Companies have enough challenges when it comes to protecting sensitive data on their own premises. But they also suffer the consequences when a breach occurs at a third party that has access to that data. 

More companies are turning to cloud computing services to help cut costs. However, that also means businesses are opening themselves up to new IT security risks if that requires them to transfer sensitive data over to another business.

Data breaches can be costly, even when a third-party organization is to blame. However, many companies aren’t doing enough to make sure the providers they do business with are taking proper care of their information.

Even though security experts warn companies about the dangers third parties can pose to their data, only 54% of IT professionals say their organization conducts an assessment of providers’ security practices before sharing confidential information, according to a recent report from the Ponemon Institute.

Another 21% weren’t sure how their company vetted the security of third parties, while 25% said there are no procedures in place.

Those organizations can probably learn some lessons from these recent IT security breaches that were blamed on third-party business partners:

1. Google’s power and cooling system

Fortunately for everyone involved, a recent attack targeting Google was meant to showcase a security vulnerability, rather than cause actual damage.

Security firm Cylance gained control of the industrial control system used in one of Google’s offices in Australia. While it wasn’t reported what exactly the security researchers had access to, but the company did reveal the attackers would have been able to change the temperature in the building or turn off the air conditioning.

The attacked exploited a vulnerability in the control system that was patched by the developer — however, the company Google contracted with to install and manage the system never applied the update.

The lesson, according to observers: Don’t trust that third parties are applying critical security to the applications they use. Find out what a provider’s patch policies and procedures are and make sure the contract requires those basic security practices.

2. Bank of America

Earlier this year, a hacktivist group targeted Bank of America in an incident the hackers claimed gave them access to sensitive data regarding the bank’s employees and executives.

However, that information wasn’t taken from Bank of America’s own networks — the hackers said it came from a server in Tel Aviv, Israel that belonged to ClearForest, a third party service provider that performs businesses and data analytics.

The group claims it has 14 GB of data belonging to the bank — as well as Thompson Reuters, Bloomberg, and other organizations that had contracted with ClearForest. Bank of America confirmed that a third-party security lapse was to blame for incident, but didn’t identify which company was breached or how the attack occurred.

3. Epsilon

In 2011, a big data breach occurred at email marketing firm Epsilon. Compromised info was limited to customer names and email addresses, PC World reported, but experts warned that information would likely be used by the attackers to conduct targeted phishing attacks against individuals and businesses.

A reported 38 Epsilon clients had to notify customers that their data was compromised. Exactly how many addresses were stolen is unknown, but there were likely a lot there for the taking — Epsilon  sends more than 40 billion e-mails a year and manages customer databases from 2500 clients.

What companies can do

Here are some ways companies can avoid being affected by third-party data breaches, according to Darkreading.com:

1. Conduct a risk assessment and annual reviews – Depending on the industry and the type of data being stored by the third party, security audits and testing may be required by law. But even if they’re not, it should be done anyway. And don’t just rely on general statements from auditors and the vendor’s employees — make sure you get the technical details from actual penetration tests.
2. Check what data’s being sent – One way to minimize the risk of losing data on account of a breach at a third-party vendor: Minimize the amount of data that’s held by the vendor. That means actually looking at what’s being transmitted to make sure only the necessary info is sent to the other company’s network.
3. Assess transport and storage mechanisms – Look for specific details, such as how data is encrypted when it’s sent to or stored on the vendor’s servers, to see if everything complies with regulatory requirements and your company’s policies — and periodically run assessments to make sure nothing’s changed.
4. Make sure an incident response plan is in place – Of course you hope that the plan will never have to be used, but your company and the vendor must know what to do in case data is compromised.

The post Protect your data: Lessons from 3 recent third-party breaches appeared first on Finance Tech News.

Often, organizations run into hidden costs and other problems that can raise the price of cloud computing services and diminish performance. For example, among 650 IT pros surveyed by KPMG International:

1. 31% said integrating cloud services with existing architecture was difficult
2. 30% said avoiding data loss and protecting privacy was a challenge
3. 30% were concerned about losing control over their IT infrastructure, and
4. 26% said there is a lack of standards and interoperability between cloud computing providers.

Overall, one-third of companies said they ended up spending more on cloud computing services than they had planned.

