In the 1980s, Italian drinks brand Martini promoted itself with the slogan: “Any time, any place, anywhere.” Banking giant UBS is channeling a similar spirit for its remote working setup.

The system, dubbed A3—“anytime, anywhere, and any device”—has been put to the test during the Covid-19 lockdowns that have confined banking employees throughout the world to their homes since March.

A3 is a virtual desktop infrastructure, or VDI. It aims to give remote users the same access and functionality they would have if they were in the office—a home away from home, so to speak. Mike Dargan, head of group technology at UBS, believes that in this regard, it has succeeded.

“This morning I went into the office, and now I am back home, and it feels no different,” he says.

Running a remote office environment for a large financial institution brings risks, though. Home working increases what experts call the “attack surface” for cyber criminals to exploit. The effect is magnified when such a high proportion of staff are exiled from the office and scattered among thousands of locations across the globe. The confusion of the pandemic is also fertile ground for phishing attacks and attempted hacks.

Luckily for UBS, the bank had already begun to introduce A3 in 2016, which meant the system was already embedded and tested before the pandemic struck.

With VDI, individual apps are hosted in the cloud or in a central server, rather than loaded on laptops or workstations. It’s a more elaborate setup than a virtual private network (VPN), where users tunnel into a corporate network from outside.

A3 users log in to a remote desktop via a home device such as an iPad or laptop, running an ordinary browser like Chrome. The interface is customized for each individual: Employees working in operations, for example, see a different screen from traders.

To deliver its virtual desktop, the system requires an extra layer of technology. A3 runs Microsoft’s Remote Desktop Services across a server provided by Citrix, one of the largest VDI providers.

Critics of VDI say the setup requires a hefty initial outlay on new hardware and servers. UBS spends 10% of its revenues on IT every year, in line with the level of investment by other large banking groups such as JP Morgan and Bank of America. But Dargan argues the system saves the bank money in the long run.

How? Since many corporate VPNs are typically built to support 20% to 30% of staff working remotely at any given time, some firms have had to allow access to their VPN on a rotational basis to avoid overwhelming the system during the pandemic.

UBS’s A3 system is not limited in this way. At the height of the lockdown, the bank had 95% of its 90,000 staff working remotely across more than 50 countries. Even now, at peak working hours, some 60,000 staff are logged in simultaneously to the A3 environment. High staff productivity goes some way to ensuring the bank sees a return on its IT investment.

The bank also claims to save money by being able to patch the system remotely. If UBS were operating in a hard laptop environment, with users tunneling into the corporate network via VPN, Dargan’s team would have to fix each device separately. Now, it can just patch the database.

“We have a golden image, if you like, that exists in the datacenter. We just patch that, and everything is sorted [out],” Dargan says.

Going Mobile

The transition to A3 took place at the same time that UBS moved into its new offices in the City of London in 2016, and started doing away with fixed seating and workstations. The bank introduced thin clients—computers that run from a central server instead of a local hard drive—and equipped mobile staff with laptops. At the time, few rival banks had made this shift, with Citigroup’s Manhattan office a notable exception.

For firms that don’t use VDI or a similar kind of virtual solution, the pandemic has forced them to figure out how to very swiftly ship—or fly—laptops to staff. HSBC, for example, has told WatersTechnology that it’s considering providing virtual desktop capabilities to staff.

Early in the lockdown, financial firms along the Street scrambled to get their traders outfitted in such a way that they could work from home effectively, as volatility triggered a spike in trading volumes. UBS itself saw 300% more activity than normal in March, Dargan says. For many firms, it wasn’t always easy.

With A3, traders get special treatment. Their VDIs are hosted on a super-server called A3 Dedicated. “This is a dedicated blade or server in the datacenter with higher processing power,” Dargan says.

In addition, home-working traders have two 34-inch screens and a thin client. To complete the array, UBS provides a “network wrap device.” Dargan says this is “a remote access protocol and a voice turret that interfaces into the system through the datacenter. So it’s effectively what you would see on the trading floor: the turret, the screens, and so on.”

Dargan says UBS is researching a virtual product offering with multiple screens for traders, but that is “still in the lab.”

In another nod to user-friendliness, Skype and Microsoft Teams are fully integrated into the VDI setup. UBS says bank staff make around 3 million Skype calls per week, and the bank continually tracks the quality of calls. If a user is experiencing echo, the system spots it and alerts the user to mute themselves or to change device. UBS engineers are also trying to improve the quality of video calls by synchronizing audio transmission with the image, if they’re mismatched.

In development are tools that will help diagnose issues with hardware or the user’s home Wi-Fi, Dargan says.

Eagle Eye

With great virtualization comes great responsibility. A system like A3 needs constant monitoring and, here, UBS has a 24/7, follow-the-sun approach. The bank has tech operations centers in three cities—Nashville, Tenn.; Zurich; and Pune, India—that perform resilience monitoring and handle ongoing problems.

While some IT workers have to be on-site, most of the monitoring and maintenance is done remotely. “If you have people working on the hardware, for example the mainframe, they need to be on-site. But it’s a small number of people who need to be in the office, as we have virtualized our support functions,” Dargan says.

Hand in hand with a rise in home working comes an increase in the range of cyber risks that the bank is exposed to. In response, UBS has stepped up its monitoring of incoming emails, scanning for potential phishing attacks. Analysts report that phishing attempts are growing as scammers look to exploit the panic and uncertainty around the pandemic, although UBS has not noticed a significant increase in such attacks.

Phishing can range from marketing emails offering half-off on new office chairs, targeted at employees with sore backs who found themselves suddenly working at the kitchen table, through to messages purporting to contain new information about the coronavirus from seemingly reputable health authorities.

“We measured that in two ways. Firstly, we looked at emails or messages that were specifically related to Covid-19 and to working from home,” Dargan says.

Dargan is wary of giving too much detail on the second element of monitoring for confidentiality reasons, but says the bank uses a layered security approach to detect and block attacks in conjunction with monitoring the underlying IP address of emails that come in.

“We look almost in real time at the origin of the email and the IP addresses related to it, and the subdomain of that IP address. So you can see a partial history of where the email comes from. That needs to be done in real time because we get tons of emails coming through,” he says.

In common with many other firms, UBS runs exercises throughout the year to create awareness among employees of cyber security. This includes sending fake emails to staff to check responses.

As firms emerge, blinking into the light, after the months-long lockdown, Dargan predicts workers will want to stay home more than they used to. “Even if I look at it through my own lens, if I have only virtual meetings, that benefit of being in the office is small. I think there is a subset of the workforce that may want to continue to work from home partially or for good; we haven’t yet got a defined view on this,” he says.