How V-Bank AG successfully digitalised its services
01.05.2023 – Airlock Reference V-Bank AG
Customers demand two things from their bank: maximum security and modern service provision. This is why online banking apps, which allow customers to ‘carry’ their portfolio in their pockets, are almost a matter of course nowadays. But implementing this kind of app requires extensive experience and smart applications, as the example of V-Bank AG shows.
Since it was established in 2008, V-Bank has had a clear focus – ensuring that assets are kept in safe custody for independent asset managers, family offices, foundations and investment banks. With assets under management of more than EUR 35 billion, V-Bank has been crowned winner of several awards in Germany, such as ‘Best Depot Bank 2021’ and ‘Top Innovator 2021’. It has also been honoured with an accolade for its ‘Excellent Service Quality’.
In 2020, V-Bank decided to speed up its digitalisation efforts by expanding the range of services it offers to include a mobile online banking app. Until then, end users could only see an overview of their assets and transactions on a browser-based solution. While the bank focused entirely on usability and on the added value of the new application for clients, Knowledge Lab AG was entrusted with implementing the security aspects. Due to its many years of experience in IT security for financial service providers, Knowledge Lab AG, Gold Partner of the Swiss IT security provider Airlock, was the perfect partner for V-Bank to successfully support its digitalisation project.
Knowledge Lab AG was tasked with ensuring that all of the security-related aspects were taken into account in the new solution. Security was not to just be considered at the end, but to be implemented continuously as part of an agile project.
Security thanks to consistent checklists
Something that plays a key role in aviation safety has also proved its worth in IT security. We are, of course, talking about checklists. Regardless of whether a journey above the clouds or migration to the cloud is on the horizon, checklists can be used to structure complex requirements in a consistent manner and achieve maximum security.
By taking a look at the Knowledge Lab AG checklist, it is clear which main aspects need to be taken into account to ensure agile IT security. The overarching aim is to allow authorised users access to their data in as simple a way as possible. On the other hand, unwanted visitors such as hackers or bots should be intercepted early on, so that they cannot cause any damage. We would now like to show what working with checklists and an agile ‘DevSecOps’ process actually looks like using V-Bank as an example.
“By implementing a modern, cloud-based solution with such a high degree of automation, we were able to cut operating costs to the bare minimum.”
Step #1: Authorisation and identity management
In the digitalisation project that V-Bank described at the outset, the biggest challenge was that the existing browser-based end user application was an SaaS solution managed by a third party. Using the Airlock Gateway and Airlock IAM with the industry-standard authorisation protocol OAuth2, the Knowledge Lab team quickly provided modern two-factor authentication including biometrics for the integrated mobile app.
Step #2: Availability and scaling
But the true innovation of the overall solution can be found under the surface and mainly concerns the scaling of the cloud-based solution. Of course, V-Bank wanted its customers to use the new service extensively and in large numbers, especially on its release. An appropriate infrastructure that automatically scales up in the event of a sudden surge in visitor numbers needed to be in place to achieve this goal. In addition, previously known and zero-day attacks had to be detected early on and prevented where possible.
To meet the needs of V-Bank, Knowledge Lab AG designed and configured the first cloud-based deployment of Airlock Gateway and Airlock IAM in the form of a high-availability, fault-tolerant and dynamically scaled cluster.
Step #3: Automation and hotfixes
Other security-related aspects involved dealing with newly discovered security vulnerabilities and provision in a variety of environments. To simplify operation, automated setup and bootstrapping of each gateway instance was achieved by means of the configuration interface (REST API) and Ansible, an open source automation tool.
Continuous integration and deployment (CI/CD) has been ensured for four staging environments, allowing production hotfixes to be implemented in a matter of minutes.
For monitoring, seamless integration with the cluster-wide logging stack, Grafana dashboards and alerts sent to Microsoft Teams has been implemented. That way, the error messages of the systems are centralised and processed clearly for analysis with Grafana.
Step #4: Ready for take-off
Thanks to the successful collaborative relationship between V-Bank and Knowledge Lab AG, end customers can now access all the information about their assets and transactions from their mobile devices. The mobile app now offers a comprehensive customer experience without compromising on security aspects.
About Airlock
The Airlock Secure Access Hub combines the important IT security issues of filtering and authentication into a well-coordinated overall solution that sets standards in terms of usability and services. The Secure Access Hub covers all important functions of modern IT security in this field: from a web application firewall (WAF) awarded by journalists, to a customer identity and access management system (cIAM) trusted by Swiss banks, to API security that meets the latest requirements. The Airlock IT security solution protects more than 20 million active digital identities and 30,000 back-ends from over 550 customers around the world.
For more information, visit www.airlock.com