Treasury Warns on Cloud Adoption Challenges for Financial Sector

A recent report from the Treasury Department finds that while cloud services come with a number of benefits, there are also some challenges that come with adopting the technology – particularly in the financial sector.

The agency issued the report earlier this year, analyzing both the potential benefits and challenges associated with the increasing trend of financial sector firms adopting cloud services.

At an Atlantic Council event on July 17, Todd Conklin, deputy assistant secretary at the Department of Treasury’s Office of Cybersecurity and Critical Infrastructure Protection, elaborated on some of those challenges.

“Cloud is no longer an emerging technology with the financial sector for software as a service,” Conklin said. “Nearly every single financial institution, whether it be small or large, is leveraging cloud for multiple elements of software as a service applications.”

However, Conklin noted that many smaller organizations have had to move to the cloud “before they were even ready.” Additionally, he said, the availability of technological talent is a big struggle for these smaller organizations.

“The point that we wanted to pivot to in our next steps is how do we then rethink the shared responsibility model, knowing that there’s not a widespread availability of cybersecurity talent – let alone cloud-specific cybersecurity talent especially for our smallest institutions,” Conklin said.

“How do we make sure that we’re leveraging the public-private partnership and engagement with cloud providers, not just to drive more transparency on their back ends, but to get them to kind of recalibrate their shared responsibility model,” he added.

The report explains that public cloud offerings are deployed using a shared responsibility model, which means that both the financial institutions and cloud service providers are responsible for monitoring and securing the cloud environment.

In response to the report and to help close the gaps identified in it – such as addressing gaps in human capital – the Treasury Department’s Financial and Banking Information Infrastructure Committee (FBIIC) has launched a series of next steps and set up a cloud executive steering group.

“We want to make sure there’s a partnership,” Conklin said. “We’re not approaching this as beating the cloud providers over the head. It’s: okay, the landscape has really shifted over the last few years. Let’s make sure we’re recalibrating, not accusing one over the other.”