Sherlock Holmes and his art of deductive reasoning can be described as taking straightforward practical principles resulting from observation, and drawing logical conclusions. The Holmes quote “Elementary, my dear Watson” is commonly used to refer to this quality of intellectual connection. Many financial firms and their CIOs apply this art as they weigh the options and risks when contracting for cloud services. Taking current best security practices and applying them to cloud provisioning is good business thinking.
When making decisions on cloud computing solutions, security can easily be dwarfed by over-riding pressures of moving new services to market. CIOs are well informed on the flexibility and ease of use of cloud computing. They are also knowledgeable about the growing popularity and demand for media banking services.
Elastic Computing
A recent report from Accenture talks about the trends of cloud computing and social networking reshaping banks. Banks in mature markets “can use cloud computing to enter and scale up in emerging markets more quickly and at lower cost and risk. And banks in emerging markets will use cloud computing to reach their unbanked populations by leapfrogging physical branch networks and moving straight to electronic and mobile banking. Already, a new generation of cloud-based online personal financial management applications—mint.com, Geezeo and BankSimple to name a few —are gaining traction among customers.”
Speed versus Security
As this evolution takes place, what should be of concern is that in a recent Ponemon survey of US cloud service providers, a majority said they focused on cost and speed of deployment instead of security. Secondly most of the cloud providers indicated their systems and applications are not always evaluated for security threats prior to deployment to customers. These measurements should lead financials firms to wonder if safe guards are being adequately implemented.
In light of the fast technology evolution along with the known security provisioning risks, it becomes imperative to verify security in cloud technology. Also, as Sherlock might deduce, when looking at cloud providers it is logical to take learned security practices and apply them to new services.
Top questions to consider when evaluating a cloud provider
The following are suggested common best practice questions to consider when evaluating a cloud provider:
- Is the cloud governance based on industry standards such as ISO 27000 (or FFIEC)?
- What is the risk and compliance management program?
- What are the physical and logical access controls, and the health checking processes?
- What is the problem and incident management process?
- How is protecting the company high value / sensitive data implemented? Encryption?
- How is threat and vulnerability identification implemented?
- Is the hypervisor certified?
- What is your personnel security policy?
Selecting cloud solutions and services can be quite elementary when following the art of deduction.
Security Strategist and Financial Sector Lead at IBM