Frontal system. Sberbank reported on the results of the development of a unified front-end system. The platform is the basis for building an ecosystem

Sberbank is creating a new flexible platform that will transform the bank into a technology company. The bank plans to open access to elements of its platform via API, as well as partially publish the code of its developments, Sergei Ryabov, senior managing director and chief IT architect of Sberbank, said at the FinCore 2017 forum. FutureBanking provides excerpts from this speech.

Charles Darwin's saying states that it is not the strongest species that survive, nor the most intelligent, but the one that best responds to change. We have set the ability to change quickly as a key goal of our technology strategy and as a basic requirement for building a new platform.

The general approach to building a platform can be briefly described by three letters “R”: Rationalize- rationalization and optimization of the current architecture, Rearchitect- creation of a new platform, Rethink- rethinking the scale and creating an ecosystem. We are a bank, but at the same time we look at other markets. In the strategy, we stated that we would enter new markets, such as healthcare, the car market, we are already working in the real estate market and not only in terms of mortgages.

What are the key requirements for building our new platform?

1. Customer centricity. Most services and a new approach to customer service require that we know as much as possible about the client. This is not only what is in our core systems, it is also what is around.

2. Unified information space. This is an approach where information is available to our decision-making systems in real time.

3. Flexible mechanisms for setting up complex products and STP processes. We strive to remove as much human interaction as possible where possible; use mechanisms such as monitoring of our processes and automatic management of faulty situations.

4. A very important block is the open API. Accordingly, APIs permeate all components of the platform. We open an external API for our partners and contractors.

5. Machine learning mechanism. We're trying to build it into our platform components, and we're gradually building it into our decision-making system.

6. Maximum reliability 24x7. We are a huge systemically important bank, reliability is our everything. Therefore, we spend a lot of effort to ensure that the information system is as reliable as possible.

7. Horizontal scaling on low-end equipment. Our current information systems are stable, powerful and large, but we work on large high-end ones. Many vendors have already discontinued some of their lines aimed at the maximum high-end and are moving to the mid range and to other architectures. We are also trying to get away from this, to reduce the cost of ownership.

8. Use of open source technologies. Yes, we are a large bank, we have our own experience, we know how to work with traditional architectures, but we have begun to gradually switch to open source.

9. Storage and processing of data in memory. We had big discussions about whether to use this technology or not. On the one hand, these are great risks, on the other - the greatest opportunities for data processing speed. At the latest Gartner Symposium conference in Barcelona, ​​discussions were held with architects and leading analysts about how information systems should be built, what opportunities and limitations there are.

What is the platform and how we present it

First, we built the core of the platform and part of the key services that we classify as a business hub (decision-making system, unified customer profile, product catalog). But now we are moving in several directions, including because we are big, it is much more difficult for us to swing.

The platform consists of several architectural layers. Below is the technological core.
You can assemble some of the other layers from Lego blocks. These are actually reusable components,
which are used at other levels.

The heart of the new platform is the business hub. These are blocks such as Unified Client Profile,
product catalogue, decision making system. These are new solutions that we are now building,
which enable flexible customization of processes and products.

At the top we have the Unified Frontal System. It is important to provide an omnichannel experience for our customers.

The big block is food factories. This includes loans, deposits, and other traditional products. But at the same time, we are making new complex products, for example, a combination of insurance and credit products.

You can create any business on the platform components

Our goal is to make the platform flexible and customizable so that we can build new components into it. We have already talked about API and componentization, a service approach at all levels of the platform. It is very important. The platform provides the ability to integrate and customize at all levels.

What key technologies do we use?

Here are just a few of them:

1. Storage and processing of data in memory. We cooperate with the GridGain company, we go through a rather difficult path, because the other side of the speed of work is the reliability of the system. We actually implement some of the elements that are missing in this product from scratch. This is difficult, deadlines are being shifted somewhere, but we are following this path because the effect is great scaling opportunities.

2. Horizontal scaling on low-end servers. Our entire assembly is x86 machines.

3. Open source. This was also quite painful. We started switching to open source several years ago and learning. In the integration layer we use solutions such as Kafka, ZeroMQ. We use the open-source Activiti solution as a BPM solution. We use WildFly as our application server.

If you talk to large companies, most of them publish all their solutions. For example, we studied the experience of Alibaba. Our strategy also includes this. But this requires a certain maturity of us as an organization. We are now at the beginning of our journey, but we will definitely publish it, because it will provide completely different opportunities.

