When we were almost done with the transformation from a traditional bank into a tech company, 2020 came, and we had to make some further adjustments due to the Corona outbreak. Our presentation will guide you through "how did it work out". We always base our talks on "Why" are we presenting this topic and on the key takeaways for the people attending. Why? In 2020 our Bank went through many challenges, starting from increasing cyber-attacks/scams to organizational and other corona-related problems. We believe that we have some valuable lessons learned that can be helpful to any Corporation, and not only during a global pandemic. Takeaways: 1.How did the large banks adapt to the Corona situation 2. What were the challenges in our organization and how we approached them 3. From a cybersecurity point of view, what changed in 2020 in the banking sector?
IT OPS Chapter Lead, Fraud & CyberSecurity, ING Bank
Senior Software Engineering Manager, ING Bank
Engineering Manager Chapter Lead, Cybersecurity & Fraud, ING Bank
Hello everyone. And welcome for today. We are going to tell you the story of our past two years, and we're going to see together how we approached and overcame the COVID-19 challenges I'm joined today by two of my colleagues, Mihai Popa, which is the head of global consumer landing platform, Mihai Roman, which is the engineering chapter lead within cybersecurity and fraud. And I'm George, the it ops chapter lead within the same area, cybersecurity and fraud. And now a little bit about ING. ING is a Dutch market, national banking and financial services corporation. Having the HQ in Amsterdam, uh, we are currently employing around 52,000 people out of which around 30% are engineers. And we are supporting over 39 million customers who are operating in around 40 countries within Europe, north America, south America, middle east Asia and Australia. And now let's dive into today's topic. Uh, for me, it was quite interesting because I was actually in Asia when the pandemic hit the news and things escalated quickly.
Uh, this photo was taken on the 1st of February in Japan and basically, uh, there, things were taken seriously from the beginning. I still remember that the face masks went out of stock, literally in a few hours after everything hit the news. And from there, I, uh, had to fly directly into a business trip in Romania. And when I arrived in Europe, it was, uh, I was actually a bit shocked, like coming from Asia where a very strict testing was in place. Uh, masks are already mandatory in many places in some, um, areas that are already testing the temperature. From there, I arrived into a place where people were actually looking straight at me because I was wearing a face face mask. And even if everything was okay, of course, I, uh, started wearing the mask monthly because, uh, as a precaution to protect everyone, uh, because at that point there were not so many things known about Corona. And since I was going to the office, I wanted of course to have some extra safety measures in place. And this is me in the office on the 11th of February, 2010.
And, um, now let's see a bit what happened next? Well, um, once the local authorities decided the new rules, uh, in most of the European countries, we started working fully remotely. And that's the point when the initial challenges appeared? Uh, it started with some, uh, January, the challenges that problem, many corporations face, like of course, the shooting of VPN connection to support all the employees, uh, the internet of home, because in some buildings they were sharing a connection. And since everyone was at home, then they started having, uh, bandwidth issues, uh, different, uh, problems with the laptops headphones and how we were shipping them since they couldn't come to the office. Um, and all these, uh, we're also together with our adapted way of working. Uh, we call this actually the home way of working, um, because we suddenly had more meetings, more calls, more emails.
We had to adapt the time we spent on chatting in order to also do our daily tasks. And since you couldn't just go directly on top of your colleagues anymore, um, you had of course to message, email, try to have a call or a video call. And so on. Um, in our case, we were somehow lucky because most of our engineers were already working one, two days from home. Um, and they were somehow used and they had already a place where, from where they were working on sawn. Uh, but now it was a bit different because they were all of a sudden with their whole family at home. And in some cases they had also young children and they were kind of easily distracted and they didn't have, in some cases a much, um, yeah, the right environment actually, to, to focus on their daily tasks. And so, but I'll, let me hide tell us, uh, how all these impacts with our teams and how things evolve in the, in the following months behind.
