Financial Sector Turning to Multi-Cloud Strategies

Financial institutions are adopting multi-cloud strategies to reduce reliance on single providers, address rising cyberthreats and meet increasingly complex regulatory requirements, according to a new report.

See Also: OnDemand | Healthcare in The Cloud: Detecting and Overcoming Threats to Ensure Continuity & Compliance

Multi-cloud strategies enhance flexibility and bolster disaster recovery and business continuity for financial institutions, which appear to prioritize operational resiliency more than most sectors, the Cloud Security Alliance said in a Tuesday report.

CSA found that financial institutions are cautiously embracing cloud technologies to tackle emerging regulatory and technological challenges, including new resilience-focused rules taking effect in 2025. Resiliency of third-party cloud services and data protection has become critical for the financial sector and regulators amid growing cyberthreats to the supply chain, said Troy Leach, chief strategy officer at CSA.

“It is important for security and governance professionals to understand the expectations and prepare now for the next generation of regulation and technology complexities,” Leach said in a statement.

Still, three quarters of financial institutions tend to prefer single-cloud environments due to ease of management and cost-effectiveness, according to the report, “although multi-cloud strategies are gaining traction to enhance resilience.” The survey of 872 security practitioners identified misconfiguration and exploitation of serverless and container workloads as significant concerns, with slightly more than one of every five respondents describing true multi-cloud strategies as “expensive and challenging to implement.”

Data privacy and integrity are also a top concern for financial institutions testing and deploying generative artificial intelligence technologies, the report said. The industry association survey found financial institutions remain “more worried” about the misuse of AI for cyberattacks than non-financial institutions.

Financial services have accelerated AI adoption in recent years to reduce costs and enhance efficiency, accuracy and performance, but the Financial Stability Oversight Council warned in its 2023 annual report that rapid deployments could introduce significant cyber and model risks, potentially jeopardizing financial stability. The council also warned that generative AI’s “complicating factors,” such as convincing but flawed outputs, may require specialized expertise to evaluate effectively (see: US Regulators Warn of AI Risk to Financial Systems).

The financial sector faces a critical skills gap, with half of respondents citing insufficient talent as the top threat in the next 24 months. The second and third major threats are inadequate cloud security strategies and poor management of privileged account access, respectively.

CSA said financial institutions “require highly skilled professionals to manage complex security systems and respond to emerging threats.” The report recommends investing in continuous training and development programs to help upskill existing staff, as well as attracting and hiring cybersecurity experts and IT professionals with specialized skills to help improve the organization’s security posture.