Can encryption bring banks to the cloud?

One of Australia’s leading thinkers on IT strategy in the banking sector has proposed that encryption be used to overcome regulatory barriers preventing the finance industry from adopting cloud computing services.

The banking

The banking and finance sector has eyed off the potential to drive down IT costs using highly commoditised, virtualised computing stacks housed in offshore data centres – the largest in the region of which are based in Singapore.

Speaking at an Australian Information Industry Association breakfast, Paul Ventura, head of architecture, innovation and integration for Westpac-owned BT Financial Group told the audience that he respected and even appreciated APRA’s oversight.

Ventura, stressing that it was his personal opinion and not necessarily the corporate position of his employer, said he was grateful for the clarity APRA’s November 2010 open letter on cloud computing to the banking and finance sector provided.

It recognised, he said, why the sector was attracted to the new business model, but evidently set out their obligations: "It was a reminder that customer information is sacrosanct and has to reside in Australian territories."

The research available to date

On the research available to date, analysts cast some doubt over whether encryption would be an adequate solution for legacy banking and finance applications.

IBRS analyst James Turner, who has studied APRA's attitudes to cloud computing at length, as well said he doesn’t expect "throwing encryption at the problem would instantly get a gold star from APRA".

The basic mechanics of cloud computing

APRA’s outsourcing requirements are "fundamentally at odds with some of the basic mechanics of cloud computing," he noted.

"The introduction of encryption would add a whole new level of sophistication to the outsourcing model, which some cloud providers wouldn't be able to rise to. The process maturity around key management, securing any relevant communications from the cloud vendor back to the enterprise, and at that time the fun of auditing to verify that these processes are all being adhered to - that's going to present a challenge."

It's server-side encryption innovation allows electronic files to be ‘owned’ by the creator of the document – allowing the creator to adjust security settings that allow access to the file even once it has left a secured system.

IBRS’ Turner said he would not underestimate the potential impact any security breakthrough in the banking sector would provide the wider cloud computing industry.

He agreed that banking and finance offered a "lucrative market" to cloud computing which could drive research in the area.

"Cloud vendors will win doubly when they can sell to the banks in volume – first from revenue from the banks, second as a proof-point to other industries. They could say, look, the banks trust us.