When Is Processing Payments in The Cloud More Secure?
Back when I started my career, “Jessie’s Girl” by Australian rocker Rick Springfield topped the charts, the federal funds rate was 20 percent and most organizations were reliant upon one or more mainframe computers that were hosted in an internal “computer room.”
Payment systems migrate to the cloud
Today, the four largest banks in the U.S. process their payments in the cloud (i.e. remote data centers that are accessed via a private network and/or the Internet). These institutions have opted to use “private clouds” owned by cloud partners where client data is kept strictly partitioned, versus a “public cloud,” which offers users a shared infrastructure.
And these large banks are not alone.
According to a recent survey, 44 percent fewer companies use in-house software for online payments compared to just two years ago and instead rely on a vendor’s payment software.
Source: Wiese Research survey and Ovum’s Global Payments Insights
In addition, 54 percent of organizations said that they plan to move more of their payment infrastructure to the cloud in the near future. For example, Bank of America recently announced plans to move 80 percent of its technology workloads to the cloud in the next few years. Why are many industry leaders moving their payment infrastructures to the cloud? The key drivers are lowering costs, improving speed to market and catching up with customer demand for new products and services.
Security in the cloud vs in-house data centers
The rapid growth of cloud computing has also been driven by the rock-solid level of security available in the cloud. In fact, according to a 2017 report on cloud security, “on-premise IT infrastructure is more likely to be attacked, more often, and through a broader spectrum of attack vectors than cloud-based infrastructures, countering security concerns about the cloud.”
How does the security of cloud service providers compare with that of in-house data centers? It depends on the type of security being used. A cloud vendor that employs the following 10 cybersecurity practices are well positioned to deliver better security than in-house data centers.
1. The Network Effect: The network effect states that the value of a network increases with the number of users. In the case of cloud security, providers are better able to leverage their security investment and visibility across thousands of clients, compared to an organization processing in-house.
- Identify fraudulent transactions and breaches more quickly
- Combine security investment of thousands of clients to build and run a highly secure software platform used by all
- Participate in InfraGard, a public-private partnership between the FBI and U.S. businesses, dedicated to sharing information and intelligence to protect critical infrastructure
- Coordinate with Financial Services – Information Sharing and Analysis Center, the global financial industry's resource for cyber and physical threat intelligence analysis and sharing
2. Experience: Cloud software providers can offer a depth of knowledge and experience unmatched by individual institutions.
- They have more years of experience in developing and operating bill payment software compared with individual organizations
- The same company that built the software runs the software
- Software developers and data center operators collaborate
3. Certifications: Look for a provider that is certified to offer the best practices in security.
4. People: The provider’s leadership team and employees should be focused on security.
- A Board of Directors with a risk committee
- Chief Risk Officer operating autonomously from all other groups
- Annual security training for all employees
5. Policies: Make sure your provider’s security infrastructure is designed around standards.
Implements ISO 27001/27002 and National Institute of Standards and Technology (NIST) Cybersecurity frameworks
- Standardizes information access, retention and destruction
- Utilizes an inventory system for hardware and software
- Performs vulnerability scanning and penetration testing
- Has a pandemic plan for business continuity and disaster recovery plans
6. Software development: The provider uses bullet-proof software and best industry practices.
- Upgrades software to latest version regularly (this was one of the problems that led to a recent high-profile breach)
- Build systems based on the Payment Card Industry Data Security Standard (PCI)
- Scans systems before going live
7. Detection: The provider depends on automated detection and attack response for protection.
- Can identify distributed denial of service (DDoS) attacks, worms, Trojans and port scans
- Finds abnormal activity through modeling
- Relies on Automated attack response
8. Access: The provider carefully controls cloud access.
- Keeps client data separate with private cloud using a partitioned architecture
- Owns and operates its own data centers
- Employs biometric data center access
- Uses role-based access
- Has 24x7 closed-circuit television monitoring
- Uses a secure network for client access
9. Defense-in-depth with a layered security model:The provider erects multiple, overlapping layers of defense.
10. Data: The provider secures critical data.
- Tokenizes sensitive information (i.e. use a “proxy”)
- Encrypts data
- Uses Hardened computers
- Isolates internally with virtual local area networks
Cloud payments simplify compliance
In addition to offering robust security, cloud-based payment systems make compliance easier to achieve for several reasons. First, companies are no longer storing sensitive customer payment data on-premise, which limits the scope of PCI assessments and audits. Second, the provider is able to make the latest investment in compliance infrastructure and spread the cost across multiple clients, while also utilizing the best client practices.