Many organizations turn to cloud computing to help them control their costs. But how can companies control the costs of cloud computing services? Here are some key steps organizations should take:

1. Consider costs versus business needs

Representatives from video streaming and rental company Netflix offered some advice based on their company’s experiences at the recent Cloud Connect 2013 conference. One important step: Know what you need first.

Companies have a lot of options when it comes to cloud services — and those options vary a lot in terms of price and performance. That’s why businesses must assess their needs before they choose a cloud service.

For example, when data and applications are hosted in the cloud, it can introduce a certain amount of latency. It’s possible businesses can spend more in order to reduce that latency — therefore, companies must accurately determine their needs so they can avoid spending more than is necessary or having a service that isn’t powerful enough.

2. Anticipate outages

While many companies are worried about the security of the data that is held in the cloud, many experts warn that the biggest risk of cloud computing is that cloud services may go down more than in-house applications. That doesn’t necessarily mean businesses should avoid cloud computing — but it does mean that they should have a plan in place for those outages, Netflix says.

One step Netflix has taken is to avoid having all of its cloud services hosted in the same geographic region. Companies should also find out what steps their cloud computing vendors offer to keep services up and running and inquire about additional options to add redundancy and other precautions.

3. Consolidate accounts

Cloud computing allows different departments to purchase their own services to meet their own needs — but that may not be the best thing for the company’s overall cloud computing costs. Some cloud vendors will offer discounts if services are bundled together, which organizations might miss if the purchases are made separately.

In addition, cloud computing accounts should be centrally managed in order to avoid security and performance problems — for example, the IT department must make sure a cloud services meets the company’s security needs.

4. Negotiate for a better deal

While companies often find that cloud services are a better deal than another option, that doesn’t mean they’re getting the best possible deal from their cloud vendors. A study conducted last year found that cloud computing contracts typically favor vendors, and customers don’t do enough negotiating.

As more cloud vendors pop up, companies can leverage that competition to bargain for lower costs, as well as additional perks such as better performance guarantees or enhanced security protection.

5. Decide what to put in the cloud

One key companies must keep in mind when developing a cloud computing strategy: Some functions are better served by in-house applications, due to security or reliability concerns, performance requirements or other factors.

Therefore, companies must decide what they should and shouldn’t put in the cloud.

What applications belong in the cloud? While each organization will come up with its own answers. these were the top cloud computing services respondents to a CDW survey said they have adopted or are planning to adopt:

1. Conferencing and collaboration (cited by 68% of organizations)
2. Storage (65%)
3. Office and productivity suites (65%)
4. Messaging (62%)
5. Compute power (59%)
6. Business process applications (57%)
7. External hosting for internally developed applications (55%), and
8. IT governance applications (51%).

The post 5 ways to control cloud computing costs appeared first on Finance Tech News.

When adding up the costs of a data breach, it doesn’t matter much which company’s “fault” the incident was. While some service providers assess penalties for security issues, the company could still be subject to costly legal action, a diminished reputation and whatever damage is done with the stolen information.

That’s the lesson Bank of America learned recently after an attack from the hacktivist group Anonymous.

The group claims it has 14 GB of data belonging to the bank — as well as Thompson Reuters, Bloomberg and a service provider called TEKsystems — that hackers stole from an unsecured server in Tel Aviv. Based on emails included in the stolen data, the group has surmised that Bank of America had contracted with TEKsystems.

The bank didn’t confirm that — but officials did say the data breach was the fault of third party and that it’s own network was never compromised.

Protect data from third-party breaches

Regardless of where a breach takes place, companies need to protect their data. And checking on the security of third parties is becoming even more critical as cloud computing becomes more common.

As more organizations turn to cloud services, more data is being held outside of the in-house network and on the networks of third parties.

To protect that data, here are some of the key security-related questions IT pros or others should ask cloud computing vendors before signing up for a service:

1. What are the policies and procedures in place to protect the physical data center, including the process for vetting employees who have access to clients’ data?
2. What’s the vendor’s privacy policy? Which employees have privileges to access sensitive customer data? What controls are in place to keep clients’ data safe from internal violations of the company’s privacy policy?
3. What technology is used to keep one client’s data separate from others’ on multi-tenant servers?
4. What encryption protocols does the vendor use to protect data in transit and at rest?
5. What authentication protocols does the vendor use to prevent access by unauthorized users?
6. Does the vendor properly handle data to comply with government regulations concerning privacy and security that your company must follow?
7. What are the vendor’s own audit procedures? Is it possible for you to audit them?

