Darren Turnbull, VP Strategic Solutions at Fortinet looks at how Smart Policies based on user ID or location are the answer to simplifying IT security in an increasingly complicated world
IT security touches every part of our daily lives. All of the data held on computers, mobile devices, local and wide area networks that is being shared on a second-by-second basis; then there’s the billions of secure global financial transactions happening at the same rate, that for most of us, never crosses our minds. In this light, complete protection of this all-encompassing network and the information and transactions transferred across it is essential to a well-oiled, fully functioning financial industry.
In a financial world that demands a secure business-computing environment but insists on ubiquitous connectivity, piecemeal solutions proliferate. However, solving today’s problem in this way will create tomorrow’s nightmare. In today’s world we have created a population of users that expect to gain access across a range of devices and network connections instantly 24/7, 365 days per year. The global financial industry is in a situation where technology shifts, regulatory pressures and changes in user behaviour consistently move the security boundaries. And then there’s remote working, which blurs the line between the workplace and home life with access any time from anywhere being expected. Access to everything, by everyone, from everywhere – securely?
Of course this evolution hasn’t occurred via a series of carefully planned steps, the speed and variety of change has taken many IT managers by surprise. Reacting to these events has created a multitude of solutions to address the emerging, or expected problems. It seems as though every new vulnerability creates an opportunity for a new solution; and every new solution creates an opportunity for a new vulnerability. The result can be chaotic with mis-matched, overlapping technologies, and a raft of hastily assembled rules and policies. All of this created in the hope that each will work together in defence of the network and support the financial organisation expected to fund this effort. It is the very antithesis of ‘holistic’.
Having created such an environment it becomes very difficult to let go. You hope you have tamed the tiger, but there’s a chance it will still bight someone. In other words, you hope you have a solution, and you hope it is secure.
Unfortunately, today’s reality sees network management increasingly struggling to accomplish a truly secure unified access. The escalating number and complexity of security technologies, rules and policies accumulated over time, means financial organisations may struggle to stay abreast of the constantly changing threat landscape. A piecemeal approach is not the way forward because it does not remove previously created policies, risking a complexity that will spiral out of control. It also adds complexity to understanding the increasingly challenging threat landscape, risking at worst irreparable security holes.
So, the answer to complexity is not more complexity; the answer is simplification. But where does any business start in untangling the mess and implementing a logical, manageable, sensible and secure solution to policy accumulation?
Managing a large estate of specialised security devices from many different manufacturers is a sure fire way of multiplying the number of active security policies. In contrast, by deploying a suite of complementary systems from the same vendor reduces operating costs by enabling easier and more responsive management with less policies, higher performance and better overall security. It also enables network access policies to be integrated with all other security policies. A single operating system across devices will obviously be a major benefit to simplifying the management process.
The process of simplifying security policies is challenged by the introduction of application-aware security; a key tenet of next generation firewall technology. So it is important to apply an application-awareness policy to individual user-IDs in one place, and to enforce it throughout the network and across network security functions.
The granularity that arises from running distinct security policies according to each different authentication environment may seem a bonus, however, it can be burdensome to security management. But granularity need not be sacrificed and security management can be simplified by the use of obvious tactics such as Single Sign On (SSO), which conveniently retains context about the user’s location or device.
With this approach to policy enforcement at a unified entry point onto the wired/wireless network, all policies can be determined according to user ID, device type and location.
Runaway policy accumulation will invariably occur where artificial or technology dictated solutions to wired and wireless network access become entirely separated for management purposes. Where both coexist, wireless is typically the more dynamic environment, with similar levels of traffic as wired infrastructure. For easier oversight and simplified monitoring and compliance, a unified wired and wireless policy will ensure simplicity, while still offering both visibility and control. This can be achieved using security appliances such as Fortinet’s FortiGate range, which offers switching and access point management functionality and integrated advanced firewall protection, VPN connectivity, endpoint and application control, web filtering, antimalware and data loss prevention.
Ultimately, we need to make smart, simple policies and reduce the decision making process – highly important in financial institutions where security is not only of utmost importance, it is expected by end users. Of course you still have a policy set to be concerned about – but it is much easier to handle. Don’t press on with a flawed strategy and an increasingly disparate security infrastructure loosely controlled by myriad of policies – many of which may contradict each other. Untangle the solution and simplify it. Don’t let your policy accumulation and complexity creep become a part of the problem. Tame your tiger!
Fortinet has a white paper resource for security administrators to easily and seamlessly implement ID-based ‘smart policies’ across their wired and wireless network infrastructures. Entitled “Making Smart Policies with FortiOS 5”, the white paper shows how organisations can unify access and security policies, apply an integrated, ID based authentication and authorisation model, and benefit from simplified visibility of detailed real-time data.
