Sherlock Holmes and his art of deductive reasoning can be described as taking straightforward practical principles resulting from observation, and drawing logical conclusions.  The Holmes quote “Elementary, my dear Watson” is commonly used to refer to this quality of intellectual connection.  Many financial firms and their CIOs apply this art as they weigh the options and risks when contracting for cloud services.  Taking current best security practices and applying them to cloud provisioning is good business thinking.

When making decisions on cloud computing solutions, security can easily be dwarfed by over-riding pressures of moving new services to market.  CIOs are well informed on the flexibility and ease of use of cloud computing.  They are also knowledgeable about the growing popularity and demand for media banking services.

Elastic Computing

A recent report from Accenture talks about the trends of cloud computing and social networking reshaping banks.  Banks in mature markets “can use cloud computing to enter and scale up in emerging markets more quickly and at lower cost and risk. And banks in emerging markets will use cloud computing to reach their unbanked populations by leapfrogging physical branch networks and moving straight to electronic and mobile banking.  Already, a new generation of cloud-based online personal financial management applications—mint.com, Geezeo and BankSimple to name a few —are gaining traction among customers.”

Speed versus Security

As this evolution takes place, what should be of concern is that in a recent Ponemon survey of US cloud service providers, a majority said they focused on cost and speed of deployment instead of security. Secondly most of the cloud providers indicated their systems and applications are not always evaluated for security threats prior to deployment to customers. These measurements should lead financials firms to wonder if safe guards are being adequately implemented.

In light of the fast technology evolution along with the known security provisioning risks, it becomes imperative to verify security in cloud technology.  Also, as Sherlock might deduce, when looking at cloud providers it is logical to take learned security practices and apply them to new services.

 

Top questions to consider when evaluating a cloud provider

The following are suggested common best practice questions to consider when evaluating a cloud provider:

  1. Is the cloud governance based on industry standards such as ISO 27000 (or FFIEC)?
  2. What is the risk and compliance management program?
  3. What are the physical and logical access controls, and the health checking processes?
  4. What is the problem and incident management process?
  5. How is protecting the company high value / sensitive data implemented? Encryption?
  6. How is threat and vulnerability identification implemented?
  7. Is the hypervisor certified?
  8. What is your personnel security policy?

Selecting cloud solutions and services can be quite elementary when following the art of deduction.

 

More from Banking & Finance

Kronos Malware Reemerges with Increased Functionality

The Evolution of Kronos Malware The Kronos malware is believed to have originated from the leaked source code of the Zeus malware, which was sold on the Russian underground in 2011. Kronos continued to evolve and a new variant of Kronos emerged in 2014 and was reportedly sold on the darknet for approximately $7,000. Kronos is typically used to download other malware and has historically been used by threat actors to deliver different types of malware to victims. After remaining…

Why Cybersecurity Risk Assessment Matters in the Banking Industry

When customers put money in a bank, they need to trust it will stay there. Because of the high stakes involved for the customer, such as financial loss, and how long it takes to resolve fraud and potential identity theft, customers are sensitive to the security of the bank as well as fraud prevention measures. Banks that experience high volumes of fraud are likely to lose customers and revenue. The key is to protect customers and their accounts before problems…

Cost of a Data Breach: Banking and Finance

The importance of cybersecurity has touched almost every industry. Beyond that, robust cybersecurity is table stakes for several sectors, particularly health care and the banking and finance industry. Not only is financial data at risk, but so is customer trust. In banking and finance, trust means everything. Yet, consumers are hesitant to share their confidential data. A recent McKinsey survey revealed that no industry achieved a trust rating of 50% for data protection. Here’s the most sobering stat: 87% of…

What Do Financial Institutions Need to Know About the SEC’s Proposed Cybersecurity Rules?

On March 9, the U.S. Securities and Exchange Commission (SEC) announced a new set of proposed rules for cybersecurity risk management, strategy and incident disclosure for public companies. One intent of the rule changes is to provide “consistent, comparable and decision-useful” information to investors. Not yet adopted, these new rules – published in the Federal Register on March 23 – could change reporting requirements. Take a look at some of the big-ticket items and what your organization needs to know.…