Why does open source matter to us?

Silviu Mihaila
Engineering Lead, Lloyds Banking Group
14 January 2021
5 min read

As the UK's leading digital bank, we know the importance of delivering the best digital tools, platforms and products to our millions of customers. That’s why, here at Lloyds Banking Group, we understand how crucial open source software is in helping us to deliver our digital strategy and stay at the forefront of innovation. 

Open source allows us to build the right products that our customers need in today’s fast-paced, ever changing digital world. The software works by allowing developers to collaborate and build code which can be easily accessed, studied, modified and shared, meaning that developers and fans of coding from all over the world can spot bugs and build enhancements to our digital products. This ensures that our offering is ever evolving and improving, and reflects what our customers really need.  

With the importance of safely strengthening our digital capabilities in mind, we’ve recently launched our Open Source Mission. The aim of the Mission is to provide robust solutions to how Lloyds Banking Group safely consumes, contributes and publishes open source software, while collaborating with external open source communities. 

As part of the Mission, we’ve developed guidelines to allow the Group to realise many of the productivity and innovation benefits of open source software in building products and services, while optimising its cost and mitigating its risk. This also accounts for legal and license compliance, by providing a set of guidelines for colleagues to participate in external projects and communities. 

 

Our aim - "The aim of the Mission is to provide robust solutions to how Lloyds Banking Group safely consumes, contributes and publishes open source software, while collaborating with external open source communities."

To achieve these objectives, the Mission has set out the following goals:

  1. To build a strong open source mission statement and supporting strategy.
  2. Supporting open source migration processes for strategic services, platforms and applications.
  3. Provide a strong communication channel between the software development teams, Lloyds Banking Group management, product owners and internal business units, in order to convey the activities and results of the Open Source Mission quickly and effectively.
  4. Prepare a flexible and adaptable risk landscape towards control effectiveness to provide the right level of assurance to the bank, as well as the conformance that the regulator requires.
  5. Enable an ongoing monitoring of open source software critical services, applications, and addressing cyber resilience whilst accelerating digital innovation and transformation.
  6. Provide a multi-tiered training program for software development teams and other stakeholders in order to help enhance team and collaborator open source skills.
  7. Implement process automation and tool support to empower developers.


Open source software: benefits and pitfalls

Today, enterprises are becoming one of the most influential forces in the open source ecosystem - and their impact is only going to increase. They are consuming it as fast as possible, but also contributing not just patches and fixes but complete sets of functionality, and are even open sourcing entire applications. But, at times, in their objective to harvest all the benefits that new developments bring, their passion can have unintended consequences; usually as a result of inadequate quality management.

 

The benefits of open source include:

  • Supporting organisational security, flexibility and resilience by creating common and flexible responses through open source communites and collective work.
  • Advancing innovation across all areas of business and society by increasing engagement and collaboration.
  • Attracting and retaining talent, because the best developers want to work with the latest open source technologies, and in a collaborative manner that is also open source and are most likely already contributors to projects being developed in the organisation.
  • Increasing productivity, because developers with open source software programming skills can be productive on the day they are hired to work on these same technologies inside the Group.
  • Allowing easier customisation and better adequacy as alternatives are freely available.
  • Cutting the development cycle, which can reduce the cost of software development in an open source ecosystem.

The Mission recognises the fact that the Group, like all financial institutions, is undergoing one of the biggest transformations in its long history, and that reaping the above benefits of using adequate and effective open source software is part of bringing about this seismic change. We also understand that these changes require full organisational buy-in and adoption in order to truly make a difference.

Pitfalls of open source - and how to address them

The use of open source software could introduce various risks and security challenges for organisations, such as:

  • Compliance risk, intellectual property and license management issues
  • Security and vulnerability management concerns
  • Operational risk such as software versioning, duplication and prioritisation
  • Reputational risk in case of any system, services and customer data compromise and exposure.

However, with an adequate strategy, competent and mature open source management, these concerns can be addressed, allowing the use of the right software to innovate and deliver applications and services to the market rapidly.


Ten ways to avoid pitfalls of open source:

  1. Define a risk profile for open source software
  2. Establish an open source software policy with the right scope
  3. Add security as part of a native software development process
  4. Create and validate an open source software inventory
  5. Define measured outputs and specific metrics for software security initiatives
  6. Develop a security focused organisation culture
  7. Verify authenticity and block corrupted downloads
  8. Check for vulnerabilities and blocking severe risks
  9. Check licenses and block for licenses prohibited for specified use cases
  10. Provide a warning strategy for obsolete software

For any organisation following these industry best practices, the use of open source software would bring massive innovation to services and applications by establishing an agile response to the ever-evolving digital needs of customers in a rapid, consistent way.

We believe that a robust open source strategy can support our purpose of helping Britain prosper.


Our ambitions for open source software

We believe that a robust open source strategy can support our purpose of Helping Britain Prosper, and that by proactively engaging with developer communities we can encourage inclusivity. “Be open and use open source” is the motto of the UK’s government digital services internal guidance on open source software. It is good practice to publish your code, and to use open source to improve transparency, flexibility and accountability.

We are establishing a constructive relationship between all of our business units that are interested in open source by leveraging it strategically and engaging with internal stakeholders, as well as with the senior management team. We are creating an effective open source strategy which is driven by the bank’s objectives, and which ties together our goals of consuming, contributing and community together.

In addition, we are promoting the practice of publishing some of our internal code as open source. The Mission is actively raising awareness about open source and driving cultural transformation across the Group, by highlighting the benefits that can be achieved through strategically planned open source activities. This is being achieved through numerous measures, from recording video sessions, publishing articles and hosting group activities across the business areas.

We believe that with a collaborative software development process in the bank, by leveraging the software and actively publishing them, we can help the Group to reduce its costs considerably and reduce development time. Furthermore, we‘ll be able to improve the overall quality, including security, by increasing transparency and active peer review.

We are conscious of challenges and risks in this process. But we have the right policy and processes to respond to such concerns, supporting broad participation, discovery and active development of open source software across the organisation.

As we launch the next steps of the Open Source Mission, we’re confident in the delivery of the Mission’s goals and objectives. We’re looking forward to an engaging experience with the Group’s developers to help them achieve their objectives, and ultimately, the Group’s objectives too.

 

About the author Silviu Mihaila

Engineering Lead, Software Engineering Centre of Excellence, Lloyds Banking Group

With an experience of almost 20 years in the technology space, Silviu has joined Lloyds Banking Group in January 2020 and has taken the lead of the Open Source Mission. In his new position Silviu had a crucial contribution at Lloyds in raising awareness and spreading knowledge about open source software risks and opportunities to engineers and non-engineers alike.

 

Silviu's background Read less
About the author Gilles Gravier

Director, Open Source Consulting Practice, Wipro

Gilles, based in Switzerland, provides open source and blockchain strategy consulting and advisory services to Wipro's key customers worldwide. Throughout his career, Gilles has been involved in both security and open source.

 

Gilles's background Read less
About the author Reza Alavi

Managing Consultant Risk, Compliance, Assurance (RCA), UK/I/CE, Wipro

Reza, with over 15 years of experience in leading technology risk, digital transformation and security executive projects, works with Wipro’s clients to analyse, develop and deliver solutions for complex risk and security challenges in digital transformation projects.

 

Reza's background Read less

Related content

Building the bank of the future

Through our digital transformation, we’re delivering new products and services that will help our customers and businesses for years to come.

Find out more

Join our Tech and Transformation team

Whether you're an analytical thinker or someone with an eye for design, you could be a great fit for one of our Technology roles.

Find out more