Making the Most of Cloud Solutions in Financial Services

When it comes to digital transformation initiatives, cloud computing is frequently a key part of the conversation. The cloud is meant to be cost-effective, flexible, and scalable – a way to optimize operations, improve efficiency, and address a long list of use cases. And yet, technology professionals will be quick to caution that cloud services are not a panacea for every business challenge, and cloud transformation may look very different across different types of companies.

For example, while some industries embraced cloud migration early on, financial institutions have always moved at their own pace. The financial services sector has some of the most complex legacy application ecosystems and must comply with strict regulations, which has resulted in hesitance when it comes to embracing public cloud. On-premise systems were the norm, and initial exploration of the cloud was largely limited to private cloud deployments as financial institutions took a more conservative approach. However, the promise of offering better services with less effort has driven banks, credit unions, and other financial organizations to explore other types of cloud environments. In recent years, financial organizations have been investing much more in hybrid deployment models and public cloud, with 90% using at least two cloud deployment types and 88% using more than one public cloud. 64% of enterprises that have adopted public or internal private cloud even consider public cloud as their primary cloud platform.¹

Clearly, the cloud has become integral to the way modern financial institutions do business. However, the cloud journey still presents financial institutions with unique challenges around security and privacy which must be addressed. Finding the right cloud deployment model is critical to long-term business success – and identity tools can help financial institutions get the most out of their cloud investments.

Before diving into the promises and potential pitfalls of the cloud, it is useful to think about the ways in which the financial services industry is unique. Certain cloud benefits may be particularly desirable for financial institutions – but conversely, some of the potential risks come with much higher stakes for a company charged with the keeping of its customers’ finances. Some of the factors that impact the way financial organizations approach cloud include:

Resilience Focus

Organizations that manage money are particularly sensitive to downtime and service disruptions. Providing existing clients with a consistent customer experience and ensuring they always have access to their funds must come first. The cloud offers greater resilience in theory, but in practice, technology migrations from legacy systems to cloud-based ones may be challenging to complete without harming performance, and multi-cloud solutions may make this even more complex.

Reliance on Custom, Legacy Systems

Financial organizations usually have multiple legacy systems, many of which were custom-built, and modernization is not always the right answer. This is why hybrid deployments are so attractive – financial services organizations need to be able to blend new applications and technologies in with their legacy services.

Corporate Culture

Financial organizations often have legacy employees as well as legacy systems, which engenders a culture of resistance to change and an ever-increasing skills gap. The resistance to change combined with the aim for 100% uptime may hinder innovation, although innovation does not always mean downtime. Closing the skill gap mitigates the perceived risk of innovation. Management must address this while considering the adoption of new technologies.

Strict Regulatory Demands

Financial institutions must comply with a variety of regulations, including GDPR, Open Banking/PSD2, CCPA, BSA, CDR, PCI DSS, and more. These regulations often dictate how (and where) customer data is collected, stored, used, and shared. They also put the focus on ensuring tight cybersecurity and data protection controls. Regulatory compliance is a key consideration when developing a cloud strategy. In fact, CloudSecurityAlliance.org has even developed a controls matrix specifically to address this issue.

In large part, the growing cloud-first focus in the financial industry has to do with improving resilience, reducing costs, and the desire to more effectively serve customers. Financial institutions look to the cloud to help achieve a faster time to market, greater flexibility and scalability, lower costs, improved collaboration, high availability, and data loss prevention. Cloud promises improvements in all of these areas, and enables the API-powered financial ecosystems that are so crucial to the way this industry operates today. The cloud also gives traditional financial institutions a better chance to compete with newer entrants into the industry – cloud-native fintechs and neobanks often offer services that require cloud technologies to take advantage of them.

On the other hand, cloud deployments bring new and serious challenges such as increased complexity, security and privacy concerns, regulatory compliance challenges, and governance issues; organizations often experience vendor lock-in as well, making it difficult to switch providers when something isn’t working optimally. There is also the matter of needing new skills to fully realize cloud’s purported benefits, and the cultural and personnel changes that often come along with this can make the transition harder still.

At the end of the day, a cloud migration strategy is a risk-management exercise, and all of these challenges contribute to the fact that financial organizations nearly always opt for hybrid deployments – this allows for a better balance between the benefits of cloud and the associated risks. Putting aside the inherent value and complexities associated with cryptographic separation and key management, one issue that hybrid deployments generally can’t address is the complexities surrounding storing applications and data in multiple locations, frequently across regions. These challenges can make some of cloud’s benefits harder to realize if they are not accounted for early in the architecture and design discussions.

Where does identity fit into this story? When applications are scattered across cloud and premise-based systems, identity is the one thing that ties everything together. After all, even in a dynamic environment where technology continues to change and evolve, a user’s identity never changes, regardless of where they’re coming from, what they’re accessing, or what their role within a given enterprise might be. Joe Smith is always Joe Smith, whether he’s accessing the web or mobile app, connecting to a third party service through a fintech partner, or contacting support to report a problem with his account.

The same identity and access management information is used on-premise and in the cloud, and looking at individual identities as users interact with key systems allows organizations to understand who users are, what resources they are accessing and when, and what the associated risks are. Fraud, cyber, operations, and insider threat teams can all use identity data to improve investigations and drive the resiliency that customers expect from their financial institutions. Because identity is the common point where policy can be enforced, it is the best place to start when protecting both your workforce and customers, regardless of where your applications may sit. With identity as a single policy enforcement point, organizations can lower risk, increase audit and investigation accuracy, and make maintenance easier.

Getting identity and access management right can greatly improve the chances of success when embarking on digital transformation initiatives that include cloud services. Financial services firms may find that outsourcing identity security is the best possible move when existing employees don't have the skills to build, run, and maintain the solutions at scale. Using standards-based technologies are the key to ensuring ease of management – and ease of switching providers in the future.

Given we’re discussing the cloud, it’s important to note that identity can be deployed in a hybrid model, too. When it comes to measuring the multiple components required to complete a single financial transaction, milliseconds matter. In order to meet performance requirements and reduce supply chain risk, organizations should look for identity services that can meet their apps where they are – whether that be on-premise or in the cloud – but can still be adapted to performance, availability, and disaster recovery requirements.

Here at Ping, we’re happy to help you move to the cloud, ensure regulatory compliance, consolidate technologies, enable your workforce, and delight your customers with seamless security and smooth customer experiences. If you’d like to learn more about our approach to these topics, check out our webinar, Cloud and Hybrid Identity Solutions for Financial Services for a deeper dive.

Woo, Liu, Soley, The State Of Cloud In Financial Services, 2023. Forrester. 2023.