Empowering Japan’s First Fully Digital Bank with Real-Time Protection, AI-Driven Insights, and Unmatched Support
Business Challenges
- Difficulty scaling a digital-first mobile banking experience
- Lacked visibility, security, and compliance across applications and cloud-native infrastructures
- Security requirements slowed development and deployment
- Too much time spent on vulnerability management, limiting strategic security efforts
Company Overview
Deliver valuable connections to everyone.
That’s the core mission of Zerobank Design Factory (ZDF) Ltd. A subsidiary of the Fukuoka Financial Group, ZDF developed and operates the banking system for Minna Bank Ltd., Japan’s first fully digital bank. Built on Google Cloud, ZDF’s platform provides all services via an intuitive smartphone app, making it ideal for the digital-native generation.
Challenges
Disjointed Security at the Cost of Efficiency
A digital pioneer, Minna Bank aimed to deliver a seamless banking experience, which started by tasking ZDF with building and maintaining the infrastructure to support this vision. Rather than relying on third-party solutions, they chose to develop everything in house. Leveraging Google Kubernetes Engine (GKE), they built and deployed critical systems, from accounting to information, ensuring a fully integrated digital banking platform.
“Given the sensitivity of financial data, our security requirements were extremely strict,” said Takumi Sakurai, Architecture Group Manager at ZDF. “We initially selected a vendor that appeared to meet our security requirements on paper. Unfortunately, their solution proved operationally problematic.”
“Our goal was to build a system that was secure enough for financial services but agile enough to scale rapidly while continuously integrating new applications and features,” said Kazuhiro Oshikawa, Senior Manager of Minna Bank’s Cybersecurity Group. “This was simply not achievable with the original solution we tried to implement.”
Inefficient Security and Compliance Management
To bolster security and protect against internal fraud access, ZDF implemented a strict isolation policy, separating the development, semiproduction, and production environments into distinct clusters. This approach ensured that even the head of Minna Bank was restricted from accessing the production system. To streamline platform management, the company adopted Terraform’s infrastructure-as-code (IaC) framework, enabling operational automation through code.
However, their existing solution fell short of meeting their needs. While it could handle traditional security and regulatory standards, it struggled with the more complex demands of managing GKE.
“The vendor’s software relied on a predefined list of approved entries that had to be manually updated with every development or update,” Sakurai said. “The list was managed in JavaScript object notation, which wasn’t IaC compliant. This made it incredibly difficult to review and identify differences.”
Frustrating Support and Delayed Responses
ZDF’s issues extended beyond functionality to a deeply frustrating support experience. The vendor’s response times were sluggish, and their support team often lacked the necessary expertise to resolve issues efficiently.
“When we encountered a bug or other problem, we had to wait several days to several weeks for a response, even when we flagged an issue as urgent,” Sakurai said. “We were frequently told that the support team didn’t understand the problem and needed additional time to research it. There was no partnership; we were just a ticket in their queue.”
Time Wasted on Alerts That Didn’t Matter
Alert management was another critical pain point with ZDF’s previous security solution. The team was bombarded with vulnerability notifications, but the software lacked the ability to prioritize or categorize them, forcing the team to manually investigate each alert.
“As a security administrator, I couldn’t help but note the massive amount of time we wasted because of our security solution,” Oshikawa said. “It wasn’t just the workload but the overhead as well. The time spent manually reviewing alerts left little room for more strategic security initiatives.”
Solutions
Seamless Cloud Security for Scalable Operations in Complex Cloud Services
ZDF recognized the need for a more comprehensive security solution. They sought a platform that would deliver vulnerability management, visibility, compliance checks, real-time threat detection, and unified management across their cloud-native infrastructure. Sysdig fulfilled all of their requirements.
With Sysdig, ZDF now has complete visibility into their entire ecosystem from a single interface. They can monitor the security status of Kubernetes resources in real time and automatically prioritize alerts based on their relevance and criticality.
“With Sysdig, we have the level of information we want, when we want it. We can look at one dashboard to review information about our environment or review a single alert, then immediately take action,” Oshikawa said. “I especially appreciate its vulnerability management features. The ability to detect vulnerable functions or packages through InUse has been invaluable for effectively prioritizing issues. Manual vulnerability assessments and incident responses have been reduced, allowing us to redirect our security resources to more advanced tasks.”
Simplified Compliance and Risk Management
By implementing Sysdig, ZDF has significantly enhanced both their real-time threat detection and vulnerability management capabilities, particularly in mitigating technology-related risks. Sysdig’s compliance management features have also brought substantial improvements, allowing ZDF to quickly assess compliance with global standards and identify any missing policies.
“Sysdig has simplified compliance. It comes with a lot of out-of-the-box policies and mappings to the compliance frameworks we follow, but being built on open source Falco, it is also flexible enough to write our own rules as needed,” Oshikawa said.
The integration of Sysdig with Terraform has proven to be another major benefit for ZDF. Their infrastructure team can now operate directly within Terraform, eliminating the need for a GUI and streamlining their workflows.
A Superior Support Experience
The contrast between Sysdig and ZDF’s previous vendor was evident in many areas, but none more so than in support.
“I could tell right away that the Sysdig engineer responding to our questions had in-depth knowledge,” Oshikawa said. “No matter the question, he would dig deeper and provide precise answers. In some instances, he even verified and shared the results of detailed behaviors not covered in the documentation.”
ZDF also values Sysdig’s implementation of generative artificial intelligence (AI). Beyond explaining security incidents and offering remediation guidance, Sysdig Sage™ is an AI analyst that anticipates security needs and elevates human response. According to Oshikawa, this has streamlined both operations and support.
“Sysdig Sage is always there to answer our questions. It is upleveling junior teammates and elevating senior cloud security engineers. It goes beyond basic summarization and employs multistep reasoning and contextual awareness,” he said. “Sysdig Sage helps me resolve issues faster and without having to engage other teammates.”
Ongoing Success With Sysdig Security
Looking ahead, ZDF plans to accelerate the development of new features and services to further support Minna Bank’s mission to deliver a seamless, fully digital banking experience. Both the infrastructure and security teams are highly satisfied with Sysdig and intend to continue relying on its security capabilities.
“Sysdig doesn’t just look good on paper – it performs exceptionally well,” Sakurai said. “It delivers everything we need, exactly the way we need it.”
To learn more about ZDF, visit www.zdf.jp.
About Sysdig
In the cloud, every second counts. Attacks unfold in minutes and security teams must protect the business without slowing it down. Sysdig, named Customers’ Choice in the Gartner® “Voice of the Customer” report for cloud-native application protection platforms (CNAPPs), stops cloud attacks in seconds and instantly detects changes in risk with real-time insights and open source Falco. Sysdig Sage™, the industry’s first artificial intelligence (AI) cloud security analyst, uplevels human response and enables security, developers, and DevOps to work together, faster. By correlating signals across cloud workloads, identities, and services, Sysdig uncovers hidden attack paths and prioritizes real risk. From prevention to defense, Sysdig helps enterprises focus on what matters: innovation.
Sysdig. Secure Every Second.
Take the Next Step!
See how you can secure every second in the cloud.