System failures in recent weeks involving such companies as Amazon.com Inc. and Sony Corp. have cast doubts on the security and reliability of cloud computing, and should put financial advisers on high alert
System failures in recent weeks involving such companies as Amazon.com Inc. and Sony Corp. have cast doubts on the security and reliability of cloud computing, and should put financial advisers on high alert.
First, Amazon Web Services, which offers computing services and data storage over the Internet, disclosed at the end of April that a technical glitch had caused numerous websites that it hosts for other businesses to run at a snail's pace. The same day, Sony said that personal data of nearly 100 million customers of its gaming services, PlayStation Network and Sony Online Entertainment, had been hijacked by hackers.
The two crises, though different, raise serious questions about the safety of cloud-based systems and should give advisers plenty of pause before deciding to move client information and applications from their hard drives to remote central servers.
Although cloud computing has long been common practice in other industries, it is just starting to become widespread among advisers.
In fact, 32% of respondents to InvestmentNews' 2011 RIA Technology Survey said that they are using cloud computing.
MANY BENEFITS
Cloud computing allows advisers to access many familiar desktop applications over the Internet.
Advisers who use cloud-based services save the time, effort and expense of maintaining local servers, thereby allowing them to spend more time with clients.
Indeed, 44% of the advisers who use the cloud said their top reason is that it makes technology management easier, according to the survey.
But the cloud is far from heaven sent. As the recent events involving Amazon and Sony demonstrate, cloud-based technology is vulnerable to malfunctions and to cyberattacks.
Although providers of cloud-based services are making it easy for financial planners, investment advisers and brokerage firms to shift sensitive client data to the cloud, advisers must not be lulled into thinking that data are safe and secure simply because they no longer reside in their offices.
Nor should they feel totally secure because no large financial services provider, so far, has reported a massive data loss due to vulnerabilities with the cloud.
The truth is that if companies as big and as technologically savvy as Amazon and Sony can experience problems with the cloud, so, too, can major banks, brokerage firms, mutual fund companies and advisers.
Data stored in the cloud should be encrypted and afforded the same level of backup protection as data stored elsewhere.
Advisers also must hold cloud-based vendors' feet to the fire when it comes to the security of data. That means that they should require them to submit to routine security audits and penetration testing.
They should, at a minimum, require vendors to complete a Statement on Auditing Standards No. 70 audit and to receive a service auditor's Type II report. The SAS 70 Type II report is a widely recognized auditing standard developed by the American Institute of Certified Public Accountants. It confirms that an independent third party has verified that a vendor's policies and procedures are appropriately designed, with the proper controls in place, and functioning as designed.
Vendors that refuse to comply with these requirements shouldn't be used under any circumstance.
For better or worse, the Internet represents a new battleground. That was made clear last week when the Pentagon said that it wouldn't rule out a military response to a cyberattack.
Financial planners, investment advisers and brokerage firms must do everything they can to protect their systems, and their clients' portfolios and personal information, from cyberterrorism, especially now that the cloud is on the horizon.
