Banking & Cloud – Cloud Banking – Tec-Bite IT Security Blog

About the job

At the end of March, the Swiss Bankers Association (SwissBanking) published a cloud guide. As with many other industries, the cloud also brings great advantages for banks, especially the possibility to test new products and services very quickly and thus bring them to market faster, which increases their competitiveness. Digital innovations can be easily tried out and efficiently adapted through a cloud platform before being launched to a broad audience. In the cloud, banks have access to Artificial Intelligence (AI) and Machine Learning (ML) platforms and can efficiently process and analyse very large amounts of data (Big Data), often in real time. While this is also possible on-premises, it not only requires a much larger investment but also allows much less flexibility in the selection and adaptation of these solutions. A prime example is Novartis; in 2013, they had to screen 10 million chemical compounds against a specific cancer marker within a week and would have had to build an on-premises infrastructure costing around 40 million US dollars. With AWS, they were able to achieve the same with 10,000 compute instances over 9 hours, at a cost of under 5 thousand US dollars. Source: SwissBanking, Cloud Guide – Guide for Secure Cloud Banking (Version 1.0), Basel March 2019, p. 13, Fig. 2 A central issue is compliance with banking secrecy in the cloud. Customer data (Client Identifying Data, CID) and personal data (Personally Identifiable Information, PII) must be protected in the cloud context through technical, organisational and contractual measures. These data can be encrypted or anonymised. In the case of encryption, control over the encryption keys must remain with the bank but may be made available to or stored by the cloud provider. An alternative is so-called pseudo-anonymisation or tokenisation of the data. Here, the data are anonymised, but the tokens are kept intact and can be analysed in the cloud, as they contain all relevant information but are not themselves customer data. The interesting point is that many big data analyses and similar evaluations can indeed be performed using tokens and metadata; the actual customer data are not necessary for a large part of the analyses or can be additionally correlated on-premises. In the case of an effective outsourcing of parts of the IT, the data must be encrypted both in transit and at rest. A hybrid approach is also possible, where pseudo-anonymised tokens are used that can be decrypted via a PKI session. The method the bank uses here is mainly influenced by which services can be used in the cloud (big data analyses or migration of infrastructure to the cloud). Source: SwissBanking, Cloud Guide – Guide for Secure Cloud Banking (Version 1.0), Basel March 2019, p. 16, Fig. 3 Additional measures can and must be resolved procedurally, but especially contractually. Another important issue is the disclosure of protected information following a decision by a competent Swiss court or the authorisation of a Swiss authority. Foreign authorities can request data from a cloud provider, but the release of data may only occur with the bank’s consent, based on a decision of the competent Swiss court or an authorisation from the competent Swiss authority. There is some uncertainty in this area regarding the so-called CLOUD Act (Clarifying Lawful Overseas Use of Data Act), which was signed into law in March 2018 (more on this in a separate blog post). Links: Everything about cloud security from AVANTEC at https://www.avantec.ch/themen/cloud-security/ The article Banking & Cloud first appeared on Tec-Bite.