INTRODUCTION TO THE CLOUD.

Lynn Strongin Dodds, Editor

The financial services industry is often at the forefront of technological change but they are only cautiously embracing cloud computing. While drawn to the flexibility and low costs on offer, concern over security and reliability persist. Providers are trying to allay their fears but investment banks and fund managers continue to tread cautiously towards the virtual world.

Marc De Groote, chief executive of Callataÿ
& Wouters, a technology firm that serves the financial services industry believes that cloud will gain momentum as “part of the overall outsourcing trend that is taking place across the industry. About half of the banks are outsourcing in some way
and I think people do understand the benefits and potential cost savings of using the cloud.”

In fact, a recent study by Centre for Economics and Business Research, a UK think tank, commissioned by data storage and solutions company EMC, predicts that 60% to 80% of all EMEA-based businesses in the banking, financial and business services sector will have adopted some form of cloud computing by 2015. Views are mixed though as to whether adoption rates will be that rapid.

Jon Milward, director of managed and support services at IT consultancy, Northdoor plc, believes financial services firm have to put cloud technology into perspective. “In many ways cloud computing does not offer any new functions in that access to storage, applications and servers are provided and managed by a third party versus in-house.” he says. “It is though a new way of delivering those services and companies have to understand that the cloud will not make all their IT headaches go away.”

The main benefits as with any IT outsourcing are well documented. Financial firms would not have to develop implement, maintain or upgrade technology. In addition, due to the on-demand nature of cloud computing, there is both scalability and elasticity. For example, if a bank requires surplus computing power or storage space due to an occasional spike in demand, it can look up to the cloud.

There are though several concerns, the first being the confusion over the definitions and the different terms that are bandied about such as – cloud computing, software-as-a-service (SaaS) and application service provider (ASP) which can be viewed as variations on a theme. A recent report by Celent defines cloud computing as the outsourcing of IT hardware – such as storage, servers and other infrastructure services – to a vendor that provides these services via the internet on an on-demand basis. Users therefore pay only for what they use and can call on these services as and when they need them.

SaaS, on the other hand, refers to the outsourcing of various applications, but not hardware. It may seem similar to ASP but Celent believes there are differences. The use of private networks and the constant customisation made the ASP model economically unrewarding, whereas the SaaS model is based on all users having access to the same application and via the same internet-based route.

The other issues, according to Milward revolve around availability, the legal contracts as well as the security of data stored and accessed remotely. “As with any technology such as Amazon or Google mail, there are outages and as a result, firms have
to look at whether they will be compensated if the service goes down. As for security, companies have to check whether they are allowed to have their data stored in a different location than their home market because some regulators do not allow this. Also, in terms of overall security, the best advice is to use a large provider with a track record.”

In fact, there are many vendors in the marketplace who have jumped on the cloud bandwagon and relabelled their offerings as cloud compatible. Stuart Berwick, chief executive officer of Singletrack Systems says, “We have seen several established IT vendors entering the cloud space positioning themselves as cloud providers to align themselves with this new trend. What
we are seeing is that banks and asset managers are gradually making the move with smaller firms making the move first. It is typically starting with applications like CRM [customer relationship management] and research management.”

Private versus public

These views are underscored by a report by Gartner which notes that cloud computing will evolve in stages emigrating first to what are known as private clouds and then on to public clouds over a period of years. A private cloud typically means that the data centres are still owned by
the corporate users and managed in-house. They take advantage of cloud-enabling technologies such as the virtualisation provided by VMware and the internet. By contrast, a “public cloud,” usually means that nearly all of a company’s information
is outsourced and managed by a third party that owns clusters of data centres.

Simon Watts, chief architect at DST Global Solutions, says, “Concerns over security are making asset managers, for example, extremely wary of public clouds but we are seeing an increase in the use of private clouds because they are ring fenced within an organisation. I think the usage will ramp up as organisations become more comfortable with the technology but to date most of the public clouds are being used by the consumer and retail sectors.”

In the financial community, the first movers have tended to be the smaller asset management houses that do not have the deep pockets to develop their in-house capabilities. Alternative fund managers are also jumping on the bandwagon. “We are seeing an increasing number of hedge funds and private equity firms who are using our services for fund raising,” says Philip Whitchelo, a vice president at technology group IntraLinks. “For example, instead of private equity firms sending out individual prospectuses to investors, they will take all the information about a fund and put it in a cloud-based service for investors to read. This makes the process much more efficient and cost effective.”

