What Every Financial Institution Should Look for from Its Cloud Vendors

What Every Financial Institution Should Look for from Its Cloud Vendors

Dan Dosen,

General Manager Cloud Services at iManage

As General Manager, Dan is responsible for the commercial aspects of the iManage cloud including customer onboarding, security-compliance and cloud roadmap. Most recently he was VP Business Development at Microsystems and VP Product Management at SpringCM.

Views 990

What Every Financial Institution Should Look for from Its Cloud Vendors

23.04.2019 08:30 am

The cloud model is gathering pace as the preferred environment for software deployments among financial services enterprises of all stripes, from fund managers and asset managers, to insurance brokerages and commercial banking institutions.

This is all well and good, because the cloud offers significant benefits to these institutions, ranging from increased agility and reduced capital expenditure, to greater performance and availability for their mission-critical applications.

In many cases, the cloud also offers the potential for greater security because a cloud vendor can devote far more time, staff, and resources towards creating a secure environment than a financial services company could. Building and maintaining the infrastructure for an on-premises deployment and keeping it secure from a barrage of threats is a 24/7 job, and many finance institutions are more than happy to let a cloud vendor shoulder that burden.

Here’s the thing, though: not all clouds are created equal when it comes to security.

In an era when cyber criminals and other bad actors are exploiting every technology loophole and potential human vulnerability to breach enterprise networks, financial institutions can’t afford to take chances on a cloud software provider that hasn’t shored up its own defences.

What Makes A Trustworthy Cloud?

There is a checklist that any financial institution should run through when evaluating cloud providers. Sitting at the top of the list is the question of whether or not that cloud provider is following a Zero Trust model.

Traditional enterprises, including legacy cloud vendors, have a security model that presumes a great deal of trust of internal networks, administrators, users and other resources in the environment. These resources may get automatic privileged access making the enterprise more vulnerable to sophisticated attacks.

Assuming that people within the network are automatically trustworthy doesn’t always work out so well – just ask SunTrust Financial Services, which experienced a breach that potentially impacted the data of 1.5 million customers in April 2018.

The way to avoid these types of breaches is through a Zero Trust model which assumes that no resources – either internal or external – can be implicitly trusted, greatly minimising the potential for data leaks.

It’s important to note that the Zero Trust approach needs to permeate every aspect of a cloud offering – from the datacenters, through infrastructure and process design, down to the system and application levels. When it comes to safeguarding sensitive financial data, it’s not enough for Zero Trust to exist in one area of a vendor’s cloud, but not others.

Customer Managed Encryption Keys (CMEK) are another essential component that financial services organisations should look for in any cloud offering. The CMEK is an encryption key that the customer generates and manages with a third-party service provider. The cloud provider never receives or stores a copy of this key.

Why is this important? Because it ensures that encrypted information can’t be decrypted unless the customer himself hands over the key and “unlocks” the data. This gives customers confidence that their private financial details will remain private – not just in the event of a breach, but in the event that a cloud provider is compelled to hand over data by an investigatory body or governmental agency.

Keeping data secure in today’s financial landscape also means keeping it properly domiciled. Woe to the financial services organization who runs afoul of the European Union’s General Data Protection Regulation (GDPR) or other recent regulations that require customer data to stay within a specific geographic boundary.

A cloud offering with geo-isolation capabilities solves this problem, ensuring that all services performed on customer data – encryption, optical character recognition (OCR), document preview, and so on – are performed solely in one specific geographic location.

For any finance company that’s using the cloud to manage their most important documents and emails – including policies and proposals, contracts, client communications, compliance documentation, and other essential paperwork – this capability isn’t a “nice to have” – it’s a “need to have.”

Choose Wisely

When it comes to security, the cloud service must be a key component of a financial institution’s overall security strategy. Picking a vendor who isn’t properly equipped to deal with today’s security demands can have catastrophic consequences.

Does the vendor follow a Zero Trust model? Do they offer CMEK? Do they have geo-isolation capabilities?

By seeking out cloud vendors with these qualities, financial institutions can give themselves – and the customers they serve – the confidence of knowing they’re taking an uncompromising approach to security in all aspects of their environment.

Latest blogs

TYRON JONES n/a

How Technology Has Disrupted the Used Car Buying Experience

We’ve seen many fields change rapidly as a result of the integration of modern technological advancements over the last couple of decades. And it looks like more is coming on the horizon as well, judging by current trends. One of the markets that Read more »

Shuvo G. Roy Mphasis

Reboot 1.0: How financial services technology can enable the supply chain to support a post-lockdown boom

Ground control and Captain Tom When veteran Captain Tom Moore decided to walk one hundred laps of his garden before his 100th birthday to raise funds to support NHS heroes battling Covid-19 from the frontline, he never imagined that he would Read more »

Lisa Gutu Salt Edge

Building a PSD2 compliant channel: challenges and opportunities for financial institutions

PSD2 obliges ASPSPs including banks, e-wallets, prepaid cards and other companies that offer payment accounts to provide at least one channel for secure communication with third party providers (TPP). Even neobanks or e-money institutions, including Read more »

Thomas Pintelon Capilever

Credit origination - A lot of innovation on the horizon

While consumer credits are becoming more automated and user-friendly to request, all other credits are often still very manual and labor intensive to originate. In this (relatively long) blog I will try to give a description of the (potentially Read more »

Kelly Kearsley Hourly.io

Time Card Theft is a Big Problem. Here's How to Stop It.

Trust is at the core of every employer-employee relationship. You trust your people to do their jobs, and they trust you to compensate them for their work. Most of the time, it works. However, there's always the person looking to bend the rules or Read more »

Magazine
ALL
Free Newsletter Sign-up
+44 (0) 208 819 32 53 +44 (0) 173 261 71 47
Download Our Mobile App
Financial It Youtube channel