• Dan Dosen,, General Manager Cloud Services at iManage


• 23.04.2019 08:30 am
Cloud , Financial institution , As General Manager, Dan is responsible for the commercial aspects of the iManage cloud including customer onboarding, security-compliance and cloud roadmap. Most recently he was VP Business Development at Microsystems and VP Product Management at SpringCM.

The cloud model is gathering pace as the preferred environment for software deployments among financial services enterprises of all stripes, from fund managers and asset managers, to insurance brokerages and commercial banking institutions.

This is all well and good, because the cloud offers significant benefits to these institutions, ranging from increased agility and reduced capital expenditure, to greater performance and availability for their mission-critical applications.

In many cases, the cloud also offers the potential for greater security because a cloud vendor can devote far more time, staff, and resources towards creating a secure environment than a financial services company could. Building and maintaining the infrastructure for an on-premises deployment and keeping it secure from a barrage of threats is a 24/7 job, and many finance institutions are more than happy to let a cloud vendor shoulder that burden.

Here’s the thing, though: not all clouds are created equal when it comes to security.

In an era when cyber criminals and other bad actors are exploiting every technology loophole and potential human vulnerability to breach enterprise networks, financial institutions can’t afford to take chances on a cloud software provider that hasn’t shored up its own defences.

What Makes A Trustworthy Cloud?

There is a checklist that any financial institution should run through when evaluating cloud providers. Sitting at the top of the list is the question of whether or not that cloud provider is following a Zero Trust model.

Traditional enterprises, including legacy cloud vendors, have a security model that presumes a great deal of trust of internal networks, administrators, users and other resources in the environment. These resources may get automatic privileged access making the enterprise more vulnerable to sophisticated attacks.

Assuming that people within the network are automatically trustworthy doesn’t always work out so well – just ask SunTrust Financial Services, which experienced a breach that potentially impacted the data of 1.5 million customers in April 2018.

The way to avoid these types of breaches is through a Zero Trust model which assumes that no resources – either internal or external – can be implicitly trusted, greatly minimising the potential for data leaks.

It’s important to note that the Zero Trust approach needs to permeate every aspect of a cloud offering – from the datacenters, through infrastructure and process design, down to the system and application levels. When it comes to safeguarding sensitive financial data, it’s not enough for Zero Trust to exist in one area of a vendor’s cloud, but not others.

Customer Managed Encryption Keys (CMEK) are another essential component that financial services organisations should look for in any cloud offering. The CMEK is an encryption key that the customer generates and manages with a third-party service provider. The cloud provider never receives or stores a copy of this key.

Why is this important? Because it ensures that encrypted information can’t be decrypted unless the customer himself hands over the key and “unlocks” the data. This gives customers confidence that their private financial details will remain private – not just in the event of a breach, but in the event that a cloud provider is compelled to hand over data by an investigatory body or governmental agency.

Keeping data secure in today’s financial landscape also means keeping it properly domiciled. Woe to the financial services organization who runs afoul of the European Union’s General Data Protection Regulation (GDPR) or other recent regulations that require customer data to stay within a specific geographic boundary.

A cloud offering with geo-isolation capabilities solves this problem, ensuring that all services performed on customer data – encryption, optical character recognition (OCR), document preview, and so on – are performed solely in one specific geographic location.

For any finance company that’s using the cloud to manage their most important documents and emails – including policies and proposals, contracts, client communications, compliance documentation, and other essential paperwork – this capability isn’t a “nice to have” – it’s a “need to have.”

Choose Wisely

When it comes to security, the cloud service must be a key component of a financial institution’s overall security strategy. Picking a vendor who isn’t properly equipped to deal with today’s security demands can have catastrophic consequences.

Does the vendor follow a Zero Trust model? Do they offer CMEK? Do they have geo-isolation capabilities?

By seeking out cloud vendors with these qualities, financial institutions can give themselves – and the customers they serve – the confidence of knowing they’re taking an uncompromising approach to security in all aspects of their environment.