I talked about the decision-making system - the core and heart of our platform. This part is painful to open from the very beginning. We are going to open the parts, starting with the non-mission critical components. Our task is to be able to open the code of a certain component so that the community can refine it. Our approach now is quite cautious.

What is the Unified Frontal System and how we build it

The main requirement is the implementation of omnichannel front-end scenarios. The complexity here is less technical and more organizational. I am sure that in many banks the organizational structure is such that one person is responsible for remote channels, another person is responsible for branches and branches, and a third is responsible for the call center and network. And, of course, when we talk about an omnichannel customer service scenario, it should be applied to the maximum extent possible in all channels. To ensure this, it is important to reach an agreement at the level of all those responsible.

We have a large set of tools. We are actively using React technology now. There is also Angular. These are two alternatives. We settled on React.

The integration layer creates isolation of the front-end system from the back office and our other information systems. The main challenge is to ensure that customers are served consistently across channels. This is our target approach. We started the program two years ago and are now entering the replication phase. There is functionality for branches and contact centers. The next year will be quite actively devoted to remote channels.

Business hub

Historically, each Sberbank client lived in his own automated
banking system. Now we are moving away from this approach, moving to online as much as possible.
client profile, to the master system.

Other important components of the business hub are a product catalogue; decision making system;
execution of end-to-end processes; and an integration layer built on Kafka and ZeroMQ.

Accounting services are separated using the accounting engine paradigm, that is, product accounting
separated from accounting.

Data Factory

This is a new strategic program. We placed a big bet on Hadoop and related technologies. There are certain limitations, but we try to overcome them. We use classic solutions. We also implement solutions from Teradata.

What is important for the platform is that we must learn to push data from the level of food factories to the analytical level quite efficiently in order to do very complex analytics that we cannot do online.

Working with the team

A large vector of changes in the bank is associated with building close interaction between business and IT as part of the implementation of Agile. We call it Sbergile. On the one hand, we hear each other, on the other, this approach introduces more heterogeneity, because the teams run in parallel, they need to be somehow synchronized. In this case, architectural control is very important. But without a common focus on building a new platform, we will not move anywhere. Having taken a new goal, we must correspond to it.

The platform is the basis for building an ecosystem

A big direction in our strategy is related to the development of ecosystems. These are the services of our subsidiaries and our partners that we need to develop. The general idea is to give a quick start to those sites that will be part of the Sberbank ecosystem.

The core of the platform can also give a quick start, because some of the elements can be reused. We are talking about services such as identification, data exchange, API. These are the blocks that everyone will need. On the other hand, if this is a new business, then platform elements will help create a solution faster.

I would like to end with a quote from Mahatma Gandhi that “the future depends on what you do today.” So let's do it. We are going this way.

This subsidiary of the bank, as usual, began to implement all the bank’s IT projects and planned to enter the open market. But everything went wrong. The information technology foundation of the “largest bank in Eastern Europe” needs a complete overhaul. Created in 2011, after 7 years the company has not lived up to expectations.

You can, of course, try to argue with numbers. To say that it is now the largest IT employer in the country. More than 10 thousand programmers! We can say that revenue has grown over the past year. But this is clear evidence that the bank began to spend even more on IT without improving the quality of services.

In June last year, CEO Alisa Melnikova left the company. But this didn’t help the company much. Over the entire existence of the subsidiary and extremely important company for Sberbank, so many problems have accumulated that they are all starting to sink the parent company.

1. Too many people

This reason is a consequence of a mixture of gigantomania from the Soviet era and the desire of specific top managers to have budgets and power. But another reason is that the right hand does not understand what the left hand is doing. Remember Gref’s great statement about programmers?

“We don’t need programmers today. We have a huge number of programmers with whom we are fighting,” said German Oskarovich.

Half of the ministries and most of the companies on the market are screaming and chasing after the super-valuable and extremely necessary “builders” for the digital economy, which are what programmers should be, and Gref decided to fight with them. Who will realize the future? Why does a company need so many people? The same VTB or Alpha with Tinkov spend much less human resources on implementing exactly the same or even better characteristics. At the same time, people are lured away from the market with double salaries and promises that they will definitely change the world. But in fact it turns out to be a completely different story. According to papers, it takes 200 programmers and several months of hard work to put a button in CRM.

2. No breakthroughs

EFS, PPRB and FD. The company is proud of this and publishes it openly on its website. Let's look at a specific example. EFS - Unified Frontal System. What it is?

