How HMRC Digital secures services at scale
summary
Multi-channel Digital Tax Platform hosts over a thousand microservices including about 340 front ends and handles data for roughly 45 million taxpayers and 5 million companies while processing hundreds of billions in payments. The platform enforces Scala Play services, hides AWS credentials, and provides self-service CI/CD. Central appsec builds and deploys tooling that works: Bobby runes blocks disallowed dependencies, a dependency Explorer maps exposure, a leak detection service scans commits, and a risk Ledger plus an MVP dashboard surfaces prioritized CVEs for teams to fix.
AI-written summary · about
chapters (14)
- 0:00HMRC Digital’s tax platform intro
- 3:44Secure services for all
- 6:13Application security at scale
- 9:02Threat actors in tax services
- 11:15Microservice architecture at scale
- 13:21Managing changes securely
- 14:25Dependency security with Bobby
- 16:33Preventing secrets leaks
- 17:36Vulnerability assessment with Explorer
- 20:50Prioritizing vulnerabilities
- 22:37Finding risky code patterns
- 23:43Platform-based security team
- 25:30Collaborating on security
- 27:16Key takeaways
related talks
35mSecuring digital services
17mPlatform Engineering & Digital Transformation
39mMicroservices and Continuous Delivery at the BBC
23mPaving a Secure Road
31mServers Are Not the Hardest Thing to Orchestrate
41mUsing automation to scale security
27mTechnology is Easy. Culture is Hard.
35mRoad to Efficient and Data-Driven DevOps