EXECUTIVE REPORT. 6 Key Considerations for Financial Firms to Improve Security and Scalability of Mobile Banking Services

Transcription

1 EXECUTIVE REPORT 6 Key Considerations for to Improve Security and Scalability of Mobile Banking Services

2 Consumers Demand Mobile Banking, So Financial Companies Need Best-in- Class Security and Scalable Data Center Infrastructure In financial services, consumers are increasingly demanding access to more services via mobile devices. If financial companies want to stay relevant, firms must be able to provide mobile services. But doing so leads to an increase in the amount of data being transmitted and processed, and accommodating more data requires best-in-class security and scalable storage and data center infrastructure. Financial companies can increase their storage and security capacity in-house, but for a number of reasons, more global firms are finding it makes more sense to colocate at a data center instead. Colocation enables financial firms to scale infrastructure capacity; it ensures best-in-class data center security; and it facilitates data center consolidation. Financial CIOs must understand the following 6 considerations to assist them in meeting consumer s demand for mobile banking services: 1. The increasing demand for mobile financial services 2. Assessing ability of IT to manage big data 3. Cost concerns related to degradation in information security practices 4. How to measure the value of data center colocation 5. Improving data security for mobile applications 6. The impact of data center consolidation 2

3 #1: Demand for Mobile Financial Services is Increasing The statistics about the ubiquity of the smartphone are growing: about half of mobile phones in the U.S. are internet-enabled smartphones. But it is what consumers are doing with their smartphones that financial services firms must understand. Consider: 1 21 percent of mobile phone owners use mobile banking; 11 percent of those who don t use mobile banking think that they will within the next year The most common use of mobile banking is to check account balances or recent transactions; the second most common use is to transfer money between accounts 12 percent of mobile phone owners make mobile payments; the most common was online bill payment, followed by direct person-to-person money transfers Mobile banking usage will likely increase to one in three mobile phone users by early Growth in mobile and online technology adoption and the demand for these services by consumers will increase the need for CIOs in these segments to increase spending and expand IT infrastructure. #2: How Well-Equipped Are Financial Companies to Provide Mobile Services? Accommodating mobile banking and mobile payments increases the amount of data that financial companies have to manage. To make the customer-centric approach work, banks need new IT capabilities, including the ability to easily scale up or scale down infrastructure capacity and the ability to manage large volumes of customer and transaction data. 3 Most financial services firms are not adequately equipped to provide those new IT capabilities from the additional storage and data center infrastructure that will be required to best-inclass security requirements. 1 Board of Governors of the Federal Reserve, Consumers and Mobile Financial Services March econresdata/mobile-devices/2012-other-mobile-financial-services.htm 2 Board of Governors of the Federal Reserve, Board of Governors of the Federal Reserve,

4 Data is increasing, yet many financial services IT organizations aren t equipped to manage it Due to the rise of online and mobile financial services, the volume and size of data for financial institutions is increasing substantially. Making decisions on how to manage this data is important to the success of organizations. And even beyond mobile, companies need to focus IT efforts on emerging technologies that support the relationship between the bank and the customer. These technologies will allow the consumer to have control and improved communication relating to their customer experience. According to a 2012 report by Booz & Company, The financial crisis and changing marketplace have created massive disruption in the financial services industry, particularly for banks. To address these challenges, consumer banks must become more customer-centric. This in turn requires new foundational capabilities: capabilities that will help banks distinguish themselves as part of a customer-oriented industry. These include a seamless cross-channel portal with improved customer experience, better access to (and use of) customer insights, custom products and services, and better back-end business processes. 4 In a 2012 InformationWeek survey of 231 business technology professionals, 57 percent of respondents cited budget constraints as the top barrier to big data management. 5 Storage alone can quickly consume an enterprise budget. We see most data centers doubling storage capacity requirements every two to three years. To manage big data, companies need to figure out the right mix of policies and technologies to balance access, performance with capacity, security, and short and long-term costs. 6 4 ibid 5 InformationWeek, The Big Data Management Challenge, April research-thebig-data-management-challenge_ pdf 6 InformationWeek,

5 #3: Financial companies also need best-in-class security Many financial services firms have neglected information security over the last several years, in a degradation in many of the industry s security capabilities. For example, the percentage of survey respondents to the 2012 Global State of Information Security Survey who said their companies have business continuity and disaster recovery plans in place declined from72 percent in 2008 to just 57 percent in The percentage who reported compliance testing processes declined from 64 percent in 2008 to just 57 percent in Some of the degradation in information security practices in the financial industry is likely due to cost concerns. Security spending deferrals and cutbacks, already high, increased further in For the third year in a row, security-related spending deferrals and cutbacks for both capital and operating expenditures are high. This year s reluctance to spend on security priorities increased or remained constant for all categories. In fact, spending appears even more restrained than it was during the two years immediately following percent of respondents to the 2012 Global State of Information Security Survey said their companies deferred or reduced capital expenditures on security initiatives in 2011; 44 percent said the same about operating expenditures. Attention is more often paid to application security, but there are a number of information security issues related to physical infrastructure that are critical for financial companies to address as well, including: Physical data center security While the focus is often on security breaches by remote access, data centers can be, and sometimes are attacked physically. Such physical breaches can result in the theft of valuable data as well as theft of actual physical assets, and can lead to costly downtime. Several years ago, for example, armed robbers cut into the reinforced walls at a Chicago data center with a power saw and stole at least 20 data servers. 9 7 PwC, 2012 Global State of Information Security Survey, consumerglobal-information-security-survey.pdf 8 ibid 9 Rich Miller, Armed Robbery at Chicago Data Center, Data Center Knowledge 5

