Is Your Bank Ready for the Cloud?


8-27-14-cisco.pngFinancial services firms, like other companies, are running out of computing and storage space with available resources, and they are turning to cloud computing as a way to deliver information technology services on an as-needed basis. Firms are now looking for ways to stretch their existing data centers, as they often need more computing and storage capacity than their own facilities provide, especially during peak high-demand times. With the importance of this from a strategy and security standpoint, the board of the bank needs to provide proper oversight over this issue.

What is Cloud Computing?
Think of the cloud of a collection of computers where services such as compute (crunching numbers and data), and storage (a place to store the data that is being crunched and the results of that), are delivered dynamically as a service, rather than as a product. These services are typically delivered over the network, and in many cases, the Internet.

Instead of a line of business requesting 40 servers for a new data analytics software package, an IT team could deploy that software package on a cloud environment and provide access to the software. A dynamic cloud environment may give more compute and storage capacity when the application needs it and allocate less in periods of slow volume. This system of dynamic resource allocation makes the cloud an economical solution for large organizations.

Challenges With Financial Services IT Delivery
Data centers are a considerable investment to build and operate. Banking in the cloud lets banks extend their data center and current infrastructure when needed, while also providing additional data storage and computing capabilities offsite. In many cases, additional computing capacity is needed only for a short time in order to run certain risk models or to provide additional reporting for regulatory requirements. In this instance, a cloud-based infrastructure could be used to augment current big data and risk/analytics environments that banks have deployed.

The Trend to Hybrid Clouds
Today’s banks are in various stages of their cloud journey. Some have built their own private cloud hosting, defined as a single-tenant environment where the hardware, storage and network are dedicated to a single client or company. The resources and equipment required to run it are usually deployed in the firm’s own data center and managed by their own IT staff. Others utilize third parties to augment their own in-house application development efforts, a hybrid approach. A hybrid cloud service is a cloud computing service that is composed of some combination of private, public and community cloud services, from different service providers. Typically in this environment, a firm may have its own in-house private cloud environment, but may connect its private cloud to another provider’s cloud. In some cases, these facilities are located off-shore in foreign countries, and are not permitted to connect to, or utilize the bank’s internal network. In these instances, banks can benefit from using cloud solutions that allow temporary computing capacity, without a significant capital expenditure or time.

The Cloud’s Differentiated Services
Financial institutions can build secure hybrid clouds that only allow certain credentials to access bank data. Private cloud solutions provide a purpose-built, secure environment in which financial services institutions can very efficiently expand their compute capacity at a very low cost. In addition, the institution has full transparency to the environment from a monitoring and systems management perspective. When the bank needs additional space, it can use a public cloud, which shares data from a number of different sources and will require a higher level of security or care in what kind of data is housed there.

Board Oversight
Given that banks are increasingly turning to cloud computing, it makes sense for the board to know whether and how the institution is using cloud computing, and provide proper risk management oversight. Questions the board should ask include:

  • Is our bank currently using cloud computing services?
  • Do we intend to?
  • Do we have a private “cloud” or do we use third parties?
  • What security do we employ?
  • What kind of data is housed there?
  • How do our regulators view the use of cloud computing?
  • What are the advantages and disadvantages of the various types of cloud computing?

Is Banking’s Future in the Cloud?


Cloud_Puzzle_Pieces.jpgThe buzz on cloud computing is growing louder, leaving bank chief information officers—and the boards they report to—to examine whether cloud computing is a good fit for their banks. Broadly defined, it is the storage and management of data, which can then be accessed from virtually anywhere—on the road, from your home or from the office—via the web. According to Tom Garcia, CEO of InfoSight, Inc., an IT security firm based in Miami Lakes, Florida, the cloud is “really in its infancy” but “growing exponentially.” While regulators seem to be approaching cloud like any other vendor-provided service, a lot of bankers today are taking a wait and see approach, wondering, “Am I going to open up Pandora’s box with an examiner if I do this?” explains Garcia.

Atlanta-based SunTrust Banks, a $178.2-billion institution, is one banking company that is already on the cloud, using a private cloud that is unique to the company for customer relationship management software that allows the company to keep track of sales leads. Anil Cheriyan, SunTrust’s chief information officer, says the board of directors is actively engaged in a discussion about cloud computing, and SunTrust sees benefits in cost savings, efficiencies and flexibility. “The speed and agility [cloud computing] provides is of significant benefit,” he says, and it “clearly enables us to get our products and services to market much quicker.” He declined to describe the exact cost savings as those numbers vary.

Due to its ability to expand and contract quickly based on usage, Garcia adds that banks can see “great economies in cost savings” with cloud—as high as 40 percent for applications like hosted email over a traditional in-house solution. 

SunTrust has been steadily increasing oversight of vendor-provided services in general since the financial crisis began in 2008, Cheriyan says, so cloud computing has not directly resulted in any increases in oversight.

“We’ve taken that task of increased oversight anyway,’’ states Cheriyan, and continue to be “more and more aggressive [in terms of] how our data is protected.”

BNC Bancorp’s Bank of North Carolina, a $2.4-billion institution based in High Point, North Carolina, is at a fork in the road when it comes to the cloud, says Michael Bryan, the bank’s chief information officer. The bank outsources 90 percent of its core and ancillary systems already, and he feels good about cloud computing for core systems, seeing several benefits, particularly from a business continuity aspect in regards to disaster recovery. With cloud, if something happens to Bank of North Carolina’s operations center, “all I have to do is restore an Internet connection.”  As it is now, Bryan has to “spend more money” to acquire and maintain hardware. However, benefits found in cost, time and continuity are, to Bryan, not worth the loss of control if there is a security breach. Cloud vendors are not going to take on liability, “So if something goes wrong there; it’s up to you. Well, you don’t have any control over it,” Bryan says. “How do I explain that to my regulator?”

Once the security issues are worked out, Bryan sees tremendous opportunity. “Life would be a lot simpler,’’ he says.

SunTrust’s Cheriyan shares some of Bryan’s security concerns, and won’t trust everything to the cloud. “I wouldn’t trust our bank data on the public cloud at all,” he says. While SunTrust’s directors and management might read about exciting developments in the retail space, “You certainly have to weigh that against all the security concerns and manage core banking systems on much more secure environments.”

Due to the higher levels of regulation required in the financial industry, public cloud adoption rates will be slower. Can the benefits outweigh the risks? In areas like human resources and customer relations management Garcia believes so, and cautions that retail banks that hesitate to take advantage of the cloud may do so at their peril.

As the cloud industry grows, bankers’ trust in it—and their need for a competitive edge—could evolve. Can bank boards eventually trust their data to the public cloud?  In the world of technology, Cheriyan says, “Never say never.”