Legacy System Modernization: Empowering Multi-Tenant SaaS Architecture Development at Alessa
How Scorpion Five Technologies (S5T) helped modernize Alessa’s cloud distributed systems engineering approaches to increase profitability, technical capabilities, and drive customer value to new heights
Quick Stats
-
1
Comprehensive Analysis of Infrastructure as Code approach to harden systems an increase cloud infrastructure automation capabilities -
2
New security technologies to facilitate multitenant isolation and security: implicit deny service meshes, Kubernetes Pod admission policy enforcement -
1
Extensible mono repo capable of supporting localized development of several dependent microservices that closely simulates the target architecture to spot security violations in dev -
100%
Empowerment of senior developers to architect and develop efficient, powerful, and secure multitenant containerized systems orchestrated by Kubernetes
We recently engaged Scorpion Five Technologies to support our team at Alessa on our journey to modernize our cloud operations and elevate our cloud‐engineering practices, and the experience has been outstanding.
From the outset, S5T brought exactly the kind of expertise and insight you hope for when embarking on a multi-phase cloud transformation. For organizations on a similar path, looking to modernize their cloud infrastructure, strengthen cloud ops, and build internal, I would recommend Scorpion Five Technologies. Their balanced combination of technical depth, business acumen, and enablement mindset makes them a strong partner for this kind of journey.
Modernizing cloud operations is never trivial, especially in an organization with a mix of legacy, advanced, regulatory demands, and growth ambitions. S5T provided the right mix of guidance, hands-on delivery, and internal team enablement that made this effort successful.
Holly Sais Phillippi
CEO, Alessa
The Challenge
Alessa’s advanced Anti-Money Laundering (AML) Compliance software empowers its customers with a comprehensive 360-degree view of client risk, covering everything from identity verification, to watchlist, sanction, and transaction monitoring.
Alessa SaaS services provide AML compliance support to a wide range of industries, including banks, casinos, FinTech firms, insurance companies, crypto, and much more.
Like most modern SaaS providers, Alessa must fight several tech battles at once. Cloud infrastructure has brought just as much cost increase as it has capability enhancements and cyber threats grow more intense with every passing day. What’s more, the needs of Alessa’s clients for advanced AML compliance capabilities have also increased dramatically, as money laundering schemes have exponentially advanced in technological sophistication.
⚠️ Key Obstacles
Despite the power and sophistication of Alessa products’ internal business logic, the architecture that supports that logic was built during a pre-cloud era and then later adapted to the cloud. In that era of development, monolithic architectures were the norm, as the benefits of shared resources provided by containerization and microservices architectures did not yet outweigh the costs of developing them for at least most systems and applications.
Furthermore, it is exceptionally difficult at an organizational level to support rearchitecting a system that customers are not only using, but who are employing the capabilities at a large scale. The senior developers and systems admins that deeply understand the product simply have their hands full. The moment you try to divert your attention to architecting the next generation system, the legacy system pulls your attention right back.
Alessa needed a way to architect a new multitenant system that could share resources, while still providing exceptional service to existing customers and keeping up with their growing AML demands.
Our Solution
Driven by a commitment to innovation and future-ready technology for their clients, Alessa engineers had already made valiant efforts to modernize their systems and work towards multitenancy. Despite the difficulty of doing so, progress was being made. Alessa engineers are hardy and tenacious, but they needed more hands. That’s where S5T comes in.
What We Delivered
- ☁️
Cloud Engineering
Using our experience engineering hyper-secure cloud systems deployed using automated provisioning and configuration management techniques, like Infrastructure as Code (IaC) and Configuration as Code (CaC), S5T provided Alessa with:
- A comprehensive cybersecurity review of their existing IaC code
- A roadmap to increasing the cybersecurity posture of their existing code, complete with exact technical steps to take
- System modeling for an improved "version 2" of their automated cloud infrastructure that increases stability and security, decreases complexity, and decreases hosting costs
- A greater understanding of how to achieve multitenant, multi-cluster, containerized architecture with a global footprint using fully open-source Kubernetes container orchestration technologies
- 💾
Legacy System Modernization
Alessa's business logic is robust and well developed, and only suffers from being monolithic in nature. Therefore the consult we provided was:
- Focus on a refactor approach over a rewrite
- Modularize the code under the auspices of SOLID software principals to better-prepare for containerization
- Design interfaces for the modularized capabilities such that consumers of a module enjoy abstraction from the inner workings of a given module, better-preparing individual capabilities to function as microservices
- Dispense with the notion that replacing an existing piece of aged architecture with a slightly newer version of the same thing constitutes a modernization—e.g., simply migrating an application from using an old on-premise database engine to a newer engine available in the cloud is not cloud modernization, it's procrastination
- ⚓
Microservice Development
Alessa engineers were certainly not ignorant of microservice development, and had already managed to develop a few key services for their new architecture. S5T simply empowered them further by creating a model system in a mono repo for their inspection in a fully-local environment that demonstrated how to:
- Establish a universal, programming language agnostic, data contract between services using Protobuf and gRPC
- Deploy stateless applications using high availability (HA) paradigms to support robustness, service availability, and rolling updates that avoid service interruption
- Perform asynchronous, multistep calculations that employ design patterns such as the Operator Pattern, the Sidecar Pattern, and the Workflow of Workflow pattern
- 🔐
Multitenant Cybersecurity Hardening
The most important aspect of the work S5T has done to empower Alessa engineers is that of multitenant hardening.
Although the resource sharing provided by containerization and Kubernetes-based container orchestration dramatically reduces cloud hosting costs compared to monolithic architectures, you must reproduce the complete separation of data and network traffic between clients' systems that monolithic architectures naturally provide. To endow Alessa with this capability, S5T taught their engineers how to:
- Create implicit-deny service meshes inside their Kubernetes systems to isolate traffic at the tenant level
- Use the proxy sidecar pattern to perform advanced traffic filtering at the individual microservice level
- Activate and enforce Pod Admission Policies that reject workloads whose security does not meet minimum baselines
- Harden container images at build time to limit the attack vector
- Run individual services with the least-required privilege at both the container and kernel access levels
- Create and manage Kubernetes Role Based Access Control (RBAC) configurations to further enforce the principal of least privilege at the service level
Results and Impact
We can sum up the impact S5T had on Alessa with a single word: empowerment. Alessa did not need S5T to teach them how to engineer advanced software—they have been doing that for years! What they needed was a clear roadmap to maximizing the power of their software using modern, containerized multitenant architecture in the cloud in a way that is cost effective.
- 🚀
Enhanced Cloud Engineering Practices
Significantly enhanced cloud engineering capabilities to not only solve the modernization problems of today, but to engineer cloud capabilities for Alessa's future AML capabilities.
- 🤝
Expert Guidance for Legacy System Modernization
Experience-based insights that allow existing capabilities to modernized, made extensible, and continue to provide value.
- ⚓
Sophisticated Microservice Capabilities
Understanding of how to best-leverage the benefits of containerization modularity in distributed cloud architectures.
- 🛡️
Secure Multitenancy
Advanced capabilities that allow for the costs savings provided by containerization and compute resource sharing, while also providing strict tenant isolation.
Ready for Your Own Digital Transformation?
What Clients Say About S5T
View More Cases Studies
-
Digital Transformation in Healthcare: Prime MD’s Journey Toward a Sophisticated Digital Enterprise
How Scorpion Five Technologies (S5T) helped a premium med spa escape vendor lock-in, modernize their digital marketing strategies, create operational efficiencies, and begin building a HIPAA-compliant digital enterprise