6 Compliance with increasingly complex regulations According to a 2012 survey conducted and reported by The Banker, a third of respondents say their information management program will not be able to cope with a growing regulatory burden and increased compliance requirements. Among all respondents, the greatest regulatory challenges will be associated with the Dodd-Frank Act, Patriot Act and Foreign Account Tax and Compliance Act (FATCA). 10 Business continuity and disaster recovery It is critical that financial companies ask themselves, If a hurricane flooded my data center, or a storm cut off its power, how would I continue to provide my customers access to financial services? How long would it take me to resume operations? Recent natural disasters and resulting blackouts in highly populated areas have brought those questions, about business continuity and disaster recovery for data-dependent companies, to the fore. Some financial services firms are well ahead of the pack, with plans already in place to ensure a rapid, efficient recovery in the event that a data center for whatever reason goes down. Investing in business continuity and disaster recovery is critical because the company s reputation and its customers loyalty is at stake. When severe thunderstorms in the mid-atlantic states caused temporary shutdowns at Amazon Web Services (AWS), the online dating service WhatsYourPrice.com was out twice for two-hour periods. The outages prompted a flood of complaints from many of WhatsYourPrice.com s 400,000 active members and damaged the dating site s reputation for reliability, said CEO Brandon Wade. In response, WhatsYourPrice.com ended its 18-month relationship with Amazon Web Services (AWS) and deployed servers in two colocation facilities, and hired another cloud provider, Fiber Hub, for data backup Capco, Lucas Mearian, Disaster Recovery Plans Get New Urgency, CIO. New_ Urgency?taxonomyId=3089 6

7 #4: Data Center Colocation Enables Scalable Storage, Data Center Infrastructure and Best-in-Class Security In order to manage increasing amounts of data and provide best-in-class security, financial companies IT capabilities need to evolve. Companies can fulfill those evolving capabilities in-house, but in many cases data center colocation may be more effective and more efficient. Colocation enables financial companies to scale infrastructure capacity. The ability to quickly and efficiently scale up or scale down infrastructure capacity is key to managing large volumes of customer and transaction data, and being able to bring mobile applications and services to market faster. It s also a critical driver of the cost savings associated with data center colocation. Scale quickly and efficiently Data center construction and expansion is a huge capital expense, and often takes many months to plan and secure approval. So in order to expand data center capacity in-house, most financial service firms need to look at a 6- or 12-month time horizon, as well as significant capital expenditures for the physical space, additional power, and additional cooling infrastructure. Expanding data center capacity in a colocation environment, in contrast, is as simple as securing new space and plugging in hardware. Manage large volumes of customer and transaction data Abhishek Mehta, managing director for big data and analytics at Bank of America, explains the role of big data in the banking industry well: Be it Bank of America, be it Wal-Mart, be it Verizon, they are all data companies. You don t push cash around, it s moving bits and bytes. 12 So big data has become a fact of life for financial companies, in an environment in which mobile services exponentially increases the amount of data that needs to be processed at any given time. Given that banks have to manage somewhere around 1.9 petabytes (1.9 million gigabytes) of data, the ability to manage that data efficiently and cost-effectively is critical. One of the ways that data center colocation enables the management of big data is by enabling financial companies to turn capital expenditures (sunk cost data center and associated infrastructure) into variable operational expenditures (a flexible colocation agreement that allows the financial firm to scale up or down as needed). 12 Datanami, How Four Financial Giants Crunch Big Data, July nancial_ giants_crunch_big_data.html?page=3 operational expenditures (a flexible colocation agreement that allows the financial firm to scale up or down as needed). 7

8 Get to market faster The speed at which business changes is faster than ever, and continues increasing. As mobile services continue to expand in the kinds of features available through mobile applications as well as the reach of mobile devices, financial companies will have to run to keep pace with changes in consumer demands. That s much easier to do when the company can scale quickly and efficiently with a colocation services provider than when scaling up requires significant infrastructure investment in-house. Ideally, financial companies should have data centers that are a best-fit solution, meaning they grow and adapt as the firm s needs evolve. That is typically much easier (and less expensive) to do in a colocation environment versus in-house. When considering a data center for colocation, financial companies should look for: Secured, shared infrastructure that can deliver lower costs and faster responsiveness when the financial company needs to change power or size requirements Low to very high density solutions that are tailored to the rack level Power redundancy tailored to the rack level A flexible contract so financial companies can grow into purchased power and space over a given time period Personalized service from data center employees, not outsourced contractors #5: Colocation Enables Best-In-Class Data Center Security Today, data is the lifeblood of a financial firms business. Obviously firms can t put their data in a secure vault with no connection to the outside world. But because the data flowing into, out of, and between their servers represents the lifeblood of their business, firms should secure it just thoroughly as they secure their customers deposits. 8