“If you can’t explain it simply. You don’t understand it well enough”
The rise of AI in compliance management
By Martin Ellingham, director, product management compliance at Aptean, looks at the increasing role of AI in compliance management and just what we can expect for the future
Artificial Intelligence (or AI as it’s now more commonly known) has been around in some shape or form since the 1960s. Although now into its eighth decade, as a technology, it’s still in its relative infancy, with the nirvana of general AI still just the stuff of Hollywood. That’s not to say that AI hasn’t developed over the decades, of course it has, and it now presents itself not as a standalone technology but as a distinct and effective set of tools that, although not a panacea for all business ills, certainly brings with it a whole host of benefits for the business world.
As with all new and emerging technologies, wider understanding takes time to take hold and this is proving especially true of AI where a lack of understanding has led to a cautious, hesitant approach. Nowhere is this more evident that when it comes to compliance, particularly within the financial services sector. Very much playing catch-up with the industry it regulates, up until very recently the UK’s Financial Conduct Authority (FCA) had hunkered down with their policy of demanding maximum transparency from banks in their use of AI and machine learning algorithms, mandating that banks justify the use of all kinds of automated decision making, almost but not quite shutting down the use of AI in any kind of front-line customer interactions.
But, as regulators are learning and understanding more about the potential benefits of AI, seeing first-hand how businesses are implementing AI tools to not only increase business efficiencies but to add a further layer of customer protection to their processes, so they are gradually peeling back the tight regulations to make more room for AI. The FCA’s recent announcement of the Financial Services AI Public Private Forum (AIPPF), in conjunction with the Bank of England, is testament to this increasing acceptance of the use of AI. The AIPFF is set to explore the safe adoption of AI technologies within financial services, and while not pulling back on its demands that AI technology be applied intelligently, it signals a clear move forward in its approach to AI, recognising how financial services already are making good use of certain AI tools to tighten up compliance.
Complexity and bias
So what are the issues that are standing in the way of wider adoption of AI? Well, to start with is the inherently complex nature of AI. If firms are to deploy AI, in any guise, they need to ensure they not only have a solid understanding of the technology itself but of the governance surrounding it. The main problem here is the shortage of programmers worldwide. With the list of businesses wanting to recruit programmers no longer limited to software businesses, now including any type of organisation who recognises the potential competitive advantage to be gained by developing their own AI systems, the shortage is getting more acute. And, even if businesses are able to recruit AI programmers, if it takes an experienced programmer to understand AI, what hope does a compliance expert have?
For the moment, there is still a nervousness among regulators about how they can possibly implement robust regulation when there is still so much to learn about AI, particularly when there is currently no standard way of using AI in compliance. With time this will obviously change, as AI becomes more commonplace and general understanding increases, and instead of the digital natives that are spoken about today, businesses and regulators will be led by AI-natives, well-versed in all things AI and capable of implementing AI solutions and the accompanying regulatory frameworks.
As well as a lack of understanding, there is also the issue of bias. While businesses have checks and balances in place to prevent human bias coming into play for lending decisions for example, they might be mistaken in thinking that implementing AI technologies will eradicate any risk of bias emerging. AI technologies are programmed by humans and are therefore fallible, with unintended bias a well-documented outcome of many AI trials leading certain academics to argue that bias-free machine learning doesn’t exist. This presents a double quandary for regulators. Should they be encouraging the use of a technology where bias is seemingly inherent and if they do pave the way for the wider use of AI, do they understand enough about the technology to pinpoint where any bias has occurred, should the need arise? With questions such as this, it’s not difficult to see why regulators are taking their time to understand how AI fits with compliance.
So, bearing all this in mind, where are we seeing real benefits from AI with regards to compliance, if not right now but in the near future? AI is very good at dealing with tasks on a large scale and in super-quick time. It’s not that AI is more intelligent than the human brain, it’s just that it can work at much faster speeds and on a much bigger scale, making it the perfect fit for the data-heavy world in which we all live and work. For compliance purposes, this makes it an ideal solution for double-checking work and an accurate detector of systemic faults, one of the major challenges that regulators in the financial sector in particular have faced in recent years.
In this respect, rather than a replacement for humans in the compliance arena, AI is adding another layer of protection for businesses and consumers alike. When it comes to double-checking work, AI can pinpoint patterns or trends in employee activity and customer interactions much quicker than any human, enabling remedial action to be taken to ensure adherence to regulations. Similarly, by analysing the data from case management solutions across multiple users, departments and locations, AI can readily identify systemic issues before they take hold, enabling the business to take the necessary steps to rectify practices to guarantee compliance before they adversely affect customers and before the business itself contravenes regulatory compliance.
Similarly, when it comes to complaint management for example, AI can play a vital role in determining the nature of an initial phone call, directing the call to the right team or department without the need for any human intervention and fast-tracking more urgent cases quickly and effectively. Again, it’s not a case of replacing humans but complementing existing processes and procedures to not only improve outcomes for customers, but to increase compliance, too.