Yeah, that's it let's move ahead. So thanks a lot, George, for this beautiful introduction and for reminding us about how all this started, uh, probably for most of you, this is not new. You just remembered, uh, on, on how the things, how did the things started? Actually, what we want to do today is to share with you some, some, some of our stories and the way we've we've, uh, went through this, uh, let's call it situation. So for the first few months, what we tried to do, uh, was to emphasize two things. One was accountability, and the other one was trust. So we, we said, yeah, okay, we're going to provide to all the engineers, the right tools so that they can do their work. So we've increased the capacity for VPNs. We told to everyone to stay at home, but then we also started to, uh, to tell them, look, this company is, um, you're, you're a part of this company, which means that you are accountable and responsible for the world that you are having, you are going to have to do well.
We're not going to check you on, on that. And we actually cannot check you if you are at home. Um, this is also very linked to the trust, right? So I have to give you accountability. And I do trust that you're going to do your work. Now, some of you might have, might smile and say, yeah, come on. Some of the, some of the people probably didn't behave correctly. What that's true. I think this is in the human nature. And I think in the end, um, everywhere this, uh, this actually happened, but it's important to know that, um, in most of the cases the engineers actually did the work in, uh, in the right way. So if we, if we would move forward, um, we observed a couple of behaviors. So the first one was that, of course the engineers were like, okay, I'm going to work less.
But then they started to actually behave, behave in a proper way. And then we noticed that most of them started to be tired because they, they were doing actually more meetings and more work than, uh, than, um, than before. Um, and that was actually a problem, which we, we didn't, uh, we didn't foresee, um, others. Yeah. Let's say maybe three or maybe 5% of, uh, of them. They, um, they started to work a little bit less, but that didn't actually last that much. So keep continuing on this, on this, uh, uh, on this line of thinking, um, and then moving, moving ahead, we said that we have to lead by example, right? So we said that there is no better person than us as managers to, to, to show to the engineers how we actually have to, uh, have to behave and hear me, both me, hi, George and myself, what we try to do in our, in, uh, in the areas where we are working.
We said, it's important to show that, yes, we respect our colleagues. We respect the time, the timing for the meetings. We do our work as good as we can. We actually try to, um, organize for example, um, meetings or coffees, just to catch up because at the beginning, probably that happened in your organizations as well. People were not, um, we're not doing that. You know, people started to lose a little bit, uh, the content. So we organized those virtual games or virtual coffees. We organized online events and we did regular check-ins. And of course that, now, if you're looking at it behind, in hindsight, you're, you're, you're thinking like, yeah, this is obvious where at that moment in time, it was not obvious in that moment in time, everybody didn't knew exactly when the crisis kind of finish. And we also didn't know how, how long, uh, how long we will be able to cope with this.
Right. And at a certain moment in time, people started to get tired, started to feel that they were, uh, actually, um, losing the contact with their colleagues. Um, the typical gossip, I think everybody goes sips in every company, uh, started to fade a little bit out. So did, these were the, the, the first few months now, now, if we would look, if we move forward, um, we, we want to share with you also about how actually NG did support us. Uh, cause we didn't do this on, on completely on our own. So for example, I NG provided us, um, a rotation system. So especially when this, when the situation, the health situation improved a little bit and just said, look, if you want to come to the office because you have kids at home and is very difficult with them, or if you're feeling lonely, because of course there are there also people who don't have a relationship, uh, you can come in the office.
Uh, they also gave the to work from another country, Europe, it's, it's a big continent, but not so big. So you are actually allowed to go, go in your home country and work from there. Um, and, uh, in some of the countries, ING offered a certain budget to, um, to acquire different equipment. Like, um, I don't know, maybe an extra screen or maybe, um, a keyboard or a special loss. Um, and we as managers, we felt actually very, um, very good about this because we felt that the company supported us. We were, we were not actually alone. Um, some other things that you're going to see here in the, on the side it's, um, that, for example, we, we, uh, we said that we were encouraged to work from home 60 to 70% and maybe come to your face if that was possible with its posture surveys.
Um, and then we had some actions from those surveys and we tried to improve the, um, the quality of our, our engineers. Um, and maybe one of the most important ones is at least for me, which I admit that, uh, it was not invented that ING we've, we've heard it from other companies. We said that we're going to have days where people do not have meetings. For example, it can be Wednesday or Friday or whatever they, where people can actually focus. Because again, at the beginning, it was very difficult to focus you to so such an amount of meetings and discussions and coffees and, uh, and so on. So actually this, this is how, uh, how I just support us. This is actually what we did. Um, and now I'm going to let, um, I'm going to, let me hide to tell us, um, a little bit about, uh, first, what, um, what did we do and then a little bit about the awareness and security part, uh, which he, uh, is a master of so many high, um, I'll let you take it from here.
