What Every Financial Institution Should Look for from Its Cloud Vendors

What Every Financial Institution Should Look for from Its Cloud Vendors

Dan Dosen,

General Manager Cloud Services at iManage

As General Manager, Dan is responsible for the commercial aspects of the iManage cloud including customer onboarding, security-compliance and cloud roadmap. Most recently he was VP Business Development at Microsystems and VP Product Management at SpringCM.

Views 441

What Every Financial Institution Should Look for from Its Cloud Vendors

23.04.2019 08:30 am

The cloud model is gathering pace as the preferred environment for software deployments among financial services enterprises of all stripes, from fund managers and asset managers, to insurance brokerages and commercial banking institutions.

This is all well and good, because the cloud offers significant benefits to these institutions, ranging from increased agility and reduced capital expenditure, to greater performance and availability for their mission-critical applications.

In many cases, the cloud also offers the potential for greater security because a cloud vendor can devote far more time, staff, and resources towards creating a secure environment than a financial services company could. Building and maintaining the infrastructure for an on-premises deployment and keeping it secure from a barrage of threats is a 24/7 job, and many finance institutions are more than happy to let a cloud vendor shoulder that burden.

Here’s the thing, though: not all clouds are created equal when it comes to security.

In an era when cyber criminals and other bad actors are exploiting every technology loophole and potential human vulnerability to breach enterprise networks, financial institutions can’t afford to take chances on a cloud software provider that hasn’t shored up its own defences.

What Makes A Trustworthy Cloud?

There is a checklist that any financial institution should run through when evaluating cloud providers. Sitting at the top of the list is the question of whether or not that cloud provider is following a Zero Trust model.

Traditional enterprises, including legacy cloud vendors, have a security model that presumes a great deal of trust of internal networks, administrators, users and other resources in the environment. These resources may get automatic privileged access making the enterprise more vulnerable to sophisticated attacks.

Assuming that people within the network are automatically trustworthy doesn’t always work out so well – just ask SunTrust Financial Services, which experienced a breach that potentially impacted the data of 1.5 million customers in April 2018.

The way to avoid these types of breaches is through a Zero Trust model which assumes that no resources – either internal or external – can be implicitly trusted, greatly minimising the potential for data leaks.

It’s important to note that the Zero Trust approach needs to permeate every aspect of a cloud offering – from the datacenters, through infrastructure and process design, down to the system and application levels. When it comes to safeguarding sensitive financial data, it’s not enough for Zero Trust to exist in one area of a vendor’s cloud, but not others.

Customer Managed Encryption Keys (CMEK) are another essential component that financial services organisations should look for in any cloud offering. The CMEK is an encryption key that the customer generates and manages with a third-party service provider. The cloud provider never receives or stores a copy of this key.

Why is this important? Because it ensures that encrypted information can’t be decrypted unless the customer himself hands over the key and “unlocks” the data. This gives customers confidence that their private financial details will remain private – not just in the event of a breach, but in the event that a cloud provider is compelled to hand over data by an investigatory body or governmental agency.

Keeping data secure in today’s financial landscape also means keeping it properly domiciled. Woe to the financial services organization who runs afoul of the European Union’s General Data Protection Regulation (GDPR) or other recent regulations that require customer data to stay within a specific geographic boundary.

A cloud offering with geo-isolation capabilities solves this problem, ensuring that all services performed on customer data – encryption, optical character recognition (OCR), document preview, and so on – are performed solely in one specific geographic location.

For any finance company that’s using the cloud to manage their most important documents and emails – including policies and proposals, contracts, client communications, compliance documentation, and other essential paperwork – this capability isn’t a “nice to have” – it’s a “need to have.”

Choose Wisely

When it comes to security, the cloud service must be a key component of a financial institution’s overall security strategy. Picking a vendor who isn’t properly equipped to deal with today’s security demands can have catastrophic consequences.

Does the vendor follow a Zero Trust model? Do they offer CMEK? Do they have geo-isolation capabilities?

By seeking out cloud vendors with these qualities, financial institutions can give themselves – and the customers they serve – the confidence of knowing they’re taking an uncompromising approach to security in all aspects of their environment.

Latest blogs

Andrew Stevens Quadient

Comment on Competition and Markets Authority’s latest customer satisfaction in banking survey

“When the CMA launched this report six months ago, it seemed a natural fit when most customers rated a bank without any branches, First Direct, as the one they would recommend to their friend for online and mobile banking services. Barclays has now Read more »

Mark Smith Ayming

Big data is AI’s big brother

Big data is AI’s big brother. While AI is driven by machine learning, big datasets fuel the intelligence engine. Banks and insurance companies have access to huge volumes of data and are looking to harness this information to drive efficiencies in Read more »

Alan Stewart-Brown Opengear

“When ATMs Go Down” – How Banks Can Achieve Network Resilience

It is a common source of annoyance for anybody in rural communities; towns and cities around the world. You visit your local bank branch’s ATM to withdraw cash or to print out a mini statement and you are met with a message informing you that the Read more »

Todd Latham Currencycloud

Comment on BoE financial report by, Todd Latham, the CMO of Currencycloud

The recent Future of Finance report has outlined a new age of banking, stating how financial services can help bring about a multitude of changes. This new age is also designed to help bring the UK in line with the changing nature of the digital Read more »

Peter Hecht DXC Technology

How Can Insurers Attract and Retain Talent Through Digital Transformation?

Within the insurance industry, digital transformation is boosting productivity – improving the customer experience, creating efficiencies throughout organisations, and enabling actionable insights using analytics and big data. Yet so far, the focus Read more »

Magazine
ALL
Free Newsletter Sign-up
+44 (0) 208 819 32 53 +44 (0) 173 261 71 47
Download Our Mobile App
Financial It Youtube channel