At its most basic level, AI can minimise the time taken to complete tasks and reduce errors, which, in theory, makes it the ideal solution for businesses of all shapes, sizes and sectors. For highly regulated industries, where compliance is mandatory, it’s not so clear cut. While there are clearly benefits to be had from implementing AI solutions, for the moment, they should be regarded as complementary technologies, protecting both consumers and businesses by adding an extra guarantee of compliant processes. While knowledge and understanding of the intricacies of AI are still growing, it would be a mistake to implement AI technologies across the board, particularly when a well-considered human response to the nuances of customer behaviours and reactions play such an important role in staying compliant. That’s not to say that we should be frightened of AI, and nor should the regulators. As the technology develops, so will our wider understanding. It’s up to businesses and regulators alike to do better, being totally transparent about the uses of AI and putting in place a robust, reliable framework to monitor the ongoing behaviour of their AI systems.
Simplifying the Sector: How low code can aid digital transformation in financial services
By Nick Ford Chief Technology Evangelist, Mendix
From online banking to contactless payments and Apple Pay, it has been well demonstrated that the financial services industry is significantly ahead of many others when it comes to technology.
Traders, as well as customers, are now armed with the latest advances in technology and able to operate at super speed with more information at their fingertips than ever before.
However, the sector has not been immune from challenges created by COVID-19. The most significant challenge is maintaining the level of innovation they have been historically known for, with constrained budgets and smaller teams.
The pressure is on
The financial services sector is certainly quite complicated. There are many different regulatory bodies that monitor corporate conduct, which can make innovation a slow and arduous task. It also means that every time a new law is implemented, the sector needs to adjust to it, and that can mean anything from revising security protocols to radically changing the way information is processed, transmitted or audited.
This makes the job difficult for IT managers in the sector. Many of the systems they’re dealing with are old fashioned, dating back many decades and therefore not up to standard when it comes to performance and security. With lockdown restrictions meaning most sector staff are working remotely, this adds an extra pressure to IT teams that now have to ensure systems, data and work devices are functioning and always accessible. Digital transformation can help with this and a recent Mendix study found that 76% of IT managers in the sector believe it can improve operational efficiency.
Tech as a necessity
The sector now must be alert due to a new emerging challenge – the tech savvy customer. The modern age means customers are demanding much more from the services they are offered, with two things being highly desired; speed and transparency. As a result, many banks, hedge funds, and investment firms are investing in the appropriate technology to help meet these demands. The data that comes with upgrading ultimately allows financial institutions to better understand their customers and tailor their services more accurately to the changing trends influencing customer behaviour, Being able to have such knowledge is becoming more vital, as the pandemic continues to significantly affect the behaviour patterns of consumers and the preferences driving them.
Investing in technology can also increase efficiency within the sector at a time where teams and budgets are stretched, which can obviously have massive benefits. Digital transformation also leads to faster, better performing systems provides teams with the right tools they need to effectively get their job done. Tech is no longer a fintech privilege – it’s a currency. So much so that nine out of 10 IT leaders in financial services believe their firm will need to invest in digital projects over the next two years, just to survive in a rapidly changing market.
Powering digital transformation with low-code
To manage these different priorities, IT teams need to look beyond themselves and collaborate with different departments to create revenue-generating services that truly answer the clients’ needs – and it needs to empower all developers with the right tools to do so. This improved collaboration between IT and customer-facing staff means that services are designed to suit the needs of the customer-base, whilst reducing the pressure of an already-stretched IT team.
Low-code is one way to foster this collaboration. It requires little coding knowledge or expertise, meaning software development or the creation of business applications can include staff with non-technical backgrounds. Instead of having a back and forth between tech teams and other departments – of which miscommunication is always a risk – the development of apps can be inclusive involving a variety of teams, bringing together those that understand the business problems with those that understand the IT landscape, core systems and services to contribute to the vision of a product. IT stays in control with governance and guardrails built in to ensure compliance to the various standards required.
Digital transformation is an ongoing process in every industry. With low-code programming some of the current complexities and challenges facing the financial services sector can be tackled, allowing it to fully step into the digital age and continue being a hub of technological innovation.
Leading from the front – why decision makers must embrace automation
By Jeppe Rindom, Co-founder & CEO, Pleo
Ask any decision maker at a business about admin and you’re likely to be met with a familiar response – it’s a necessary evil that swallows time, but also helps inform strategic choices. Informed decisions are always better than uninformed ones, but many businesses still rely on outdated legacy processes to gather the data they need to make critical choices… and we’ve all seen the perils of a poorly maintained Excel spreadsheet in the news recently.
At director level, these administrative tasks can consist of signing off expenses or monitoring company spending to inform upcoming budgets. Although crucial to running a business well, these can be time-consuming and frustrating when you don’t have the right tools to make sense of it all. The solution? A simple change of approach.