Public clouds, particularly those focused on information based delivery services are though gaining traction among the larger players. For example, Fidessa has enjoyed success with its Fragulator and Tradalyzer products. The former offers comprehensive global content with specific regional analysis on the US, Canada, Japan and Asia as well as Europe where it is pulling data from more than 40 platforms. The tool aggregates, normalises and analyses all of the data reported by dark pools, systematic internalisers and lit venues to the various trade reporting facilities.

The Tradalyzer which is based on this data offers customisable consolidated trading analysis across Europe’s fragmented markets. The Tradalyzer allows users to compare an individual trade against data consolidated by Fidessa who in turn assesses the execution quality of that particular trade and rates it against a set of widely used industry benchmarks. These include arrival price, last trade, interval volume-weighted average price (VWAP), 20% VWAP market open, market close, and previous close.

According to Steve Grob, director of group strategy, Fidessa, the services run on Amazon. com’s S3 (Simple Storage Service) and are data encrypted and protected. “Although the financial services industry has concerns over the security of the cloud, there are well-established practices for data integrity and security. If you follow those, then there is no reason why there should be a risk.”

Looking ahead, Jose-Antonio Martinez, managing director of Radianz & Payments, BT Global Services believes that the new world regulatory order will be one the key drivers generating demand for cloud services.

Traditionally, the applications accessible via the BT Radianz cloud have been focused on pre-trade, trading and post-trade usage but the firm has expanded its horizons into the compliance and governance arena. Users can tap into LockPath’s Keylight platform for governance, risk and compliance (GRC).

The platform provides US and internationally regulated businesses with a fully automated governance, risk and compliance data reconciliation and reporting process. It consolidates business critical risk and compliance data and provides a single point of control that aims to ensures compliance across the organisation

This was the first of several SaaS applications being made available through the BT Radianz. Customers can leverage the BT Radianz cloud to access the Keylight application, while having the option to simultaneously host data in any of the global BT Radianz Hosting data centres

“Meeting regulatory requirements is one of the biggest challenges facing the financial services industry”, says Martinez. “As a result, there is
an increased demand for automated solutions to manage governance, risk and compliance. Overall, I think we will see an increase in the use of cloud services but many companies may choose a ‘hybrid’ solution whereby some of their more standard applications will make use of the cloud, whilst others will be hosted in-house. Clouds that are able to interconnect easily with these in-house applications and the corporate networks and clouds they’re hosted on will succeed.”

A CLOUD MAP FOR EUROPE.

Migration to the cloud heralds a host of opportunities
for business, but without joined-up thinking regarding
the infrastructure, legislation and standards the hoped
for benefits might not be realized. Best Execution spoke to Ken Ducatel, of DG CONNECT* about the strategy decisions being hammered out in the EU to put Europe at the forefront of cloud adoption.

What are the key drivers in developing a single policy area for cloud computing (with particular emphasis on the financial markets)?

Our main goal is to increase the competitiveness
of the European economy, to facilitate growth and the creation of jobs in Europe. Today, this is not possible for the European cloud computing market. The EU’s cloud market is fragmented, as different rules apply in different member states.

This patchwork of different rules causes uncertainty, as businesses and individual users
are not sure about their legal obligations (for example they don’t know where legal disputes
will be resolved or how to make sure that it will be easy to move data and software between different cloud providers). They are not sure what standards and certificates they should look for to meet their requirements and legal obligations, for example
to ensure that their own or their customers’ data
is safe or that applications are interoperable. It is only natural that this uncertainty leads them to postpone the decision to adopt cloud solutions.

The new cloud computing strategy** will help Europe make the most of the enormous potential offered by the cloud. According to new estimates, cloud computing revenues in the EU could rise to nearly €80 billion by 2020, if policy intervention is successful (more than doubling the growth of the sector). So this strategy is about building a new industry, and better competing in the global cloud market. More broadly, we expect a net annual gain of €160 billion to EU GDP by 2020 (or a total gain of nearly €600 billion between 2015 and 2020) if the full EU cloud strategy is in place. Without that, economic gains would be two-thirds less.

These benefits largely come from businesses being able to either save money or get access to technology that makes them more productive. In terms of overall job numbers, we expect to see 3.8 million jobs generated following full implementation of the strategy, against 1.3 million if the regulatory and other policy barriers are not removed.

In terms of policy, what kind of framework
do you envisage for the European cloud computing strategy?

We want a business framework that will speed
up the take-up of cloud computing across EU economy. To do this, we need to make Europe not just cloud-friendly, but also cloud-active. And this can be achieved by means of three key actions:

We plan to cut through the jungle of technical standards. Standards are emerging, but at the moment there is no common agreement as to which standards would guarantee the required interoperability, data portability and reversibility. That is why we want to identify coherent sets of useful standards to make it easier for the demand and supply sides to organise themselves.

