Chern-Yue Boey | 29 August 2022
Chern-Yue Boey, Senior Vice President, Asia Pacific, SailPoint
With digital transformation and the exponential growth in digital transactions during the pandemic, financial institutions have had to become more data-driven and look towards cloud migration.
Recently, Monetary Authority of Singapore, (MAS), has issued a guideline for all financial institutions operating in Singapore to develop a comprehensive and future-ready public cloud risk management strategy to ensure high standards of compliance controls, data governance and mitigation protocols.
MAS also states that as identity and access management is the cornerstone of effective cloud security risk management, financial institutions should enforce the principle of “least privilege” stringently when granting access to information assets in the public cloud. Access rights and system privileges should be granted according to the roles and responsibilities of the staff, contractors and service providers, thus ensuring each identity in the organization receives the right access to the right resources to do their job when they need it.
The cloud helps organizations scale up their operations, embrace flexibility, increase process efficiency and enhance data security, but yet a large percentage of financial institutions are still running on their legacy identity security infrastructure and are hesitant to switch to the cloud due to the hefty amount of financial and technical investments to their legacy tech stack.
A mindset shift is crucial
As a traditional, legacy approach relies on manual processes for tracking data access and user identities, there are possibilities for human errors and inconsistencies, which may result in gaps that can be exploited by cyber attackers.
Also, as work processes are siloed, IT and management teams do not have visibility into roles, responsibilities and data access in the organization.
In order to streamline operations and meet compliance requirements, it is important for financial institutions to automate business processes and strengthen their identity security practices. With a comprehensive identity security solution, financial services can automate the management of all user identities, entitlements, systems, data and cloud services.
The need of the hour is a mindset shift among traditional banks, as the transition to the cloud is not just about the technology, but also about the changes needed in the governance, processes, infrastructure and data framework, which means this should be a business transformation, and a top-down agenda for traditional banks.
Explore a phased cloud transition
For legacy banking architectures, migrating to the cloud is not a cake walk. Instead of an abrupt shift, banks can undertake a phased approach where legacy applications are migrated incrementally, in a step-by-step manner to avoid business disruptions.
Traditional banks will first need to identify the type of platform they need, ie; public cloud, private cloud, or hybrid cloud, and thereafter prioritize the workloads that need to be moved to the cloud. Then, it is important to ensure all the identity foundations are in place, followed by seeking a SaaS model that will meet their needs. Finally, reviewing the decisions made is vital for any learning, and to ensure that their priorities are still valid.
With SaaS models, banks can benefit from a range of advantages including cost savings, flexibility, enhanced security and automation, and can drive value in a shorter time. A cloud-based SaaS solution will also enable banks to be agile and innovate quickly to meet evolving customer needs, which is especially critical today as banks are facing competition from digital-first banks and non-bank companies providing financial services.
An integrated identity security solution is key
Banks should look at implementing a cloud native, multi-tenant, single codebase, SaaS-based identity security solution instead of a cloud hosted solution for frequent updates and better TCO. A modern, cloud-native identity platform will give banks visibility of all the identities, accounts, and accesses in their organization.
As financial institutions are faced with significant security, operational and compliance challenges, they need a robust identity security solution that integrates seamlessly with existing systems and workflows which as a result, saves costs, provides extensive visibility, and supports a solid security strategy. Banks which employ a mix of on-premises, cloud and hybrid applications, need flexibility, ease of integration and control to support these heterogeneous environments.
On top of these challenges, as financial institutions operate in a highly-regulated environment, they need certification of user access to facilitate compliance requirements. Hence, there lies a bigger need for banks to rapidly secure their dynamic work environments by deploying AI-driven identity security which will provide approval recommendations based on peer group access and accelerate certification process across any platform or application on-premises or in the cloud.
Harness AI and ML to secure all identities
With workforce transformation and digital transformation, there’s a rise in non-human identities, RPA and IoT, resulting in the volume of identity data and complexities increasing beyond human capacity.
A modern identity security solution that incorporates artificial intelligence and machine learning is vital for these identities to be managed as it will empower financial institutions to automate the discovery, management, and control of all user access throughout their digital lifecycle. With automation, identity processes and decisions, such as access requests, access changes, role modelling, and access certifications can be streamlined so employees can focus on innovation, collaboration, and productivity.
With a focus on the core of identity security, banks can control access ensuring users have the access they need when they need it, and spot potential threats. This approach gives banks the ability to automate IT tasks, keep policies up to date, and drive stronger security and compliance across the entire organization.
Stay ahead of the security curve
With an automated identity process, management teams can have a complete view of their users’ access, including employees, partners, vendors, contractors and non-human identities, and ensure they are only accessing, managing and sharing data for which they are authorized.
Banks can also easily and securely remove or reinstate access when an employee joins, changes roles or leaves the company, without any human interaction, which is in line with MAS Technology Risk Management guidelines that require financial institutions to ensure that access rights that are no longer needed, as a result of a change in a user’s job responsibilities or employment status (e.g. transfer or termination of employment), should be revoked or disabled promptly.
By tracking all access activity within the organization, the auditing and reporting process becomes more streamlined and cost-effective. Automation also makes it simple to enforce access controls and fine-grained entitlements that prevent conflicts of interest, information theft and compliance violations, enabling a robust, effective, and compliant cyber security posture.
With AI and ML-driven identity security, financial institutions can make smart access decisions to uncover and remediate hidden or unknown issues that may pose risks to the organization, and innovate security processes aligned with the evolving needs and complexities of the financial services industry.
