24 CORPORATE | THE CLOUD

Cloud control
With cloud technology being increasingly viewed as the future for managing
IT in the financial services industry, security concerns continue to loom large

For some years, cloud technology Data stored on central servers is come to terms with the concept,
has been touted as the way more secure and is centralised especially where it involves a
forward for businesses to for all to access. Organisations third-party service providers’
manage their information also do not need to worry common data centre shared by
technology (IT) infrastructure. about software upgrade cycles many clients.
Underpinning the increasing and users can access all their According to Teh Lip Guan,
popularity is the technology’s applications via the browser. PwC Consulting Services
ability to meet IT workloads and Financially speaking, companies executive director, security is
applications deployment without are able to move their IT spending still the main concern for public
having to commit to the high cost from a capital to an operational clouds and this is a major factor
of maintaining systems. expenditure model because they in causing banking regulators
The benefits of the public are consuming IT as a service and to be hesitant in pushing the
cloud are clear for businesses. not buying hardware as assets. approach in Malaysia.
By having applications installed This means that IT budgets ‘The central bank – in
in data centres instead of being could become much more this case Bank Negara – is
‘on premises’, companies no efficiently utilised. naturally more conservative and
longer have to individually install But despite the obvious protective in its strategy and
software locally on personal advantages, the financial services execution, as compared to
computers, laptops or tablets. industry (FSI) is still struggling to those in Australia and European

ACCOUNTING AND BUSINESS

countries, due to the economic is a key imperative and focus bank has geared parts of its HR
and financial climate in the for all the players – banks, and internet protocol telephony
region,’ he says, adding that with regulators, technology solution applications onto the public
market economics and increased and IT infrastructure providers – cloud, explains Mary James,
competition in the region, Bank within the ecosystem. Alliance Bank Malaysia’s group
Negara is being pushed to provide ‘There are some very stringent chief information officer.
guidelines on the use of cloud regulations about the locality Among the benefits of using a
computing. Elsewhere in the and ownership of data, including public provider are cost efficiency,
region, Teh notes that Singapore standards and best practices for value-added benefits without
was the first regulator to issue the type of data moving through incurring additional costs, no
guidelines on the use of cloud the cloud, how it’s encrypted, how upfront purchase of hardware,
computing in South-East Asia, it’s stored and transferred, and scalability of system, and lower
followed by the Philippines. they are evolving and constantly carbon footprint through resource
improving,’ says McConaghy. sharing, James says.
Quality and integrity While the FSI is at best However, she points out, until
Steve Hodgkinson, research cautiously optimistic about the technology itself matures
director for Ovum Asia the potential of public cloud further and FSIs fully understand
Pacific, says that the main computing, some forward- how service providers deliver their
requirements for any public looking banks in the region have solutions, it’s very unlikely that
cloud service provider is that
they must be able to assure the
quality and integrity of their ▌▌▌’CONTRACTS MUST BE ABLE TO BE
information system environment
so that they will be able to meet EXECUTED IN THE JURISDICTION THAT THE
regulatory requirements. It must
be able to provide its services SERVICE PROVIDER IS BASED IN’
on a contractual basis, with
service-level agreements (SLAs)
clearly defined so that customers
can have the confidence that
operational requirements for begun to migrate parts of their more banks and core applications
availability, reliability and security IT workloads onto the public will move to the public cloud.
can be safely met. cloud. Examples include the FSIs can, however, choose to
‘These contracts must be able Commonwealth Bank of Australia, implement a partial move, as
to be executed in the jurisdiction National Australia Bank and Alliance Bank has done with
that the service provider is based Suncorp Group, all of which are its HR and internet protocol
in – that is to say, under local using Amazon Web Services – telephony applications. ‘There
laws,’ Hodgkinson says. ‘This one of the largest public cloud are many other solutions that
creates a strong preference for providers in the world. banks can move to the public
contracting with a locally based cloud without infringing on any
service provider and for keeping ‘Hybrid’ adoption guidelines, she says. ‘Examples
data in the country of its origin.’ PwC believes that while core and include recruitment, enterprise
Dan McConaghy, Asia Pacific critical banking applications are resources planning solutions and
president at FICO, an analytics unlikely to move toward public device management.’
software company, says that there cloud deployment any time soon, James says that one of the
is currently no one-size-fits-all there are ‘hybrid’ cloud adopters main considerations for her bank
set of central bank guidelines for for selected services, namely was ensuring that the data being
public cloud computing services. the non-core and secondary stored in the public cloud does
‘The guidelines are as varied banking activities such as human not infringe on guidelines as
as the countries themselves, as resources (HR) application, provided by Bank Negara. ‘We
many economies have banking software development, also needed to understand and
systems that are still going procurement and customer learn about the service provider
through a period of automation relationship management. and the types of practices
and modernisation,’ he says. In Malaysia, one bank that and processes being provided,
But what is clear, according has begun experimenting with as many service providers do
to McConaghy, is that managing public cloud services is Alliance not necessarily have the same
data privacy and sovereignty Bank Malaysia. Since 2013, the types of strict guidelines and »

