part of a possible answer? | |
| Mar 18, 2017 at 15:34 | comment | added | Tensibai | You took barcklays as an example, the concerns about the main website (not customer space) are not the same than those about the loan management, that is why I say there's some products (software) not concerned. But well, just a point of view | |
| Mar 18, 2017 at 14:49 | comment | added | Richard Slater | There is no such thing as "Regulatory Separation" the statutes/laws and regulatory bodies don't impose separation upon financial institutions they impose a management responsibility to have "Appropriate Controls" to manage financial risk. In the same way that Agile took software development from long cycles to small cycles, DevOps is taking operations into small cycles, DevOps in Financial Services needs to find a way to take Segregation of Duties into small cycles, by for example creating a CD pipeline that enforces "appropriate controls" such as peer review and approval based promotion. | |
| Mar 18, 2017 at 14:26 | comment | added | Tensibai | Yes, devops on subjects not bound to regulatory separation, and they took advantage of the automation on a traditional silo based org for subjects restricted (which are in fact very few). They just have two kind of orgs depending on which kind of operations the software will do | |
| Mar 18, 2017 at 14:16 | comment | added | Richard Slater | @Tensbai I fundementally disagree with the assertion that DevOps is incompatible with Segregation of Duties. The laws are not prescriptive as to the manner of the controls, nor are the regulators imposing a predefined process on banks and financial services. It is largely down to the organisation to identify what appropriate is and be totally transparent with the regulators and their appointed auditors. As an example both ING and Barclays have adopted DevOps practices to allow them to accelerate their ability to deliver value to their customers. | |
| Mar 18, 2017 at 13:29 | comment | added | Tensibai | Main idea behind a devops organization beingto put everyone in the Team accountable for what happens in production, there can't be separation of duties. This mainly means this kind of organization can't be really used when there's regulatory needs for this separation. | |
| Mar 18, 2017 at 11:29 | history | asked | Richard Slater | CC BY-SA 3.0 |