Cloud computing gains traction but doubts remain

Cloud computing has been hailed by its advocates as the ultimate solution for life and pension providers’ irregular requirements for massive computing power. But some in the industry are questioning its usefulness on grounds of security and efficacy. Clive Davidson reports

Life and pensions companies face an ongoing challenge as computer processing and data volumes continue to escalate. The stochastic modelling of risk and capital, driven by Solvency II and internal risk management, place enormous demands on in-house IT, particularly at year-end and other reporting periods. Given the pressure, it is natural that companies should turn to external service providers to help, especially now there is a growing infrastructure of third-party technology for hire.

Called ‘cloud computing', the infrastructure offers online pay-as-you-go processing and data storage that can scale to meet even the most intense demands of financial services. However, although the technology has been talked up as the future of computing, there are a number of issues that must be resolved before it can fulfil its promise for the life and pensions industry.

Modelling capabilities

When Lincoln Financial Group, based in Hartford, Connecticut, wanted to upgrade its modelling capabilities for its variable annuities business it looked at cloud computing as a means of providing the required performance levels. However, in spite of successful tests of the modelling software running in a cloud environment, Lincoln could not get its models to work satisfactorily.

"Our models would run well on our machines and on the [modelling] software vendor's machines, but when we sent them to the cloud machines, they would not run to completion consistently and experienced frequent system crashes," says Nathan Hardiman, assistant vice-president, asset liability management for Lincoln Financial Group.

London-based PensionsFirst considered cloud for its PFaroe system for defined benefit scheme risk measurement and management, but was not convinced and instead chose a more conventional proprietary data centre set-up developed in conjunction with computer vendor Dell.

PensionsFirst is not alone. A survey in December 2010 of 100 mid-sized UK firms, including 27 financial services companies, revealed that while more than 40% of chief financial officers understood the potential benefits of cloud computing, over half of all respondents had concerns about the security of sensitive customer and commercial data in outsourcing IT to a third party, while more than 60% feared a loss of control over their data. (The survey was commissioned by software and cloud services provider SunGard.)

Meanwhile, regulators have begun to express concerns about cloud computing as well - and not only in terms of the future plans of financial firms, but about the cloud computing they already use, whether they acknowledge it as such or not. A number of widely-used online consumer and business applications, such as email, instant messaging, calendar scheduling, work collaboration and customer relationship management (CRM) provided by companies such as Microsoft, Google and salesforce.com are cloud-based.

Many financial services companies use these applications - for instance, Allianz, Aon and Standard Life are among the insurers that use salesforce.com's cloud-based CRM application.

Regulatory concern over the use of cloud computing was most clearly articulated in November 2010 by the Australian Prudential Regulatory Authority (Apra) when it wrote to all its general and life insurers and banks warning them of the dangers of using cloud-based applications.

In its letter, Apra noted that although the use of cloud computing is not yet widespread in the financial services industry, a number of institutions under its regulation were considering, or already using, cloud computing-based applications.
"While these applications [such as email, instant messaging, scheduling, collaboration and customer relationship management] may seem innocuous, the reality is that they may form an integral part of an institution's core business processes, including both approval and decision-making, and can be material and critical to the ongoing operations of the institution," stated Apra in its letter.

"Apra has noted that its regulated institutions do not always recognise the significance of cloud computing initiatives and fail to acknowledge the outsourcing and/or offshoring elements in them. As a consequence, the initiatives are not being subjected to the usual rigour of existing outsourcing and risk management frameworks, and the board and senior management are not fully informed and engaged."

Apra warned insurers that it would treat cloud computing arrangements as outsourcing and offshoring, and said its key prudential concerns would be the potential compromise of a financial institution's ability to continue operations and meet core obligations following a loss of cloud computing services, confidentiality and integrity of sensitive data including customer information, and compliance with legislative and prudential requirements.