So we had a quick look at what NGS company provided for us and how it supported, but we are all humans don't take into account if you're a manager or a, or a simple engineer. So we had to pay more attention to our interactions and how we interact with, uh, with the others. A simple thing that, uh, it may be said, it's when you do a call, make sure that your camera lights on. Of course not everybody it's, uh, it's comfortable of doing that. Some people are making jokes. I'm not going to turning on my camera until 10:00 AM. I still need my two coffees in the morning before I'm, uh, I'm fully running. So all these kinds of, I would say small points helped us in our interaction, in our daily interaction with, uh, with, with each other it's yours. You don't have any more, uh, an easy way to read, uh, the body language of, of your colleagues or your manager of, of your team. So paying attention to meet in meetings or at the, uh, the voice of people, it became more and more important. Of course, there are situations, uh, Mihai mentioned about having the correct hardware, which helped a lot in, in the last 18 months plus to go through to this, um, situation.
Now looking a bit from, from our perspective as, uh, as leads as, uh, being part of the leadership team we have, and we still have a lot of meetings. We've looked a bit how we can start to interact again with people in, in person. So when the situation got a bit better, we we've started to have like a one-to-one sort of, I will not call them team meetings, but just to gather each other for like half an hour, one hour outside in, uh, in the middle of a park and just have a simple discussion, which can simply replace one meeting or two meetings that, uh, we would have in front of our, uh, our laptops and last but not least, we are all three engineers at our roots. We are dealing with engineers, uh, all day long. So there were things that had to change.
We were in we're in the office. We had the certain, uh, network there, which was not easily accessible from, from outside. So we had to go the LVP. And one of the first actions that has been taken is to, to switch all non-critical functionalities and systems that we need to do our work outside of the, of the VPN. Of course, that's coming with it, other challenges, which I'm going to tackle in a second, but in the end, we have to trust each other as a leader, you can say, we need to trust our people as a, as an engineer, you can simply say, we need to trust our leadership, but I, as I've mentioned about the, um, the virtual private networks and ways to make the life of every employee easier or smoother during this, uh, strange, strange period, I want to switch a bit, uh, the focus from the situation in which, which we have faced to what we had to take into account on the longer run during this, uh, this 18 months initially.
Yeah, we got the government saying everybody has to work from home. There was the strict rules. And so on the first, our first, uh, initial reaction was we need to ensure that our people are healthy, not only due to the, um, the virus, but also they can remain, uh, they have a mental health in a proper state, but also from a security perspective made of March. Last year, everybody was in the office. We had access to the, to a secure network. As of 16th of March. Everybody was at home. What happened at all that security gate. We moved out of VPN with VPN, everybody it's, it's, uh, probably, uh, tired of approving on their mobile, all kinds of multifactor authentication for all kinds of systems. But then here, it does a space for people to not pay attention. For example, if, if I have to access three systems and I get, I'm getting six notifications to approve the access there, one of the six may not be one triggered by me.
So that, that, uh, opened the door also for, um, for some attacks and threats and one of the actions, and one of the messages, uh, that we have sent in, we have encouraged do not approve anything. If you haven't done an action upfront, it may sound silly, but being all the day in front of a screen and dealing with technology, it's very easy to go over, uh, this, this smaller, these small details. Uh, judge mentioned it in the beginning of it. We had devices which have to be shipped or devices that, uh, that broke, uh, w we have colleagues which are dealing with confidential papers. So the physical security, it, it became another problem which had to be, uh, we had to deal with, with it, how people were, uh, were billing to the office when they had to deal with confidential information or confidential documents, laptops are broken, how we, we had to deal with this. There are situation where people could go to the office to get the replacement in other situation. Not. So it was not only about keeping everybody safe from them virus perspective, but we have to keep also our working environment safe.