The post Protect against costly third-party data breaches: Key questions appeared first on Finance Tech News.

IT investments improve organizations’ agility, performance and ability to create organizational change, according to a recent survey from AT&T and INSEAD.

However, spending more on technology won’t automatically make companies more profitable — businesses must spend that money wisely. These were the IT investments that had the biggest positive impact on companies’ bottom lines, according to the report:

Mobile technology

In two years, 24% of all IT spending will go toward mobility, compared to 17% today, according to the 225 IT leaders surveyed.

But investing more in mobility didn’t necessary raise organizations’ performance. One key to making smart mobile investments: Align IT’s requirements with the needs of the business.

Among companies that invest in mobile technology, 52% of those that do with a lot of input from the business side rated highly in the report’s performance rankings, versus just 25% of those that don’t.

Of course, the study comes from mobile service provider AT&T so take this point with a grain of salt — however, the findings concur with those from another recent study, conducted by Avanade, which found that a greater use of mobile devices for work increases productivity, employee morale and overall profitability.

Cloud computing

Two years from now, 26% of IT investments will be spent on cloud computing services, compared to 17% today. And those investments can help companies cut costs, as well as become more flexible and able to more quickly adopt new platforms.

However, not every company using the cloud is seeing a great benefit. The key to success: IT talent with skills and experience using the cloud.

Among the businesses that invest heavily in cloud computing, 72% of those who said they have strong technical talent are considered “competitively agile,” compared to 42% of those without that talent.

Collaboration tools

Business will put 20% of IT budget toward technologies that foster collaboration, compared to 17% today. And those that invest highly in this technology are more likely than other businesses to perform better and become more agile.

However, as with mobile technology and cloud computing, businesses must make investments with strong input from the business side, as well as have an IT staff with the right skills to support the technology.

The post 3 IT investments that offer the biggest boost to the bottom line appeared first on Finance Tech News.

Overall, the IT job market is favorable for job seekers. But the field is constantly changing. Here are two sets of IT skills that will put techies in demand now and in the future:

Cloud computing and big data.

As IT’s role changes in many organizations, those are two of the IT skills experiencing the biggest growth in demand. For example, there are approximately 3,800 jobs requiring Cloud computing skills currently listed on IT job board Dice.com. That’s an increase of 72% compared to last year, the site reports. In comparison, IT job listings on Dice have increased by 4% since 2011.

Demand for Cloud computing professionals will only rise as more organizations invest in cloud services. And that demand is driving up salaries for folks with those IT skills. While IT salaries are rising in general, it’s especially the case for Cloud professionals. They’ll earn an average of $92,830 per year, compared to the median IT salary of $81,830, Dice says.

What jobs are available right now for pros possessing IT skills related to cloud computing? According to Dice, the top 10 Cloud computing jobs companies are trying to fill are:

1. Cloud Architect
2. Cloud Software Engineer
3. Cloud Sales Executive
4. Cloud Engineer
5. Cloud Developer
6. Cloud Systems Administrator
7. Cloud Consultant
8. Cloud Systems Engineer
9. Cloud Network Engineer
10. Cloud Product Manager

However, it isn’t just those jobs that require cloud computing IT skills, according to Dice. Many of the more traditional enterprise IT positions, such as project managers or network architects, are requiring cloud skills and experience as more organizations turn to the Cloud for their IT needs.

In addition to specific experience with the Cloud, cloud computing environments require IT pros skilled across many areas of IT, such as networking, servers, software and security, rather than just one specific niche.

For IT pros wanting to take advantage of the demand for cloud experience, experts recommend looking for chances in their current roles to cross train to learn cloud skills. With cloud computing’s popularity, it’s likely that there’s a chance to work on deploying or a managing a cloud service at many organizations.

Also, new IT certifications related to cloud computing have begun to launch, includingComTIA’s Cloud Essentials and Cloud Security Alliance’s Certificate of Cloud Security Knowledge (CCSK). While those are both fairly basic, they’ll likely be prerequisites for more advanced cloud computing certifications that become available in the future.

IT skills needed for Big Data, too

Another tech seeing big growth and an increased demand for IT skills is Big Data. And much like cloud computing, the demand for IT pros has outpaced the rate at which people have begun to gain skills and experience in the area.