However, while life and pension companies are naturally concerned about business continuity, data security and regulatory compliance, they also have to weigh business considerations as well, such as how to provide attractive low-cost products and services for customers while remaining competitive. Furthermore, because providing financial services of almost any kind these days is heavily technology-dependent, most of the issues - business continuity, security, compliance and competitiveness - eventually come down to IT. And for a growing number of people in financial services, the best way to deliver at least some aspects of IT is via cloud.

Business continuity

"The technology challenges facing firms in the financial services sector is growing at a tremendous rate, so much so that chief information officers should look beyond their own enterprise in order to be able to deliver their growing book of work," says Sean Kelley, chief information officer of Deutsche Asset Management and head of Deutsche Bank's platform services group.

Deutsche Bank is one of a number of organisations that have come together under the auspices of New Jersey-based TM Forum, an IT industry standards association, to create the Enterprise Cloud Leadership Council (ECLC). The aim, says Kelley, chair of the ECLC, is to bring business enterprises together to clarify their requirements in terms of cloud computing, not only technically, but operationally and commercially as well, so that the technology providers can work towards meeting them.

"The objective is to direct cloud providers, who started out in the consumer marketplace, to approach the enterprise market whose requirements are very different," he says.

Meanwhile, a second initiative, the Open Data Centre Alliance, has been established "dedicated to defining future data centre and cloud usage models in an open, industry-standard and multi-vendor fashion".

Whereas the ECLC includes vendors of various technology elements of cloud, the Open Data Centre Alliance is an independent user consortium. Deutsche Bank also sits on its steering committee, along with China Life Insurance Company, JP Morgan Chase, National Australia Bank and UBS, while Axa Technology Services (which provides technology to Axa's insurance business) and American Family Mutual Insurance are among its members.

Although China Life, Axa Technology Services and American Family Mutual Insurance declined to comment for this article, these insurers clearly see the potential of cloud computing and are willing to invest in making it a more viable option for their businesses.

Two of the main attractions of cloud computing for financial services firms are cost and flexibility. Until now, internal IT departments have provided technology infrastructure, various degrees of software development and integration and operation of third-party software. However, "all too often the approach has been monopolistic in nature compared with commercial practices that exist outside the corporate wall", says Kelley. Cloud computing would give business units more choice in where they source their computing infrastructure, introducing competition and potentially lowering costs and improving service.

Meanwhile, one of the most compelling reasons for moving to cloud computing is the potential for reducing time to market for products and services - a major issue in today's highly competitive financial services markets. New business concepts inevitably require technology support, but it can take months with traditional IT to convert a concept into a production system. "Today, internal IT groups can take as much as 120 days to provision hardware, software and other facilities before a developer even starts to work," says Kelley.

By using cloud to provide facilities for development and testing, Deutsche Bank will be able to cut this time dramatically. "In some cases we've been able to reduce it to ten minutes," says Kelley. Nick Holdsworth, executive general manager, service support, enterprise services, Commonwealth Bank of Australia (CBA), which is also a member of the ECLC, agrees that reducing time to market is an area where the promise of cloud computing is already demonstrably true. "We have [cloud-based] infrastructure that we can start up in a matter of minutes, rather than months," he says.

To help clarify the discussion on cloud computing, the ECLC has adopted a set of definitions originally set out by the US National Institute of Standards and Technology, which divides clouds into four types - private (operated for a single organisation), community (shared by several organisations), public (open to all) and hybrid (any combination of the others).

It has also adopted three service models – infrastructure as a service (processing, storage and other fundamental computing resources provided as a service), platform as a service (specific configurations of computing resources on which to run applications provided as a service), and software as a service (applications provided as a service).

Peak volumes

Under these definitions, Deutsche Bank and CBA already have some private cloud infrastructure in place. Allianz Managed Operations and Services (Amos), the IT, operations and services subsidiary of major German insurer Allianz, is also moving in this direction.

Amos already operates one of the biggest data centres in Europe, with seven mainframes and more than 6,000 servers. However, even this massive facility is stretched at peak times, and Amos recognises that cloud technology could provide a solution. "An internal IT provider has to ensure the needed capacity is in place, especially when processing peak volumes, for example, during end-of-year business," says Martin Elspermann, head of IT infrastructure operation at Amos. "Here cloud computing models can be useful."

