What Every Financial Institution Should Look for from Its Cloud Vendors

What Every Financial Institution Should Look for from Its Cloud Vendors

Dan Dosen,

General Manager Cloud Services at iManage

As General Manager, Dan is responsible for the commercial aspects of the iManage cloud including customer onboarding, security-compliance and cloud roadmap. Most recently he was VP Business Development at Microsystems and VP Product Management at SpringCM.

Views 828

What Every Financial Institution Should Look for from Its Cloud Vendors

23.04.2019 08:30 am

The cloud model is gathering pace as the preferred environment for software deployments among financial services enterprises of all stripes, from fund managers and asset managers, to insurance brokerages and commercial banking institutions.

This is all well and good, because the cloud offers significant benefits to these institutions, ranging from increased agility and reduced capital expenditure, to greater performance and availability for their mission-critical applications.

In many cases, the cloud also offers the potential for greater security because a cloud vendor can devote far more time, staff, and resources towards creating a secure environment than a financial services company could. Building and maintaining the infrastructure for an on-premises deployment and keeping it secure from a barrage of threats is a 24/7 job, and many finance institutions are more than happy to let a cloud vendor shoulder that burden.

Here’s the thing, though: not all clouds are created equal when it comes to security.

In an era when cyber criminals and other bad actors are exploiting every technology loophole and potential human vulnerability to breach enterprise networks, financial institutions can’t afford to take chances on a cloud software provider that hasn’t shored up its own defences.

What Makes A Trustworthy Cloud?

There is a checklist that any financial institution should run through when evaluating cloud providers. Sitting at the top of the list is the question of whether or not that cloud provider is following a Zero Trust model.

Traditional enterprises, including legacy cloud vendors, have a security model that presumes a great deal of trust of internal networks, administrators, users and other resources in the environment. These resources may get automatic privileged access making the enterprise more vulnerable to sophisticated attacks.

Assuming that people within the network are automatically trustworthy doesn’t always work out so well – just ask SunTrust Financial Services, which experienced a breach that potentially impacted the data of 1.5 million customers in April 2018.

The way to avoid these types of breaches is through a Zero Trust model which assumes that no resources – either internal or external – can be implicitly trusted, greatly minimising the potential for data leaks.

It’s important to note that the Zero Trust approach needs to permeate every aspect of a cloud offering – from the datacenters, through infrastructure and process design, down to the system and application levels. When it comes to safeguarding sensitive financial data, it’s not enough for Zero Trust to exist in one area of a vendor’s cloud, but not others.

Customer Managed Encryption Keys (CMEK) are another essential component that financial services organisations should look for in any cloud offering. The CMEK is an encryption key that the customer generates and manages with a third-party service provider. The cloud provider never receives or stores a copy of this key.

Why is this important? Because it ensures that encrypted information can’t be decrypted unless the customer himself hands over the key and “unlocks” the data. This gives customers confidence that their private financial details will remain private – not just in the event of a breach, but in the event that a cloud provider is compelled to hand over data by an investigatory body or governmental agency.

Keeping data secure in today’s financial landscape also means keeping it properly domiciled. Woe to the financial services organization who runs afoul of the European Union’s General Data Protection Regulation (GDPR) or other recent regulations that require customer data to stay within a specific geographic boundary.

A cloud offering with geo-isolation capabilities solves this problem, ensuring that all services performed on customer data – encryption, optical character recognition (OCR), document preview, and so on – are performed solely in one specific geographic location.

For any finance company that’s using the cloud to manage their most important documents and emails – including policies and proposals, contracts, client communications, compliance documentation, and other essential paperwork – this capability isn’t a “nice to have” – it’s a “need to have.”

Choose Wisely

When it comes to security, the cloud service must be a key component of a financial institution’s overall security strategy. Picking a vendor who isn’t properly equipped to deal with today’s security demands can have catastrophic consequences.

Does the vendor follow a Zero Trust model? Do they offer CMEK? Do they have geo-isolation capabilities?

By seeking out cloud vendors with these qualities, financial institutions can give themselves – and the customers they serve – the confidence of knowing they’re taking an uncompromising approach to security in all aspects of their environment.

Latest blogs

Martijn Bos Holland FinTech

Get your head up in the clouds, it’s good for business

How Digital Transformation is reshaping competition in financial services The message is clear and it’s coming at us from all sides: digitalize now. No business unit seems to be immune to the onslaught of cloud-based, AI-driven, real-time, Read more »

Sonny Aulakh Pure Storage

How to support remote working without compromising productivity

As the need to work remotely continues to impact the daily lives of people and businesses around the globe, it places unexpected demand on IT departments. How do you transition supporting 30% of your workforce to work remotely to 100% in a matter of Read more »

Martijn Bos Holland FinTech

Making it through the rain: Finance in times of turmoil

You’d need to be living on a remote island, without electricity or internet to not be aware of what the world is going through right now – a medical crisis that has spread across the world and disrupted supply chains, goods and services production, Read more »

James Devoy Sysnet Global Solutions

PCI DSS and Remote Assessments

COVID-19 is obviously changing many aspects of daily life. Some will be short term measures to see us all through these times, although I wonder how many will become more permanent fixtures in our lives. The PCI SSC has provided guidance to allow Read more »

James Booth PPRO

Brave New World: A Futuristic Vision of Payments

Over the last ten years, the retail e-commerce ecosystem has undergone a wide-ranging transformation. As recently as 2010, the e-commerce and payments value chain were relatively straightforward: Any eCommerce merchant could integrate a payment Read more »

Magazine
ALL
Free Newsletter Sign-up
+44 (0) 208 819 32 53 +44 (0) 173 261 71 47
Download Our Mobile App
Financial It Youtube channel