The Unified Frontal System is aimed at increasing the level of comfort of Sberbank clients when receiving services, as well as the convenience, speed and efficiency of the work of branch employees who provide customer service. EFS is based on cross-channel. Wherever the user comes from - through an application, a browser on a home computer, through a call to a call center or office - he can continue service through any channel from the moment where the last interaction in any of the channels ended - the system must recognize the client’s profile . In addition, EFS, through its own API, allows partners to log into the system, as well as integrate with third-party platforms.

But today a lot of services can do this! What prevented you from finishing Bitrix24 or a huge number of other systems in order to implement what is written above? This is not some kind of space. This is reality. Well, yes, Sberbank is large. But not the only one in the world. It would be possible to spy on others to do it right. Exactly the same with other projects. Absolutely lean nonsense is passed off as a breakthrough. And some of this “nonsense” has not even been created yet, but exists only on paper.

3. Simply boring

One of the reasons why “holy agile and scrum” don’t work is that they are implemented by specific people. At Sbertech, on condition of anonymity, several colleagues from the company confirmed that sometimes they simply do not understand what they are doing and how it will change the world. The bank does not need all these 10 thousand programmers in such numbers. So they stand idle. With our money.

4. Imposing extremely strange functions on the company

There was a scandal with an analyst from Sberbank CIB. The entire structure was dismantled. And now Gref has announced his intention to replace analysts with “artificial intelligence.”

Well, that's nonsense! But many listen with their mouths open. And they expect Sbertech to do everything now. So many programmers! But just as 9 women will not make a child in a month, so here - well, you will not be able to replace analysts with a computer or a neural network this year. And now imagine what strategic risks these are for the parent company.

5. Constant disruptions to the parent company

What can we say, even if at SPIEF a whole bunch of insiders loudly announced massive disruptions in the work of Sberbank at the forum. Which is just a shame. The company, by the way, did not confirm this, but did not deny it either, which indirectly proves the truth of the rumors. But regular failures, blocking of accounts for the transfer of 666 rubles and similar stories are further evidence of the impotence of managers. Yes, it was difficult, yes, there was an ordinary savings bank. But no one spared you money and time for the transformation. The hope was that you would be the best in the world. In the meantime, it turns out that you did not justify our hopes at all.

Sberbank is successfully implementing strategic initiatives, the goal of which is to build a technology platform and transform into a technology company by the end of 2018.

Strategic program “Reliability 99.99”

Sberbank has done a lot of work to ensure high reliability of its systems. Among the important milestones of this work is the organization of geo-reservation of Sberbank contact center services; creation of the core of a new highly reliable local computer network; operation of customer services when performing transactions in online stores, transfers, issuing loans, servicing through remote channels in Stand-In mode 24 × 7 during incidents and technological work. Downtime of critical automated systems at the South Port data center does not exceed 1.6 hours per year. This data center is certified under the Tier Certification Operational Sustainability program, Uptime Institute, GOLD level.

Highly critical services for transporting data between automated systems of Sberbank have been transferred to 99.999% operating mode, that is, system downtime is no more than 5 minutes per year. This ensures the continuity of provision of essential services to private and corporate clients.

The Sberbank Online system has a pilot block for employees, in which new versions of Sberbank Online are tested before large-scale replication, which minimizes risks and reduces implementation time.

IT Organization Transformation Program

Sberbank has introduced an end-to-end production process and resource planning, which has strengthened control over the launch and implementation of projects and reduced the average duration of projects from 30 to 18 months. The new process for implementing non-design tasks made it possible to reduce the time for their implementation by 1.9 times. The satisfaction of internal clients has increased, which increased by 3.8 times in the implementation of the IT component of projects, and by 3 times in the implementation of non-project tasks. Sberbank has completed the transformation of its IT organization. A platform for technological transformation has been created.

Technological Transformation Program

Sberbank has begun an Agile transformation, which consists of switching to a flexible development method called Sbergile. Sbergile teams are provided with basic automation, and a process for iterative service development has been developed.

Sberbank has created a unified process for managing operational and IT production, incidents and technology standards.

The headcount of the customer operations support function was reduced by 13%. Regional centers for supporting client operations in Khabarovsk and Voronezh have been transformed. IT operations support is provided in all time zones.

Program “Business Development Support Platform (18+)”

The platform is designed to become a universal designer for creating business applications.