By offloading some of the processing volume to an external cloud service, a company can avoid having to invest in the IT infrastructure that would be required to provide internal capacity reserves, he says. Meanwhile, Amos already has initiatives under way to create an internal private cloud environment.

A key concept of cloud computing is ‘virtualisation', where computers and storage facilities are no longer treated as separate individual devices, but networked and viewed as a single virtual computer. Tasks are then distributed across the virtual computer, or cloud, using whatever processing or storage resources they require.
Among the advantages of this approach is that tasks do not have to be assigned to particular machines. It is also possible to use the collective facilities more efficiently than if they were separate machines running specific applications, and the overall capabilities of the cloud can be easily and cost-effectively scaled up by simply adding more low-cost machines.

Amos is currently creating a virtualised layer of computing resources encompassing all its server platforms. With this it will be able to offer infrastructure as a service to all Allianz operating units. "By providing infrastructure as a shared service, Amos can make use of its economies of scale and offer lower and predictable IT costs to all units," says Elspermann. This is also the first step towards being able to offer applications as a service - where Amos will run the actual applications for the business entities rather than just providing computing facilities.

Amos, CBA and others are focusing on internal private clouds for the moment partly for the immediate benefits that virtualisation brings, but also to learn about the issues that arise with clouds and in preparation for the use of external clouds.
"Virtualisation is about getting better utilisation out of our infrastructure, but it is also about trying to make some of our applications more portable for the future," says Holdsworth. CBA has already adapted some of its computing workloads to make them more portable – able to run on alternative IT infrastructure - and defined the type of cloud services it would want to rent to operate the workloads on.

For the moment, the workloads are those that don't require high degrees of guaranteed service, such as software development and testing. "However, there are also workloads that we wouldn't even contemplate at this stage putting into a cloud infrastructure that ran outside of our data centres because there are a lot of questions around security, service levels and legal and regulatory issues," he says.
It is to help drive the resolution of these sorts of issues for large enterprises such as banks and insurers that CBA joined the ECLC. "A lot of [IT providers] talk about what they could do with cloud, but not many are actually doing it in an industrial strength manner," he says. Meanwhile, some solutions are beginning to appear.

"We've been working very closely with our IT security group and we've found that the cloud done correctly can provide an even higher degree of security out of necessity than we have in some situations in our internal environment," says Kelley of Deutsche Bank. Where a bank might not encrypt or only encrypt to a low level when data remains within the institution's firewall, it can raise the level of encryption when moving data into a cloud.

These sorts of examples and the standards and technologies being developed under the auspices of the ECLC and the Open Data Centre Alliance might begin to reassure regulators such as Apra. Meanwhile, some in the industry see in cloud the potential for new lines of business.

For providers of financial services such as insurance and pensions, customer trust - which in IT terms translates into data security and privacy - is the cornerstone of successful business, says Elspermann of Amos. "Combining the internal private cloud with our market standing as the trusted financial services company, our mid-term strategy could lead to a hybrid cloud, meaning spare capacities in the cloud could also be offered to non-Allianz companies," he says.

A growing number of people in financial services and other industries believe that cloud is a paradigm shift in computing on a par with the development of mainframes, personal computing and the internet. "We will look back on this time as a watershed for the industry," says Holdsworth. "Because of its cost and time to market, IT has always been something of a constraint on business." Cloud computing will make organisations more agile and responsive to their markets, he says.

Meanwhile, even those that have rejected cloud computing so far remain open to its potential. Lincoln's Hardiman says: "Our [cloud] vendor experience was fairly limited, so we can't speculate on how widespread or pervasive the issues may have been."

The problems Lincoln experienced were more likely to have been the teething troubles of a new technology rather than a fatal flaw. "I expect cloud computing to be more viable over time. We will continue to consider those options that may facilitate a faster, more efficient modelling process in the future," he says.