And as Big Data becomes more critical for organizations, those that do have those IT skills will be in a good position. In fact, a recent report from consulting firm McKinsey and Company claims that by 2018, U.S. companies will face a shortage of 1.6 million analysts who can make decisions using Big Data, and between 140,000 and 190,000 IT staffers skilled in data processing technology.

As with cloud computing, new academic programs have started appearing to train IT pros in the Big Data field, including New York University’s Master of Science in Business Analytics and similar programs at the McCombs School of Business at the University of Texas and Michigan State University.

The post IT skills that could cost you more, lots more appeared first on Finance Tech News.

For the very few folks in America who live in a state that doesn’t charge sales tax, traveling to the rest of the country can be something of an adjustment. With nearly every purchase, the final tally is a mystery until the sales clerk adds sales tax to the bill. Only then does this out-of-state consumer suffer post traumatic sticker shock. The same can be said of organizations that use Cloud services. Depending on the state or country where these services are actually located or the state where they’re used, the purchaser and the provider may owe the local authorities revenue from service purchases or transactions. If this doesn’t sound complicated, you’re not paying attention.

The tax implications of Cloud services can dramatically impact not just what you owe for them. They’ve got a lot to do with the choice of vendor (and how the state where they operate treats this kind of business) and it will have a lot to do with the transactions you make using the cloud. Whether or not you’re using offshore Cloud providers could also  raise the eyebrows and maybe even the ire of the tax man.

Cloud services bring a mind-boggling array of tax considerations to any organization that uses or provides them, make no mistake. Among the tax issues that could arise:
• An uncertainty about the tax implications. Many CIOs neglect to investigate the tax burden involved in a Cloud commitment. It’s only after the fact that finance digs into the impact.
• Additional scrutiny from Tax authorities. The folks who oversee state coffers, especially in states that are facing big deficits, who are becoming a lot more interested in the tax implications of the move from traditional IT service
provisioning and money they could be missing out on in this transition.

What can finance do? The first action should be to ensure that your tax experts are part of any discussions about moving services or data to the Cloud.

Much of your tax burden associated with Cloud spending and usage will depend on the service model you choose. There are three basic models:

1. Software as a Service (SaaS) — the software your organization uses is provided via the Cloud. This could be a B2B software, such as office productivity applications or accounting programs. But it could also be a B2C app, such as a game or other computer software you offer players online .
2. Platform as a Service (PaaS) — the Cloud provider hosts your business’ software on their hardware, and
3. Infrastructure as a Service (IaaS) — the servers of the Cloud provider host your data for remote storage and retrieval.

Your tax liability under each service model will be different . How you pay for your cloud services — by subscription, metering or a reserved capacity agreement — will also determine what taxes you’ll owe.

The thing that makes all this even more complex is that the tax rules that apply to all these models are changing as rapidly as Cloud technology is emerging and the use of Cloud services is exploding.

Gartner analysts believe U.S. spending on this variety of services will top $116 billion in the next six years, so it’s no surprise that state and local governments will want a taste of the action.

Finance needs to make sure it’s ahead of this very learning steep curve in technology provisioning.

There are dangers and benefits to these emerging tax rules. If you consider the fact that revenues can be earned remotely and that tax authorities don’t want to miss any possible sources of revenue, it will be important that finance have an up-to-date and clear picture of the transactions that take place in the Cloud. This will include your IP, infrastructure and the personnel that support the business.

The accounting pros at KPMG are providing an in-depth look at cloud tax issues, both the challenges and potential benefits of Cloud usage, in a free briefing paper.  It’s a good place to get an overall picture of Cloud taxing and a good source for starting a conversation with your tax experts and your CIO.

The post Unraveling complex Cloud tax issues appeared first on Finance Tech News.

In the traditional computing environment, IT provisioning usually had to be done by dedicated technical staff. Someone had to purchase and implement hardware, install software, configure systems, etc.

But with cloud computing services, anyone in the company can sign up, since all of the technical aspects are handled by the vendor.

Due to how easy it is to sign up for services — and how little many companies actually manage cloud provisioning — a significant chunk of the average company’s IT budget is now spent on items that the IT department has no knowledge about, according to a recent report from PricewaterhouseCoopers (PwC).

The consulting group estimates that between 15% and 30% of companies’ IT spending is now going toward so-called “shadow IT” outside the knowledge and control of the IT department.

That can cause a number of problems for companies. Organizations may be spending more than they need to, because IT may be able to purchase service for less money when everything is done through a central channel. For example, several departments might sign up for cloud storage services on their own, instead of getting a discount for one large order.