The performance and scalability of the In-Memory Data Grid architecture has been practically confirmed, in particular, high performance of 35 thousand transactions per second has been achieved. A unified information space has been created, where data from 100 million clients has been successfully uploaded. Mechanisms for auditing, authorization, data access and batch processing have been developed. The most important services for business have been introduced: a unified client profile of the Retail block, a unified catalog of products and tariffs for deposits and bank cards, dynamic pricing. The first product factories were launched: P2P transfers, merchant acquiring, deposits.

The Program team received the status of developers of the open-source community of the Apache Software Foundation. Program projects were given the opportunity to develop open-source components of the technology stack of platforms.

"Unified Frontal System" program

The goal of the Program is to create a unified standard in all customer service channels.

The main emphasis of the Program in 2016 was on increasing active sales to private clients through the contact center, increasing the loyalty of corporate clients through the remote account reservation service without visiting a Sberbank office, and reducing the cost of services of external contact centers for corporate clients.

On the technical side, for this purpose, a unified library of interface components of basic system services was created, which are used to create the user interface. Using the library allows you to increase the speed of developing screen forms by 30–35% and reduce the cost of their development by 15–20%. A number of open-source components have been developed, which are presented for reuse and free access to the Internet community. An automatic application build pipeline has been introduced, and the technology for automatic system deployment to all environments is being piloted. Using DevOps technology will lead to a significant reduction in time-to-market and will allow you to bring products to market many times faster.

The functionality of remote account opening, salary projects, and corporate cards has been transferred to a new digital corporate platform. This is the first step towards the transition to the Unified Frontal System.

A mobile workplace for a direct sales agent has been created, which will allow scheduling meetings and optimizing travel routes taking into account the geographic location of clients.

The program is fully implemented using the Agile method. It takes eight weeks from idea to opening. More than 90 Agile teams work under the Program. In 2016, we managed to form the best team of IT specialists and business experts. The team consists of more than 1 thousand employees from Sberbank business blocks and 17 Sberbank Technologies competence centers. To attract the best specialists, Sberbank held an open day and an International Design Hackathon.

Data Factory program

The goal of the Program is to provide the Group with conditions for achieving a competitive speed of bringing new products to market, monetizing data, increasing the speed of making management decisions, and reducing the cost of data ownership. The program combined activities to create data services and develop infrastructure, taking into account current trends in the construction of corporate data warehouses and analytical platforms.

Key projects of the Program:

• “4D” client profile – increases the completeness of information and depth of history about a corporate client;
• “Mass personalization” – increases the efficiency of retail business processes of the same name by quickly obtaining reliable information about customers based on data;
• “Boutique Conveyor” – increases income from CIB clients by reducing time and increasing the efficiency of decision-making in terms of client information;
• the Geomarketing 2.0 project provides Sberbank’s external clients with information about the economic potential of individual geographic locations.

As part of the Program, the performance of the analytical data warehouse has been increased. A new critical element of the architecture has been created - the data cloud - this is a distributed data storage for subsequent processing, into which the first data from Sberbank's largest systems - the Unified Corporate System and the Unified Loan Portfolio - are loaded. Launched an area of ​​data experimentation and model hypothesis testing for business users. Sberbank managed to reduce the time for one-time data delivery at the request of Sberbank divisions to 10 days (previously the period was more than four months).

Program "Centralization 3.0"

The goal of the Program is to complete the centralization of the landscape, significantly increasing the economic efficiency of IT assets. In 2016, as part of the Program, 682 non-targeted automated systems (against the plan of 410) and two data centers were decommissioned. In 2017, it plans to retire a further 270 non-targeted systems and seven data centers and replace IT equipment.

From this conversation you will learn what exactly Sberbank's IT subsidiary Sberbank Technologies does, what Telegram channels an Application Security specialist should read, and why one should not forget about practice during training.

INFO

Sberbank Technologies (SberTech) is a subsidiary IT company of Sberbank, founded in 2011. It all started with a team of 500 people. These were mainly IT specialists from Sberbank who moved to work in a separate IT structure.

Today, SberTech has a staff of about 11 thousand people in sixteen cities of Russia. Key development centers are concentrated in these cities, where regional teams of IT specialists gather: Moscow, St. Petersburg, Novosibirsk, Innopolis, and so on.

SberTech is engaged in the development and implementation of software, as well as support of existing Sberbank IT systems. At the moment, Sberbank is the company's only client.

