The financial services sector (FSS) is accelerating the adoption of cloud. According to a 451 Research survey, financial companies are adopting hybrid cloud services as a core part of their technology and infrastructure strategies. Hybrid cloud is defined as a cloud computing environment that utilizes a mixture of on-premises private cloud and third-party public cloud services.

FSS Companies Shift to Hybrid Cloud

In 2015, IBM’s financial services customers, including banking, capital markets and insurance companies, began to implement public cloud for nonproduction workloads, including DevOps, testing and capacity on demand. Much of this adoption is driven by the shift from capital expenditure (capex) to operational expenditure (opex) budgets and an overall willingness to leverage everything-as-a-service, which are natural use cases for public cloud consumption.

IBM’s FSS customers are designing cloud-agnostic workloads that can run on any cloud, including private and public infrastructure. We see use cases such as grid computing, capacity on demand and DevOps drive these financial services firms to utilize public cloud as the primary platform to develop new services and applications. As FSS customers focus on strategic issues such as data center consolidation, application modernization and technology refreshes, the adoption of public cloud increases, as does its acceptance as a next-generation platform.

Read the white paper: Addressing the hybrid cloud security conundrum for financial service

The Complexities of Cloud Security

Although there is high degree of interest on the part of financial services firms to adopt hybrid cloud, there are still a number of major concerns regarding security, data privacy and a complex regulatory landscape that need to be answered before hybrid cloud can become mainstream. There are also negative perceptions regarding cloud that must be overcome, such as the notion that cloud security is difficult to maintain, complex and costly.

Any FSS company planning to adopt hybrid cloud should consider the following must-have elements when selecting a vendor:

1. Regulatory and compliance alignment;
2. Standard security frameworks and controls;
3. Rigorous monitoring of regulatory changes;
4. Access management;
5. Network security;
6. Data protection;
7. Application security;
8. Visibility and intelligence;
9. Workload-centric capabilities; and
10. Cloud-agnostic managed security services (MSS).

Regulatory Compliance and Security Standards

As FSS companies adapt hybrid cloud, there are myriad complex regulations that must be addressed to ensure that cloud-enabled applications are properly secured. These standards, such as those from the Federal Financial Institutions Examination Council (FFIEC), the Federal Reserve Bank of New York (NY FED) and the National Institute of Standards and Technology (NIST), are creating stringent cloud security requirements for financial services firms to implement security frameworks and controls that comply with these regulations.

These evolving standards and associated complexities have created opportunities for vendors to deliver industry-regulated security solutions to help FSS companies properly secure their hybrid clouds.

IBM’s FSS Hybrid Cloud Security Platform is positioned to become a reliable FSS industry solution by providing capabilities that include:

1. Hybrid cloud support for private and public cloud;
2. Support for infrastructure-as-a-service (IaaS), platform-as-a-service (PaaS) and DevOps;
3. Continuous regulatory compliance;
4. Compliant security frameworks and controls;
5. Data compliance, visibility and encryption;
6. Cross-cloud platform management;
7. Monitoring, detection and response;
8. Dynamic infrastructure hardening;
9. Cloud control catalog; and
10. Identity and access controls.

Is Hybrid Cloud Safe for FSS?

So, is it really safe for FSS firms to utilize hybrid cloud services? With the right standards and solutions, yes, hybrid cloud is a viable option for FSS as of now.

Many hybrid cloud services have matured into secure platforms for financial services companies to support core production applications — with a few caveats. FSS companies must be diligent in their understanding of the evolving regulatory landscape and ensure that they are choosing cloud providers that can deliver the proper security framework, security controls, end-to-end monitoring, and a security management system that is highly automated and cognitive.

Ten essential elements for a safe, secure and compliant business operation