We went through quite a lot, I think all of us in the last, uh, in the last year and a half. But if, if we try to look a bit, a bit ahead, honestly, for me, the office will not look like before. Like I knew it in a 20, 19, early 2020, so we'll have to adapt. We've adapted a lot in the last, in the last period. So we need to find a balance hybrid office home, any of this combination with a certain percentage or not, it's, it's applicable as long as everybody feels safe. And we have the trust between between ourself as a peer, as a leader, as, as a team, we need to find the balance between these, these three points. Um, so George mentioned in the beginning that our colleagues, and we know when people in, in this world, not only in, uh, in our company, which have a certain, um, situation, or they, they feel in a certain way when they are at home, versus when, when they are in the office, having some discussions with, with some friends, somebody told me simply, I am not going to go over to the office, except if we have a clear workshop or a day when we have to decide something, others are like, yeah, I would like to go more to the office.
And so it's, it's not going to be a 50 50, like it was before home office or hybrid with office. And, and so, so it's, it's going to change. We're going to try something for a month. We're going to try something, uh, the month after. So we had to adapt and we will have, will have to adapt India. And the office was, was a space where people were together. We learned, and we did the same in a fully virtual environment, but why not? For, for the future to let everybody like all the teams to decide by themselves, if they want to be in your office, if they want to be a part in the office part at home, as long as they have the environment to, to have that conversation and to make the progress that we are expecting. And they are expecting from each other, why not?
Sky's the limit. We see the ground rules will be just to have the means the ways for the people to, to get in contact and to go forward, to move forward. And yeah, Indian that I can translate it simply we have to be a child. We are a gel, but that should not stop. Now, you're looking also for functional positions and locations of, of the engineers church mentioned the, the 52,000, uh, employees of ING. We today, the three of us, we are dealing at least with, I think engineers located in six or seven countries on a day-to-day basis. We have to do it. We have to go forward like this three years ago, we could say, yeah, I need to have a discussion with three people that are located in, uh, in the U S or, uh, in the Netherlands. I'm flying, driving, taking the train to go to that location that will not happen anymore.
So we'll have to do it with, with what we have now, and to make the, to make the best out of it. One important thing, which maybe in the beginning of this situation has been, uh, has been missed it's celebration and Indian. We don't have to celebrate any successes. We have to celebrate also mistakes, as long as they don't go over and over. And we learn, we learn something, uh, out of it, we need to understand who we are and where do we want to go? And what we can do to have a smooth, smooth, a smooth road and habits. We all have, have habits going to going to the office. It can be possible to have it now working from home. It's a new habit. We'll have to change it in, in a way we're in another, as the world is changing, we tore it out. Um, the, the current health situation, but we'll have to change last but not least on, on the future that people are the most important pillar in, uh, in the discussion, trust them, give them forward. And they will give you back exactly the same.
Now, as, as a short, uh, conclusion, we have went through extraordinary times with exceptional measures, where looking ahead, we hope that everything is kind of, it's going to be better. Nevertheless, keeping in contact, keeping the connections alive with colleagues, counterparts, uh, friends that remains very important. It doesn't knowing that we had to do it for months, just over a zoom call or a, or a team school, what the connection needs to be there. Nevertheless, we have to build the new, the new normal to look how the, our new working environment would look. It's not going to be the same setup for each one of us is going to be different. We have to work together. We have to communicate in order to build it. And in the end, we are doing all of these to stay a step ahead and in the current, uh, times stay safe. Thank you very much. And looking forward to see you in person, either in Europe, either in the United States. Thank you very much.
Unlimited users from organization
Gene Kim's Audit and Security Playlist
Matt Bonser, PricewaterhouseCoopers LLP; Yosef Levine, Deloitte; Jeff Roberts, Ernst&Young; Michael Wolf, KPMG; Gene Kim, IT Revolution
How Fannie Mae Uses Agility to Support Homeowners and Renters
Kimberly H. Johnson, Fannie Mae; Tim Judge, Fannie Mae; Christopher Porter, Fannie Mae; Ramon Richards, Fannie Mae
From Your Auditor Friends: What We Wish Every Technology Leader Knew
Clarissa Lucas, Nationwide Insurance; Rusty Lewis, Nationwide Insurance