Artem Bachevsky, head of IT systems development in the Application Security department

Tell us what SberTech does, what projects are you working on now?

Currently, the key project is the development of a new technology platform for Sberbank. It transforms a business model into an ecosystem. This ecosystem will provide non-financial services, connect partners and contractors, will be able to process large volumes of data in a short time, and will allow for high system performance.

Let's take a closer look at non-financial services. What projects are we talking about?

Such projects already exist, as the ecosystem has been developing since 2016. A complete transition to the new technology platform is planned before 2020. Sberbank is striving to move away from providing only financial services and is actively acquiring partners. For example, Sberbank-Real Estate ( LLC "Real Estate Center from Sberbank" is part of the Sberbank group of companies. - Approx. ed.), “Sberbank-Insurance”, Internet service for finding doctors DocDoc and so on. Thus, transformation into an ecosystem takes place. Companies such as Alibaba, Amazon, and WeChat are following a similar path.

“Ecosystem” and “technological platform” are beautiful words, but I would like to hear more specifics. What is the essence of your platform, what exactly are you developing and why are these technologies outstanding?

The new platform consists of three key programs.

Business development support platform- a universal tool for creating business applications. The bank must become a Marketplace, bringing together a variety of tools to achieve the goals of its clients. This requires a foundation - a new platform: scalable, flexible, reliable and open, capable of changing in real time. The development uses the latest technologies for distributed computing in memory and running applications with large amounts of data in real time - In Memory Data Grid.

Data Factory program designed to increase the level of quality, reliability and availability of data for analysis. Bank employees will be able to fully analyze and interpret data without additional labor costs for their collection and reconciliation. Big Data ensures work with super-arrays of data for monetizing information and behavioral analysis of customers and employees, to adjust strategies for working with different segments.

Unified Frontal System- cross-functional platform, Sberbank’s own development. The platform's tools provide a seamless cross-channel experience for all products and services. The technology stack allows you to maintain high performance, reliability and security for users. In addition, through its own API, EFS allows partners to log into the system, as well as integrate with third-party platforms.

Now let's talk about security. Artem, tell us what your department does?

Our division deals with Application Security - application security. The department is relatively young, about two and a half years old.
Our main responsibility is to ensure application security. These are mainly automated systems critical for the bank, but all new mobile and mission critical developments also fall into our area of ​​responsibility.

Currently the department employs fifteen people. Conventionally, they can be divided into three teams: penetration testing team, mobile pentest and internal development. The team brought together employees with different technical backgrounds, mainly from various areas of information security, but there are also guys from IT management and development. Together with our colleagues from Sberbank, we are increasing the security of the systems being developed, maintaining a reasonable compromise between business needs, user convenience and the ever-growing risks in the field of software development.

We achieve all this thanks to the strong expertise of Sberbank and SberTech employees, as well as a mature and fundamental SDL (Secure Development Lifecycle), which takes into account modern trends and approaches (Agile & DevOps) in the field of software development.

A team of web pentesters is engaged in implementing various practices, analyzing their results and conducting the pentest itself. The mobile pentest team does the same thing, but for mobile applications. There are a lot of mobile applications in the bank, this is not only Sberbank Online, there is also Business Online, corporate services and so on.

How is this infrastructure built, you mentioned SDL?

We try to build the infrastructure in such a way that colleagues who are “in the context of the code” help us in analyzing scan results, reviewing code and writing rules for SAST (static application security testing). As part of the initiative to continuously deliver value to the client, we ensure application security by introducing the Sec context into DevOps, which is being built in Sberbank and SBT, and without the involvement of teams this is simply impossible.

The practice of involving developers through security champions has proven itself very well. Security champions are employees in development teams interested in professional development in the field of information security to increase the security of systems and reduce the risk of vulnerabilities. This is achieved by increasing the level of competence of AS development teams in matters of information security, replicating secure application development practices, and reducing the duration of the life cycle of an information security defect.

We also regularly conduct various awareness programs and trainings. Once a quarter we hold a general awareness for everyone. We have training on immersion in secure development in Java. The point is that this is the target programming language in the bank, so the focus is on it. The exact same targeted dives exist for Android and iOS.

Approximately how many hours of training do your developers receive per year?

In the security field, about forty hours a year.

What do you think is the role of education today? Every day something new appears, how to keep up with it?

