Core banking and financial systems are moving into the cloud. This talk will focus on the strategy, the technology, and the review process that customers use to move their most important systems into the cloud. Regulation plays an important role in defining how these systems must be secure and resilient, and this talk will dive deep into the regulatory context. In this session nib Group will discuss, as regulated insurer, their preparations to move a System of Record to AWS, with a specific focus on the platform they built to meet their security, risk, and resiliency requirements. Come to this talk to learn what they did, what they learned on the way, and their guidance on how you could do the same.

1. S U M M I T
SYDNEY

2. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Preparing for systems of
record in the cloud
Mathew Finch
Head of Emerging Technology
nib Group
Wayne Bozza
Head of Cybersecurity, IT
Governance & Risk
nib Group

3. ANNUAL GENERAL MEETING 2018 33

4. 44
OUR PURPOSE: YOUR BETTER HEALTH
Protecting our members against the financial risk of disease,
sickness and injury
Access to world-class healthcare wherever members are in
the world
Helping members better prevent, manage and treat illness

5. 55
Cloud & Data Platforms
Secure – Elastic – Resilient
Modern Digital Experience
Web – Mobile – API
Next Gen Core System
CRM – Modular – Capability

6. 66
OUR CLOUD VISION
Agility & Innovation Culture
Experimentation Platform
Improved Cyber & Risk
Increased Resiliency
Reduced Operating Costs
Common Group Platform

7. 77
TRANSITION APPROACH
Dec
2015
Apr
2016
May
2017
Oct
2017
Feb
2018
Aug
2017
Board Sign Off
First Production Release
PCI Certified Platform
100 Apps Live
100
nibby Chatbot Goes Live
Exploring Core System Transition
Oct
2015
Proof of Concept

8. ANNUAL GENERAL MEETING 2018 88
So, what happened during the
last 12 months?

9. 99
nib RISK CULTURE
”The bigger the brakes,
the faster the car…”

10. ANNUAL GENERAL MEETING 2018 1010
REGULATORY CONTEXT
Local & Global
Regulators
Overlap with
Compliance
Requirements
Constantly
Evolving

11. ANNUAL GENERAL MEETING 2018 1111
REFERENCES
APRA Cloud Computing
Information Paper
AWS Well Architected
Framework

12. 1212
THE LAST 12 MONTHS…
Iterations

13. DEEP DIVE

14. ANNUAL GENERAL MEETING 2018 1414
KEY AREAS
1 Strategy
2 Operating Model
3 Procurement
4 Project Delivery
5 Governance
6 Solution Architecture
7 Security
8 Resiliency
9 Risk Management
Assurance10

15. ANNUAL GENERAL MEETING 2018 1515
Cloud Specific Operating Model Changes

16. ANNUAL GENERAL MEETING 2018 1616
Platform Functional Overview

17. ANNUAL GENERAL MEETING 2018 1717
RED QUEEN PLATFORM TECHNOLOGY
Multi-AZ Design
Secure Bastions
Antivirus
Automated Patching
CIS Hardened Images
Account Separation
RDS Automation
Automated DR Tests
Application Routers
Secrets Management
Network Segmentation
Continuous DeliverySpeed
Safety

18. ANNUAL GENERAL MEETING 2018 1818
Foundations
& Patterns

19. ANNUAL GENERAL MEETING 2018 1919
POLICIES AS CODE
Policies Standards Codified Patterns Workloads Governance

20. ANNUAL GENERAL MEETING 2018 2020
PATTERNS
Features Infrastructure Web/API Extreme
Encryption at Rest & Transit
Hardened SOE & Vulnerability Management
Automatic High Availability
Least Privilege Admin Access
Automated Patching
Out of Band Point in Time Backup + Recovery
Restricted Approved Services
Contingency Plan Continuously Tested

21. ANNUAL GENERAL MEETING 2018 2121
RQP GOVERNANCE

22. ANNUAL GENERAL MEETING 2018 2222
Security

23. ANNUAL GENERAL MEETING 2018 2323
SECURITY OPERATIONS
Identify Protect Detect Respond Recover
Investigate
AWS CloudTrail AWS Config
AWS Systems
Manager
AWS
CloudWatch
AWS
Lambda
Amazon
GuardDuty
AWS CloudTrail AWS CloudWatch
AWS IAM AWS KMS
AWS Secrets Manager Amazon VPC
Identify Protect Detect Respond Recover

24. ANNUAL GENERAL MEETING 2018 2424
PRIVILEGED ACCESS MANAGEMENT – “BREAK GLASS”
AWS IAM
AWS CloudTrail
AWS CloudWatch
Bastion
AWS Systems
Manager
Security Group
Production
EC2 Instance
AWS Step
Functions
Amazon SES Amazon
API Gateway
AWS Lambda
AWS Lambda
Run Command
AWS KMS
Step Functions
Timer
Unique Encrypted
Credentials

25. ANNUAL GENERAL MEETING 2018 2525
Availability

26. ANNUAL GENERAL MEETING 2018 2626
AZ 1 AZ 3AZ 2
AVAILABILITY ARCHITECTURE
Health Checks
Auto Scaling
Immutable Infrastructure
Stateless Compute
Micro-segmentation
Withstand Loss of AZ
Public
Private
Private
Auto Scaling group
ELB
Master / Slave DB

27. ANNUAL GENERAL MEETING 2018 2727
AVAILABILITY – PEOPLE & PROCESS
Monitor Detect Action / Alert Track
Detection is
automatic
Standard availability
patterns with health
checks & monitoring
Developers define
additional logs and
events to monitor
Autoscaling is
automatic
Incidents are tracked &
Post Incident Reviews held
with relevant stakeholders
On call engineer
paged if service
does not self heal
Notifications
posted to DevOps
and Developers
Availability incidents and
trends are reviewed in
governance forums

28. ANNUAL GENERAL MEETING 2018 2828
AVAILABILITY TESTING – “GORILLA”
AZ 1 AZ 3AZ 2
Public
Private
Private
Auto Scaling group
ELB
Master / Slave DB

29. ANNUAL GENERAL MEETING 2018 2929
Recovery

30. ANNUAL GENERAL MEETING 2018 3030
CODIFIED BACKUP POLICIES
S3 & RDS Codified policies
Application Specific
Point in Time
Retention Aligned to BCP
MFA Delete & Versions
Segregation Between Accounts
Ephemeral assets
Transient assets
RDS Instance
level backup
Bunker account

31. ANNUAL GENERAL MEETING 2018 3131
RECOVERY
Recovery
Server
Application Server
Database Server
Backups Bucket
Bunker
Storage
Mirror
Recovered DB
X
Alternate Hosting ProviderDisruption Scenarios:
Collusion Between Parties
Compromised Credentials
Software Errors
Replication Issues
Failed Deployment

32. ANNUAL GENERAL MEETING 2018 3232
CONTINGENCY
Risk Tiering Contingency
for Material
Services
Establish
Alternate
Service Provider
Portability
Designs
Commercial
Exit Clauses

33. • CLICK TO EDIT MASTER TEXT
STYLES
INSIGHTS

34. 3434
Key Takeaways… So Far
Your Journey is Context Specific – There's no Silver Bullet
Be Ready for Ongoing Dialogue
Use Multiple Frameworks & Partners
Your Cloud Journey is not just Technical
Remember the People – Culture, New skills, New Roles, Training
Get started Now!

35. Thank you!
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Mathew Finch
m.finch@nib.com.au
Wayne Bozza
w.bozza@nib.com.au