A logical solution
This is where automation comes in. Over the last decade, we’ve seen how technologies including chat-bots and artificial intelligence have impacted everyday business, from customer-services and marketing to data analytics and time-management. More than ever, this is allowing employees to free up time to work more efficiently and focus on business-critical tasks. But this isn’t a quick fix. At a decision making is required. Ironically, a lot of these tasks relate to how a business can improve efficiency and productivity.
Add in the fact that many of these senior staff members have tight schedules, and can’t afford to spend several hours trawling through spreadsheets, and it’s little wonder high level admin is still an issue. In a recent customer survey, we found that 75% of senior managers spend over an hour a week on expense reports, with 14% losing nearly a whole working day (five hours or more) a week to managing them – time that could be better spent growing their business. The same study found that our platform saves people an average of 11.5 hours a month on managing company expenses. If you consider this could mean an extra day for a CFO or Finance Director to spend on more essential tasks, such as business forecasting or growth planning, the reward for investing in well designed automation at this level is clear.
But, automation isn’t just a case of saving time; it also fosters trust. Our study found that over half (51%) of users agreed that automating the laborious parts of their expenses like receipt capture, categorisation and expense reports also helped them build trust within their organisation. Automation helped them to excel at the things they’re most interested in, and were actually hired to do. I’m a huge advocate of empowering people with the tools they need to succeed. And through the empowerment automation brings, it’s only natural that employees begin to feel their worth in the business and that they are trusted.
A business-wide approach
Yet for automation to work, a company-wide understanding of its potential is vital. Adoption by senior staff should not be seen as simply a fringe benefit, as automation relies on understanding and endorsement from all levels of a business to work efficiently. A report titled ‘Automation and the future of work,’ published by the British Government in September 2019 noted that the successful implementation of automation “relies on managers and business leaders themselves being able to understand the potential of automation and the impact of technological change.” In this respect, managers will be your biggest ally when embracing automation. Any manager worth their salt understands the benefits of leading through example, and by creating automation ‘advocates’, businesses can ensure teams are comfortable with the impending change. While many busy managers often resist new processes (especially those to do with unfamiliar technology), they usually find that investing a short amount of time getting to grips with an automation platform pays off in the long term.
One of the most frequent pieces of feedback we receive is that an effectively automated platform allows staff to focus on strategy, culture and creativity, with the knock-on effect of automating mundane tasks being felt throughout an entire organisation, not just one relieved individual.
Having a smart, automated platform can also massively reduce the chance of human error at an early stage. This can be disastrous when data is relied upon to make important decisions at a later date. In this respect, having access to accurate information can be a game-changing benefit for decision-makers, particularly those working under increased pressure.
At a time when businesses are facing rapid and unpredictable changes, ensuring your business is equipped with the right tools for success is crucial. And while automation may seem an intimidating change, the huge benefits it can bring to both processes and culture will outweigh any initial concerns. By giving senior staff and their team members alike the ability to embrace smart automation, efficiency will speak for itself, and your business’ success will flourish.
Research exposes the £68.8 billion opportunity for UK retailers
Modelling shows increasing the proportion of online sales by 5 percentage points would have significantly boosted retailers’ revenues during the...
Want to serve your customers better? An effective online strategy is what financial institutions need
By Anna Willems, Marketing Director, Mention A strong online presence matters. Having a strong online presence, that involves social media...
The rise of AI in compliance management
By Martin Ellingham, director, product management compliance at Aptean, looks at the increasing role of AI in compliance management and just...
Simplifying the Sector: How low code can aid digital transformation in financial services
By Nick Ford Chief Technology Evangelist, Mendix From online banking to contactless payments and Apple Pay, it has been well...
Why the Boom is Long Overdue (and Here to Stay)
By Roger James Hamilton, CEO, Genius Group Virtually every aspect of our lives has been taken over by tech, so...
5 Sustainability Lessons That Are Crucial For Business Success
By Michael Stausholm, founder of Sprout World (sproutworld.com) Sprout World is the eco-company behind the world’s only plantable pencil, with...
Why financial brands need to understand consumer vitality
By Carolyn Corda, CMO at data consortium ADARA Our day to day lives have been turned upside down. Office workers have...
Why and how a modern marketing strategy should put customer experience first
By Jim Preston, VP EMEA, Showpad In 2004, the Leading Edge Forum coined the term ‘consumerisation of IT’, defining a...
Leading from the front – why decision makers must embrace automation
By Jeppe Rindom, Co-founder & CEO, Pleo Ask any decision maker at a business about admin and you’re likely to...
Business first, not compliance only is the future for accountants
By Peter Bracey, MD at Bracey’s Accountants. The past few months have underlined the need for better business insight to reduce...