DevSecOps leadership and audit-ready operations for a captive automotive bank under BaFin

Situation

A captive automotive bank is supervised by BaFin, the German Federal Financial Supervisory Authority. Its applications were run under an application management mandate. Operations had to meet BAIT, the German supervisory requirements for IT in banks, as well as ISO 27001 and ISO 22301, and they had to hold up in audits by the supervisor.

Approach

In this mandate, Bastian Wenske, now managing director of WCS, was the technical lead of a seven-person DevSecOps team.

• Audit readiness: audit-relevant operational documentation and participation in audits by the supervisory authority.
• Incident management to ITIL.
• Automation with Python, Bash, Ansible and GitLab CI/CD, together with segregation of duties and system hardening.
• Transparency: a middleware that synchronises the ITSM system with the team’s Kanban board.
• Enablement of the team through reviews and pairing.

Before that, he worked for the same client on operating and migrating the core banking platform: intraday and end-of-day processing, SEPA and SWIFT, the move from RHEL 7 to RHEL 8 and hardening of the scheduling platform.

Result

The team’s operations were documented for audit purposes, and the team took part in audits by the supervisory authority with that documentation. Incidents were handled along a defined ITIL process, and recurring tasks were automated with Python, Bash, Ansible and GitLab CI/CD. On the core banking platform, the monitoring that was introduced reduced the mean time to recovery (MTTR) by 40 percent. This experience with supervised banking operations now feeds into the mandates of WCS.