ACCOUNTING AND BUSINESS

A TAXONOMY OF
CLOUD COMPUTING
Private cloud
Hosted on a private infrastructure and comprising servers, storage disks
and networking equipment, it is usually owned by an end user, and
operated and housed in a private data centre.

Public cloud
Hosted on a third-party data centre where companies merely lease the entire IT
infrastructure on a subscription, pay-as-you-go basis. Companies can lease hardware infrastructure and
sign up for software services such as Google Apps or Microsoft Office 365. Companies can also utilise a public
cloud provider’s resources as a platform to build other customised applications, such as Microsoft’s Azure.

Hybrid cloud
Can be hosted either at a third-party data centre or a privately owned premises where equipment is leased
or owned and operated by a private entity. Some application and data are stored privately – for example,
core banking apps such as savings and credit cards – while other applications can reside in the
public cloud such as HR and procurement.

processes that the banks might in the rear-view mirror; that’s like creation process, transit, storage
employ,’ she explains, adding that living in the past. But it’s also and usage.
the bank will continue to explore dangerous to drive too slowly ‘We recommend that
further opportunities in this area. because you fail to build the skills banks develop a sound
According to Hodgkinson, needed to drive in motorway traffic. strategic framework prior to
there are no easy steps to follow ‘The best approach is to embarking on the cloud journey –
to get on board with public cloud develop defensive driving skills, one that spans strategy through
computing. Rather, it’s a matter which can only be done “hands- execution and addresses the risks,
of gaining skills and experience on”. Banks need to try cloud security matters and compliance
progressively. Hodgkinson services safely to build experience implications of the cloud,’ he says.
refers to the experience of and skills in order to get hands- Teh also believes that banking
Suncorp Group, which, while on with cloud services to learn regulators must accelerate their
at the leading edge of cloud the skills to be an intelligent efforts in guiding the FSI in
services today, had been testing customer,’ he says. ‘Regulators adopting cloud computing.
its approach for several years need to ensure that regulations ‘Any uncertain issues
using a range of private and are not unjustifiably conservative and doubts arising from the
public cloud arrangements. or parochial and are clearly regulator must ideally be
communicated to banks.’ resolved,’ he says. ‘They must
‘All about trust’ Teh recommends that banks also be familiar with the strengths
‘It is all about trust, and trust begin identifying what needs to and limitations of various types
is only gained with experience be protected before formulating of cloud computing, so that they
and skill,’ he says. ‘Think of it as security controls to protect the are able to guide FSIs.’ ■
like learning to drive a car. It is data from an end-to-end process
dangerous to drive while looking workflow which includes the data Edwin Yapp, journalist

ACCOUNTING AND BUSINESS