We teach the basics and do not immediately strive to turn students into experts in the field of cybersecurity. At this stage, it is enough to involve them in the topic and lay down basic knowledge. Let’s say in the context of Java these will be practices of secure web application development, because in this area a lot revolves around web security.

What does a specialist need to do to always “stay on the cutting edge”?

At a minimum, I recommend subscribing to thematic Telegram channels to stay on trend and understand your interests in the profession. Personally, I read HackerNews, Habrahabr and Hacker. You can fork something on GitHub, try it out, evaluate it, and then maybe implement it. It is not necessary to dive into the topic as deeply as possible, but you definitely need to constantly try something new.

Also, in my opinion, it is good practice to participate in various CTF and bug bounty programs. In CTF you can purchase some skills, and bug bounty allows you to legally test the security of interesting systems.

Of course, learning is good, but learning alone, in my opinion, won’t get you very far. After all, without practice, learning is worthless, and behind any real experience, first of all, there is real work.

You are absolutely right. Tell us about your trainings and awareness, how does this happen?

We are trying to introduce various activities and gamify development processes. For example, at the ZeroNights 2017 conference we presented captcha-CTF. It was an interesting competition, where each challenge is a captcha with a logical or software error in its implementation. We invited conference participants to find these vulnerabilities, which allow solving many captchas in a short time.

The task was simple: it was necessary to “solve” twenty captchas in ten seconds, without actually solving them. Participants should not type all this by hand; they should, for example, implement an SQL injection so that nothing depends on the entered value. For example, in one of the tasks the captcha could be solved probabilistically - if you constantly enter the answer “5”, then with a 25% probability the captcha will be passed.

What is the purpose of such a competition? Few people today implement captchas on their own. After all, there is a ready-made and relatively reliable reCAPTCHA (if it is implemented correctly), but you can make a mistake in implementing this mechanism. If someone nevertheless decides to implement their own captcha, then participation in such a competition will leave much less chance of vulnerabilities appearing, since a person could see many errors during the competition. Moreover, these problems apply not only to captchas: there are many other mechanisms where similar errors can be made.

Does SberTech have centralized training, for example, do they train programmers?

All employees have opportunities to learn: external (courses and events), internal (meetups, hackathons, regular exchange of experience within teams and departments). Internal and external experts speak at the meetups: for example, one of the latest was dedicated to quantum computing together with IBM.

For students and aspiring professionals, SberTech conducts free schools on mobile development on iOS and Android, Java and BPM. We invite the best students to work based on their training results.

Let's move on to practice and your stack. Tell us what it consists of.

We try to find vulnerabilities as early as possible, so we use SAST (static application security testing) and DAST (dynamic application security testing) from the moment the first line of code is written. Based on one popular SAST product, we are building a solution that adds Security to DevOps for many automated systems being developed at SberTech. We are currently implementing OWASP ZAP into DevSecOps, which will allow us to develop even more secure and reliable applications.

We also search for known vulnerabilities in public components. For this purpose, a utility was created that aggregates the results of other similar tools (OWASP dependency check, Retire.js), and also scans the source code, isolating from it the components used, which are then checked against public vulnerability databases (NIST, CVEdetails).

As a result of manual analysis of bugs, we have accumulated a certain set of data with an expert assessment, and we trained a model (machine learning, which is so hyped now), which determines the chance of a vulnerability being true positive. This model helps a lot, because it at least deals with ranking. Let's say OWASP dependency check has a very low false positive rate, but it produces very few results. Our utility has a higher false positive rate, but thanks to ranking and a much larger number of results, we sometimes catch vulnerabilities that were not previously detected by other tools.

For systems where this is applicable, we use fuzzing - we build an intruder model and a threat model for all systems. We also review the code, namely its critical sections. And of course, we conduct penetration testing.

We do not leave developers alone with bugs, but go through the entire life cycle of the bug with them, advise them on elimination, and test them after corrections.

And I’ll tell you a little more about the development within our department. At some point we realized that managing the SDL process is impossible without Secure Application Lifecycle Manager. Taking into account the specific specifics of the bank (many automated systems, each of which has its own “zoo” of technologies and practices), it was obvious that we needed to write something of our own.

Therefore, we have created a product that concentrates all the processes of implementing SDL and maintaining process continuity, managing data flows (information security and related). It stores all the data accumulated as a result of various practices and allows you to manage it, automatically “rolling out” some actions for their smooth replication. It also distributes bugs across various issue trackers and provides interfaces for analyzing bugs using our tools. All this ensures the construction of SDL and effective interaction with teams.

