LMAX Exchange Security Standards

In the last week, a high profile bug known as “Heartbleed” was revealed in the OpenSSL software widely used to encrypt secure web sessions. A fix for it was available pretty quickly, but the main cause for concern was the risk that the secret keys that underpin the SSL certificate system may have been stolen from affected sites. Rather than try and explain what heartbleed was/is I’ll point you at the clearest explanation I’ve come across here.

The LMAX Exchange trading platform was not affected by the Heartbleed bug, but along with other recent high profile attacks and vulnerabilities (for example the Apple SSL bug) it’s been a good time to take a look at LMAX Exchange’s security standards, and some ways we are continuously improving security behind the scenes.

Heartbleed was a good test of our ability to respond. Within hours of the announcement hitting the wires we were auditing our entire range of SSL-encrypted external systems. Although none of our exchange and trading systems were affected we did uncover an issue with an internal corporate mail system, which required a slightly home made patch, as we were not prepared to wait for the vendor to provide one.

So, a quick recap of recent security related changes to the platform.