Sherlock Holmes and his art of deductive reasoning can be described as taking straightforward practical principles resulting from observation, and drawing logical conclusions.  The Holmes quote “Elementary, my dear Watson” is commonly used to refer to this quality of intellectual connection.  Many financial firms and their CIOs apply this art as they weigh the options and risks when contracting for cloud services.  Taking current best security practices and applying them to cloud provisioning is good business thinking.

When making decisions on cloud computing solutions, security can easily be dwarfed by over-riding pressures of moving new services to market.  CIOs are well informed on the flexibility and ease of use of cloud computing.  They are also knowledgeable about the growing popularity and demand for media banking services.

Elastic Computing

A recent report from Accenture talks about the trends of cloud computing and social networking reshaping banks.  Banks in mature markets “can use cloud computing to enter and scale up in emerging markets more quickly and at lower cost and risk. And banks in emerging markets will use cloud computing to reach their unbanked populations by leapfrogging physical branch networks and moving straight to electronic and mobile banking.  Already, a new generation of cloud-based online personal financial management applications—, Geezeo and BankSimple to name a few —are gaining traction among customers.”

Speed versus Security

As this evolution takes place, what should be of concern is that in a recent Ponemon survey of US cloud service providers, a majority said they focused on cost and speed of deployment instead of security. Secondly most of the cloud providers indicated their systems and applications are not always evaluated for security threats prior to deployment to customers. These measurements should lead financials firms to wonder if safe guards are being adequately implemented.

In light of the fast technology evolution along with the known security provisioning risks, it becomes imperative to verify security in cloud technology.  Also, as Sherlock might deduce, when looking at cloud providers it is logical to take learned security practices and apply them to new services.


Top questions to consider when evaluating a cloud provider

The following are suggested common best practice questions to consider when evaluating a cloud provider:

  1. Is the cloud governance based on industry standards such as ISO 27000 (or FFIEC)?
  2. What is the risk and compliance management program?
  3. What are the physical and logical access controls, and the health checking processes?
  4. What is the problem and incident management process?
  5. How is protecting the company high value / sensitive data implemented? Encryption?
  6. How is threat and vulnerability identification implemented?
  7. Is the hypervisor certified?
  8. What is your personnel security policy?

Selecting cloud solutions and services can be quite elementary when following the art of deduction.


More from Banking & Finance

Cost of a data breach 2023: Financial industry impacts

3 min read - According to the IBM Cost of a Data Breach Report 2023, the global average cost of a data breach in 2023 was $4.45 million, 15% more than in 2020. In response, 51% of organizations plan to increase cybersecurity spending this year. For the financial industry, however, global statistics don’t tell the whole story. Finance firms lose approximately $5.9 million per data breach, 28% higher than the global average. In addition, evolving regulatory concerns play a role in how financial companies…

Gozi strikes again, targeting banks, cryptocurrency and more

3 min read - In the world of cybercrime, malware plays a prominent role. One such malware, Gozi, emerged in 2006 as Gozi CRM, also known as CRM or Papras. Initially offered as a crime-as-a-service (CaaS) platform called 76Service, Gozi quickly gained notoriety for its advanced capabilities. Over time, Gozi underwent a significant transformation and became associated with other malware strains, such as Ursnif (Snifula) and Vawtrak/Neverquest. Now, in a recent campaign, Gozi has set its sights on banks, financial services and cryptocurrency platforms,…

The rise of malicious Chrome extensions targeting Latin America

9 min read - This post was made possible through the research contributions provided by Amir Gendler and Michael  Gal. In its latest research, IBM Security Lab has observed a noticeable increase in campaigns related to malicious Chrome extensions, targeting  Latin America with a focus on financial institutions, booking sites, and instant messaging. This trend is particularly concerning considering Chrome is one of the most widely used web browsers globally, with a market share of over 80% using the Chromium engine. As such, malicious…

BlotchyQuasar: X-Force Hive0129 targeting financial institutions in LATAM with a custom banking trojan

16 min read - In late April through May 2023, IBM Security X-Force found several phishing emails leading to packed executable files delivering malware we have named BlotchyQuasar, likely developed by a group X-Force tracks as Hive0129. BlotchyQuasar is hardcoded to collect credentials from multiple Latin American-based banking applications and websites used within public and private environments. Similar operations conducted in late 2022 have also been noted delivering an earlier variant of this modified QuasarRAT by likely Spanish-speaking actors. BlotchyQuasar, which X-Force describes as…