9 Physical data center security Data center colocation providers can typically more effectively and efficiently provide best-in-class (in some cases, military- grade) data center security, in part because they have economies of scale (they re providing security for a number of colocating customers), and in part because data center management (including security) is their core competency. When looking for a colocation services provider, look for: Onsite data center security guards 24 hours a day, 365 days a year Video surveillance and recording of the exterior and interior of each facility Biometric and key card security for rigid access control Turn style doors to prevent tail-gating Reinforced physical structure including concrete bollards, steel-lined walls, bulletproof glass and barbed-wire fencing The flexibility to have custom security features.financial services companies colocating at a data center, for example, receive: Dedicated data halls for customer-access only Floor-to-ceiling cage material for limited visibility and maximum airflow Barriers on ceiling, above server environment, and below the floor for added protection Laser beams within the walls of the data center Metal conduit for communication paths SCIF (Sensitive Compartmented Information Facility) features Compliance with increasingly complex regulations While many information security regulations apply at the application level (which a colocation services provider wouldn t touch), there are some infrastructure-related provisions in financial regulations. Look for a data center services provider that is fully certified with SSAE16, TIA 942 Top Tier, HIPAA, and PCI-DSS. 9

10 Business continuity and disaster recovery Given that financial services companies are managing large volumes of customer and transaction data so that their customers can access their information where, when, and how they want to, the companies can t afford for their systems to go down. Customers have very little tolerance for Your account is not available at this time. For most financial services firms, 100 percent uptime is easier and more cost effective to achieve in a colocation environment, where they can get a high density/high availability, future-proofed data center environment. When looking for a data center colocation provider, look for: Power and cooling architectures that utilize advanced components and are designed with N+1 and 2N parallel redundancies Meshed Design that provides a higher degree of resiliency versus other solutions on the market with no single point of failure Cooling or electrical systems that can withstand a loss of two legs and the systems are still 100 percent operational Distributed Redundant Electrical Design, which allows for multiple levels of redundancy within the same data hall #4: Colocation Enables Data Center Consolidation With some exceptions, data can typically live quite well in centralized locations. The benefits of consolidation with a colocation services provider include: Economies of scale Because an enterprise colocation data center builds and operates data centers at a much larger scale than most financial services firms would in-house, it allows those data center operators to achieve economies of scale, including economies in construction, and in the purchase of power (one of the most expensive data center operations expenses). 10

11 Labor arbitrage Security guards, for example, are a must at any data center. Obviously, the larger a data center is, the more security personnel are required, but there are nonetheless economies of scale in having data center operations consolidated among a smaller number of facilities, to reduce the duplication of personnel across many sites. Standardized, repeatable footprint (modular deployment) When companies choose to consolidate their data center operations by colocating at a smaller number of data centers, they reap the benefits of the data center operator s standardized, repeatable deployment model, which reduces the cost of and increases the speed at which new data center space can be deployed. Conclusion In today s environment, consumers increasingly expect to do just about anything from their mobile devices from making a purchase to paying a bill to transferring money. Financial services firms must stay ahead when accommodating consumer demands, yet most financial services firms don t have the scalable data storage capacity or best-in-class security they need in-house. helps financial services firms achieve scalable storage and best-in-class security, so firms can meet consumers demand for mobile banking. To learn how can help you, too, visit or call today. 11

12 About With over two dozen data centers across the globe, helps many of the world s largest global businesses including 9 of the global Fortune 20 companies and over 135 of the Fortune 1000 and companies of all sizes take advantage of the latest data center technology and realize top operational efficiencies through: Flexible, Scalable Solutions Receive flexible data center solutions that readily scale to match the needs of your growing business. Proven, Innovative Technology Benefit from the latest data center innovations expert technicians can put to work for your IT environment. Exceptional Service Enjoy personalized, consultative service through all stages of the relationship - design, build, installation, management, and reporting. National IX Offers low-cost metro connectivity and city-to-city transport in an ever growing number of cities across the US. About the Author Scott Brueggeman oversees the management of s global marketing, product development, inside sales, and corporate communications including branding, demand creation, and public relations. His 20 years of marketing and sales experience includes Fortune 50 firms, as well as smaller high-growth companies. Prior to, he spent several years with running marketing at a data center hosting and managed services company, as well as Chief Marketing Officer at PEAK6 Investments, an international financial services firm. Prior to that he was VP Marketing for CareerBuilder, and also held leadership positions at AT&T and PepsiCo. Brueggeman serves on several advisory boards. 12