We want Safe and Fair Contract Terms and Conditions to address issues not covered by the Common European Sales Law such as: data preservation after termination of the contract, data disclosure and integrity, data location and transfer, ownership of the data or direct and indirect liability. Identifying and developing consistent solutions in the area of contract terms and conditions is a way of encouraging wide take up of cloud computing services by increasing trust by consumers.

We are promoting common public sector leadership through a European Cloud Partnership (ECP). This Partnership will bring together public procurement authorities and industry consortia to implement pre-commercial procurement actions. This will allow them to identify public sector cloud computing requirements, to develop specifications for IT procurement, and to procure reference implementations. They will thus be able to advance towards common and even joint procurement of cloud computing services by public bodies on the basis of common user requirements.

Are security and privacy the main challenges, and if so what can be done to allay the fears?

Security is one of the main challenges of cloud computing – though we should bear in mind that risks in the cloud do not necessarily differ much technically from already known risks. However, in the cloud, these risks can amplify quickly and easily, and this increases the effects on multiple clients simultaneously. Cloud-specific security risks relate to the multi-tenancy and shared resources character of cloud computing. They are related, for example, to access control, data storage, data protection, data portability, data integrity and virtualisation. In the cloud, the user cedes control of the security to the service provider; it is thus more difficult for the user and the provider to agree on sufficient assurance levels for the service. This is probably why the cloud is perceived to be less secure.

Privacy risks also relate to the perceived lack of control and to unclear roles of different actors in the cloud service provision chain. In the cloud, personal and other sensitive data can be stored and processed anywhere – also outside the European Union. This in turn creates confusion about the applicable data protection rules.

What we are doing about this is work very actively to increase the security of IT systems.
The European Commission is collaborating
with industry and with the European Telecommunications Standards Institute (ETSI) to identify a detailed map of the necessary standards and to work with the support of the Network and Information Security Agency (ENISA) to assist the development of EU-wide voluntary certification schemes in the area of cloud computing. The Commission is also preparing a European Strategy on Cyber Security that will also encompass cloud security. In the field of data protection, we already have proposed a new Regulation which aims to ensure the high level of data protection and addresses issues raised by the advent of cloud computing.

Would simplifying the legislative minefield help?

We are in the course of assessing whether current security legislation needs some streamlining
as regards cloud providers. For example, their obligation to notify severe security breaches is being assessed. But amending legislation is not always the best course to follow. For example, standards are voluntary; therefore it is up to market players whether they will endorse them or not. In cases such as this, creating trustworthy certification schemes is a faster and more effective way to increase security of cloud services than legislation.

What are the challenges to delivering a co-ordinated cloud infrastructure in Europe?

The cloud computing strategy does not foresee the building of a dedicated hardware infrastructure to provide generic cloud computing services to public sector users across Europe. We simply want to see publicly available offerings of cloud- based services that meet European standards not only in regulatory terms, but also in terms of being competitive, open and secure.

This does not preclude public authorities
from setting up dedicated private clouds, but in general even cloud services used by the public sector should – as far as feasible – be subject to competition on the market to ensure best value for money, while conforming to regulatory obligations or wider public-policy objectives in respect of key operating criteria, such as security and protection of sensitive data.

What role do funding, research and innovation play?

We want European companies to remain at the cutting edge of technological development and innovation. That is why we have established a vast portfolio of research activities on cloud computing, alongside policy actions. Our budgetary commitment to cloud computing-related research is currently around €400 million and it’s funded through European research programmes.

Moreover, we will try to make full use of other available research and development instruments offered by Horizon 2020*** to tackle long-term challenges specific to cloud computing.

Why does Europe lag behind the US? Is it because there are varying local accounting methods and business practices and,
the absence of harmonised rules for the technology?

In Europe our biggest potential weapon for increasing competitiveness is the single market, and if we could get to a vibrant Digital Single Market then I believe Europe would be able to lead the world in technology and services. Too often businesses are stopped at borders which in the online world don’t make sense any more. Many of the actions announced in the Digital Agenda are addressing these problems in respect of Digital Content, e-Commerce or Data Protection and in order to promote cloud in Europe we need to reinforce our efforts in these fields.

What does it mean to be cloud active?

Being cloud-active means creating the conditions that will allow us to make the most of the potential offered by cloud computing. It means we are not standing still, waiting in the shadows for others to lead the way. It means taking initiatives that will open new paths in cloud use in business, research, education, and culture.

That is what we want to achieve with this strategy. We know that in Europe we have the talent it takes to be world leader. We want to allow this talent to flourish. We want it to bring growth and jobs in Europe for us and for the generations to come.