When departments sign up for IT services on their own, they may also put company data at risk. IT pros know what to look for in a cloud computing vendor, and people from other departments may not.

What should companies do about it? The key to avoid problems is strong communication between IT, Finance and other departments. If business units are signing up for services without IT’s knowledge, it may be the case that something is wrong with the normal process for getting those projects approved.

Companies should figure out why departments avoid going through IT, and make necessary changes.

The post Up to 30% of IT budget is unapproved, report says appeared first on Finance Tech News.

A recent Ponemon study found that 69% of Cloud providers believe the ultimate responsibility for securing customers’ data rests with the customer. While you may be depending on the vendor’s tools and structure to secure your data, if the compliance cops come to call, it will behoove you to be able to prove you’ve done all you can to ensure that the vendor’s tactics offer a reasonable and acceptable standard of care.

To do that, it’s a good idea to ask for and review the vendor’s corporate security documents. Here you’ll likely be able to find the details of how your assets will be protected.

For a good list of the security features that are crucial and should be in use by a high-quality Cloud vendor, check out this list .

The post Making sure finance data’s safe in the Cloud appeared first on Finance Tech News.

As businesses and ordinary computer users move more rapidly to implement Cloud computing strategies and equip themselves with more powerful and useful mobile tech, spending on IT is expected to rise by a robust 3%.

The pros at Gartner say IT spending should hit $3.6 trillion in 2012. It was $3.5 trillion in 2011.

Spending on public Cloud services is predicted to rise by 20% (up to $109 billion, from $91 billion in 2011). But it’s telecommunications services that will get the lion’s share of spending. Gartner is estimating that companies will put out $1.69 trillion on units and services this year. That’s only an increase of 1.4% over last year, but greater demand for tablets and smartphones will contribute to more spending that will be offset by lower fees for mobile services.

There’s also an increased demand from countries that have been slow to adopt IT services in the past.

Although Gartner is upping its forecast for spending, analysts continue to temper their predictions with caution.

“While the challenges facing global economic growth persist — the eurozone crisis, weaker U.S. recovery, a slowdown in China — the outlook has at least stabilized,” said Richard Gordon, research vice president at Gartner. “There has been little change in either business confidence or consumer sentiment in the past quarter, so the short-term outlook is for continued caution in IT spending.”

The post IT spending exceeding expectations appeared first on Finance Tech News.

Who’s delivering this early eulogy? That would be Forrester CEO George Colony, who spoke to an assembled group in Paris recently and ended his remarks by pronouncing that Facebook is “toast” and Cloud technology isn’t positioned to take advantage of the real transformative movement in tech: Mobility.

And it’s mobility that Colony believes will change the way everyone does everything when it comes to tech.

Mobile engagement, built on architectural change brought about by the app, will replace the broader web as the focus of innovation and change, Colony explained to the crowd gathered in the French capital for Forrester’s analyst forum this month.

Colony maintains that the old PC model is antiquated and that Cloud computing’s fatal flaw is that it  ”doesn’t leverage power in your pocket.” Future architecture will marry powerful data capabilities, held in the Cloud, with powerful apps on personal devices, he predicts.

He also forecasts that it will be Apple and Google who dominate the future of computing (likely because of their agile development of mobile devices). Microsoft’s late to the game and its success likely hinges on how Windows 8 fares with users and business alike.

For now, the flop that Facebook is facing over its much ballyhooed IPO give some credence to Colony’s claims. While many may be scratching their heads in wonder that the little social network that could is something of a laughing stock to many who took a pass on investing in it, there’s a fundamental lesson here that most finance folks probably recognize.

Having millions — or nearly a billion — fans or users is a remarkable thing, but unless you’ve got something they want that you can charge them folding money for, you will not have a business success.

The essential appeal of Facebook is that it connects humans to each other. And it does that for free. Facebook has never fully understood the secret of its own success and therefore has never been able to successfully exploit it.

The success of an online business depends on this simple principle and plenty of technology fans get distracted from the basics when confronted with mind-numbing tech details.

But investors and company folks who leverage tech everyday to create business success need to keep it top of mind.

When the tech bubble of the 90s burst, lessons on this simple principle were learned and it seems, quickly forgotten. Remedial studies may be required.

The post Facebook and the Cloud are dead, who killed them? appeared first on Finance Tech News.