Alisa Melnikova, General Director of SberTech, rather casually stated that “the company she heads at the end of the year became the largest software developer in the Russian Federation with revenue of 15.2 billion rubles (an increase of 46%) and a staff of 6515 people against 5300 people in 2014."

SberTech has stirred up the IT market

SberTech is a subsidiary of Sberbank and is engaged in the development and implementation of software for this bank. Many Russian IT companies have long disliked this vendor. There are several reasons for this. Firstly, such major integrators as CROC or Lanit now supply Sberbank only with hardware solutions and are strictly excluded from software.

Secondly, SberTech is like a vacuum cleaner pulling programmers out of the market, offering them significantly better working conditions. There is not a single IT company in the Russian Federation or Belarus that would not lose employees because of him. There is not a single bank from which the top managers of the IT block have not left.

Thirdly, after the “English Channel” project was put into operation at the end of 2015 (a paperless middle office on the Pega PRPC platform for 40 thousand users), HP, Canon, Xerox and other printer suppliers began to have a big problem with them. If previously a whole truckload of paper was delivered to the bank’s central office in Moscow once a week, now even a Gazelle is enough. And then only for signing contracts with clients.

Open-source and in-house development are a priority

And finally, what is interesting for software developers, SberTech has completely switched to open-source and its own development. With the help of this set of tools, in the near future it is necessary to solve three major tasks: the creation of a unified front-end system (UFS) for the development of customer service channels, a business development support platform and the launch of a data factory based on BigData technologies.

The conference on February 6 was devoted to a more detailed analysis of the ESF project. Why did Sberbank need to carry it out? Why should the bank's top officials speak at it in front of programmers? The answer was given by the top manager of Sberbank Vadim Kulik, who oversees IT and risk management of the bank.

According to him, the bank has long been a guinea pig of Oracle Corporation. They don’t have such a large database installation by this vendor with such a load on the front office anywhere else. At such a load and scale, “so many cockroaches” are crawling out of this database that it is unclear who should pay whom for licenses.

As a response to this and many other challenges, SberTech began to develop its own competencies. These include our own developments and the purchase of startups. For example, this is GridGain, which specializes in developing software for processing large amounts of data in RAM in real time (In-Memory Computing, IMC technology).

At the same time, GridGain is developing an open source distributed computing platform in Java, distributed under LGPL and Apache 2.0 licenses. This fact, as they say, makes it possible to “import-substitute”, for example, such a proprietary German solution as SAP HANA with success and minimal financial investments. So, if fintech startups have something to show, they urgently need to look for where Sberbank is located.

As for the front, the path of unification and centralization of all numerous products into one has been chosen both for our own operators and for clients with a convenient interface for all devices. On the scale of Sberbank, this is truly a colossal job. Until recently, changing, for example, the discount rate of the Central Bank of the Russian Federation in all systems took up to 3 months. At this rate, you can easily lose in the competition to the same Tinkoff Bank.

Sberbank is equal to Amazon or Google

The goal is to achieve an almost online launch of products on the market thanks to the EFS and the same online response to market changes thanks to BI and BigData based on the SOA integration bus, as opposed to traditional banking core banking systems and ERP. This, according to top management, puts Sberbank on a par not with financial institutions, but with technology giants such as Amazon or Google. At least in Russia. At the same time, we must not forget that the bank is vulnerable to Western sanctions - therefore, the emphasis is on its own development. And that’s why Tinkoff Bank’s approaches don’t quite suit him.

This fact forces SberTech to turn on the vacuum cleaner in a new way and look for programmers who are mentally up to these challenges. As the speakers noted, IT specialists working in banks are blinkered and do not want unnecessary changes. Therefore, the recruiters' eyes turned to Yandex and the like.

But they are also no strangers, they are ready to retain specialists at any cost. Therefore, SberTech is ready to consider candidates for “juniors” and is opening its own school for training programmers in Java and JavaScript (not a word was said about PHP). There was a lot of talk at the round tables about interface developers and layout designers. It turned out that in the Russian Federation there are practically no great specialists in this field on the market, especially in mobile.

The conference lasted the whole day with many round tables. It is not possible to describe everything briefly; the conference organizers promised to post a video of the event for all those interested. And it was all about the ESF! But two more megaprojects, which were described above, are being developed in parallel. It seems that at this rate SberTech can catch up with large American vendors.