EBA欧洲银行-1.-ENISA-Cloud-and-Finance-workshop_15页_1mb

Cloud Computing - Cyber Security Challenges for the Finance Sector Summary

Core Content

This document outlines the challenges and opportunities associated with cloud computing in the finance sector, with a focus on cybersecurity and regulatory compliance. It highlights the role of ENISA (European Union Agency for Cybersecurity) in addressing these challenges through research, recommendations, and collaboration with financial institutions, regulators, and cloud service providers (CSPs).

Main Opportunities of Cloud Computing

• Economies of Scale:

  • More efficient resource utilization
  • Cost savings through better ROI

• Support Innovation:

  • Easier deployment of new services
  • Faster time to market

• High Resiliency:

  • Better backup services
  • Enhanced business continuity

• Standardized Solutions:

  • Improved patch and software update management
  • Portable and interoperable systems

Main Challenges of Cloud Computing

• Isolation Failures:

  • Risk of one customer influencing another’s resources (CPU, Memory)
  • Potential data breaches due to unauthorized access

• Compliance Risks:

  • Lack of sufficient evidence for data protection
  • Difficulty in proving prudent risk management practices

• Loss of Governance:

  • Reduced control over cloud resources
  • Impact on security and compliance

• Vendor Lock-in:

  • Need for an exit strategy
  • Proper data removal from cloud environments

ENISA's Study Objectives

• Identify the status of cloud adoption in the EU and globally
• Identify good practices at both technical and policy levels
• Recommend best practices for banks and regulators
• Propose recommendations to policy makers, banks, and cloud providers

Cloud Adoption - Current Status

• Existing regulations and policies do not fully address cloud cybersecurity
• Challenges with data jurisdiction and protection
• Regulatory authorities lack understanding of cloud-specific cybersecurity issues
• Unclear legal and policy environment hinders cloud deployment
• Many standards exist but are not widely accepted
• Ad-hoc implementations are limited to non-core business areas

Main Challenges to Cloud Computing

• Lack of detailed corporate risk assessments for cloud computing
• Insufficient awareness and knowledge on cloud cybersecurity among financial institutions and regulators

Regulations Impacting Cloud Adoption

• GDPR: Focuses on data protection and privacy
• PSD2: Regulates payment services and customer authentication
• EBA guidelines: Provides regulatory expectations for financial institutions
• EU directives: Addresses cross-border data flows and security

Ensuring Compliance

• Include specific clauses in contracts, such as the right to audit
• Establish clear agreements between financial institutions (FIs), national financial supervision authorities (NFSA), and cloud service providers (CSPs)

Recommendations

• Cooperation between FIs, NFSA, and CSPs:

  • Develop good practices and guidelines for cloud security
  • Harmonize EU-wide legal and regulatory requirements

• Risk Assessment and Cloud Strategy:

  • Financial institutions should conduct detailed risk assessments and develop cloud strategies

• Transparency & Assurance:

  • CSPs must provide evidence of good cybersecurity practices (e.g., incident handling, resilience)

• Awareness Campaigns:

  • Joint efforts to bridge the knowledge gap on cloud cybersecurity among FIs, NFSA, and CSPs

Next Steps

• ENISA will continue to provide expert support to address cloud cybersecurity challenges
• Act as a catalyst for information exchange, cooperation, and discussions between financial institutions, regulators, and CSPs
• Maintain cooperation with regulatory authorities to enhance cloud adoption in the finance sector

Co-operation with Other Initiatives

• SecuRe Pay Working Group:

  • Focus on secure communication, customer authentication, and incident reporting

• Task Force on IT Risk Supervision:

  • Transversal IT risk identification and analysis
  • Guidelines on IT risk assessment
  • Collaboration and training initiatives

Conclusions

• Cloud computing modernizes the financial sector and brings significant business benefits
• Cybersecurity is essential for successful cloud adoption
• Current policies and regulations do not fully address cloud-specific cybersecurity risks
• Policy makers are not fully aware of the major cybersecurity challenges in cloud environments
• There is a need for more focused good practices tailored to the finance sector
• Limited information sharing on major cloud incidents affecting the financial industry

ENISA will continue to work with policy makers (e.g. EBA, NFSA) and the private sector (e.g. banks, cloud providers) to accelerate cloud adoption in the finance sector while ensuring robust cybersecurity.