This document discusses the inherent tension between performance and security in software systems and how Intuit balances both priorities. It outlines Intuit's approach to delivering fast and secure services through techniques like identification and authorization, monitoring and automation, and continuous performance and security management. The document provides examples over time of how Intuit has evolved its landscape and techniques to serve customers through different eras from DOS to mobile.

1. Performance And Security:
A Tale Of Two Cities
Rekha Joshi
Intuit
Rekha Joshi @rekhajoshm

2. About Me
Rekha Joshi
Principal Software Engineer, Intuit
https://www.linkedin.com/in/rekhajoshm
@rekhajoshm

3. Today
How Priorities Stack Up
Fast And Secure Services
Monitoring
Automation
Back To The Future!

4. Inherent Tension
Systems Not Performant Are Not Used
Systems Not Secure Do Not Last

5. Performance And Security: A Tale Of Two Cities
Image Credits: Bollywood

6. We Never Want Fast At Risk Of Safety
Image Credits: Disney

7. Recognizing Explicit Protection For Our Future
Choosing Your Leader Getting Through Airport
Image Credits: Internet Archive

8. Intuit - Performance Driven, Security Top Priority
Systems That Are Performant And Are Safe To Use
Systems That Are Secure And Are Usable

9. Consumers Small Businesses Accounting Professionals
Intuit – Who We Serve

10. Era of Windows Era of Web Era of the CloudEra of
DOS
Compliant
data
Mobile First
1980s 1990s 2000s
• Employees: 150
• Customers: 1.3M customers
• Revenue: $33M
• Employees: 4,500
• Customers: 5.6M
• Revenue: $1.04B
• Employees: 7,700
• Customers: 37M
• Revenue: $4.2B
20162010
Regulatory
data
Transactional data Batch data Real time data Complex, secure data
Intuit Landscape

11. Secure Services

12. Identification– Stop The Flood At The Gates
How many of you use passwords
known in bad passwords list?
How many of you use your
spouse or birthdates as
passwords?

13. Multi Factor Authentication
Push Approve
App Codes
Fingerprinting
Biometrics
USB ( Yubikeys)

14. Authorization
By The Power Of
Gray Skull,
You Do Not Have
The Power!
Image Credits: He-man And The Masters Of the Universe

15. Enforce Principle Of Least Privilege
Image Credits: Amazon Web Services

16. Making Security Easier
Custom Libraries
Secrets Management and Encryption
Data Classification, Governance and Stewardship
WhiteListing Process
Educating The Workforce

17. Fast Services

18. Where Are Performance Gains Coming From?
Image Credits: Silicon Valley

19. Configuration of Servers
Elasticity
Managing Memory
Optimized Instances
Using Enhanced Networking ( HVM vs PV)

20. Improving HTTP Protocol (HTTP/2)
Evolving
Compressed Headers
Multiplexing Request/Response
Reduced Number Of Connections
https://http2.github.io/

21. Codebase
Optimize, Tune Technology
Caching, Optimized Flows
Language Performance Improvement
Solution Path Analysis

22. Follow Your Customer Home
Explore How Your Customers Actually Use Your Product/Services

23. Continuous Monitoring

24. Monitoring Tools
AWS resource
alarms Custom App MetricsJVM and App
Metrics
Custom process
alerts
Logging and
alert
Receive an alert about an outage that hasn’t happened yet.
Prometheus.io
ElasticSearch
Kibana
LogStash
HipChat
Grafana

25. Logging And Audit
Manage Logs
Visibility on internal host state
Auto Anamoly Detection From Logs

26. Performance Management

27. Security Management
Vulnerability Testing
Network Analyzer
Threat Modeling
Mitigation
Continuous Monitoring

28. Automation

29. Injecting Performance Testing In CI
http://gatling.io/#/

30. Auto Notifications
Available Verified Patches For OS, AMI, Browsers, Mobile SDK
Available Patches For Possible Vulnerability/Threat

31. Automated Deployments
Making Configurations Easier To Change
Emergency Restacking

32. Back To The Future
The Future State?
Naturally Secure
And Performant
Systems!

33. Ahoy, Towards That Future!
Image Credits: Disney, Marvel comics

34. Rekha Joshi
Principal Software Engineer,
Intuit
Rekha Joshi @rekhajoshm
Thank You