For example, one company reduced call center PCI compliance costs by 80 percent when customers entered their credit card numbers into a cloud-based system rather than speaking card numbers out loud. In another example, customers using a cloud-based bill payment solution were able to realize 19 percent savings on security and compliance costs.
In addition, an experienced cloud payment provider keeps up to date with ongoing changes to regulations – some of those shown below.
Cloud payments improve performance
You can develop and bring new innovative features to market more quickly with the cloud than building it yourself in-house. Organizations often see an improvement in their performance as a result. For example, one of the world’s largest companies improved their collections performance by a factor of five when they made the move from an internal collections website to a cloud system.
With improved performance, lower compliance costs and robust security, I expect that more organizations will follow Bank of America’s example of shifting 80 percent of their technology into the cloud.
How are your peers planning to use the cloud to deliver the payments experiences of the future? Download our free report that explores strategic plans and IT investment trends in payments: www.aciworldwide.com/billpayinsights
Related Blog Posts
Beyond Borders: Navigating the Challenges of eCommerce Expansion
eCommerce continues to flourish, with impressive growth figures year after year. In 2018, global online sales reached almost $3 trillion, and are expected to hit $4 trillion by the end of 2020.
Despite eCommerce taking an increasing slice of the retail pie (which could now be as high as 15 percent according to recent figures), it is increasingly challenging, with competition and cost pressures creating significant issues for merchants of all sizes.
Payments and Fraud: The Paradox Twins
Digital commerce through web and mobile is where merchants predominantly experience shopper growth today. This has become a hugely important domain for their focus. It offers a means for international growth, new market penetration and a way to engage with shopper-hungry Millennials in their culture. Merchants frequently adopt a Digital-First, eCommerce-First or Mobile-First strategy to ensure full corporate buy-in to this strategy.
Open Payments Systems for Merchants: Don't Close Down Your Options
Remember “Open Systems”?
It was a big industry nom du jour in the 80s and 90s. Every IT system had to be open and therefore flexible and future-proof. Nobody can argue with the logic behind this; making systems easy to integrate with other systems, ensuring vendors could cooperate with one another; creating agility to improve time to market and drive down costs.
Knowing New Customers – And How Shared Data Helps in Fighting Fraud
As the eCommerce industry continues its rapid growth, the lines between physical and digital shopping are becoming increasingly blurred. These changes are creating a number of challenges for merchants, not least around customer visibility and fraud prevention.
Why Non-Functional Requirements Should be a Few of Your Favorite Things
It’s not unusual for me to be questioned by retailers as to why some payment solutions are priced differently or more expensively than others – in fact, it would be unusual not to be asked those questions when dealing daily with procurement and finance teams of major multi-national multi-channel merchants!
Adding a Global Payments Layer for Future Growth
Digitization has changed the payments industry completely and irrevocably. Cash payments are in full retreat, as more people pay digitally – with more than 1.6 billion people now shopping online. The digital customer expects an extremely fast and convenient payment experience, with high security standards, and immediate availability of payments information.
Major League Baseball’s Tampa Bay Rays Tell Cash, “You’re Out!”
As a lifelong baseball fan and former resident of Tampa, Florida, I had the pleasure of spending a summer night or three at Tropicana Field, watching my beloved New York Yankees take on the hometown Tampa Bay Rays. And as a fan of cheap tickets, air conditioning in the Florida summer and plenty of great seats, I always enjoyed the “The Trop” despite its poor reputation.
Let’s Get Phygital: eCommerce Is Coming To A Store Near You
While payments vendors continue to pitch and strategize with a focus on omnichannel, the omnichannel story has already moved on.
Make no mistake – omnichannel remains important and the best vendors have solutions that provide a single cloud payments service capable of delivering a single view of the customer across stores and digital channels. And the best retailers utilize these solutions to deliver efficient cross-channel shopping experiences. Meanwhile, many other retailers get by (though seldom rise to the top) with a siloed approach.
Around The World: Taking Stock of Global eCommerce in 2019
As I head to #NRF2019 in New York City next week, I’m excited to see how some of the biggest retailers and merchants see the industry evolving over the coming year. What trends they think are going to shape 2019, and which of 2018’s buzzwords can be put to bed.
Fraudsters Don’t Wait for Peak, So Neither Should You: 2019 Fraud Strategy Starts Now!
In existence for barely two decades, eCommerce has transformed not only the way we shop, but also how retailers plan and execute their marketing strategies around the peak shopping season. Now that we’re deep into this period, retailers will have prepared for changes in buyer behaviors, relaxed their strategies to be within the limits of manageable review rate, and most important of all, put strategies in place for increased fraud attempts.