The document discusses security issues with cloud computing and software as a service (SaaS) applications. It introduces CloudMask as a solution that protects sensitive data by masking it before it enters encryption channels and at data centers. This prevents unauthorized access to data even if user credentials or data center security are compromised. CloudMask allows secure use of cloud services without the risks of data breaches and regulatory issues from exposed sensitive data.

1. CloudMask thinks differently in the secure-cloud landscape.
Financial services make CloudMask a smart investment in securing data.
The economic value proposition of Software as a Service (SaaS) is undeniable. SaaS is disrupting industry after industry,
making accessible to sole proprietors and small businesses software functionality that historically required significant
investment in hardware, software, and annual maintenance fees. This, in turn, is making smaller players even more agile
and efficient than they used to be, allowing them to run competitive circles around larger or laggard players.
The good news is that rich software functionality is often available for less than $100 per month, enabling high levels of
business management and administrative efficiencies.
The bad news is that the tempting sky of cloud and SaaS computing is filled with thunderclouds of cybersecurity concerns.
Despite the best efforts of traditional cybersecurity experts, the adoption of cloud computing has been accompanied by an
ever-growing number of egregious data breaches. These breaches damage brands and drive up significant costs for
investigations, notification, and identity-theft protection for clients whose personal information has drifted into malicious
hands.
So, what’s going on? Why do even the largest enterprises struggle with securing their data? Wouldn’t the National
Security Agency be one of the most rigorous security practitioners in the world? What leaks have we not yet detected?
One thought leader at a major global cybersecurity consultancy explained it like this: “We’re trying to examine every packet
that flows across the perimeter of the network and notice IP addresses that don’t make sense. This is incredibly hard.
There’s a ridiculous amount of data, and we’ve entered an age where the network no longer has clear boundaries. We
really haven’t solved that problem.”
What is the problem?
The problem lies in the way traditional security thinkers have defined the problem. They’re working with a castle and moat
metaphor, where the internal network is protected with a set of security rings. Each ring, however, has costly hardware and
software searching for malevolent inbound and outbound data. But it’s like looking for needles in a haystack. And even if
security experts are successful at protecting the perimeter, there is little protection against insiders (employees or others
with access to the internal network).
Protect your confidential
information while improving
services

2. CloudMask thinks differently.
We see the problem in simpler terms: protecting sensitive data and ensuring that only authorized users, using known
devices, can see data in the clear. We’re happy to let the traditional security experts work on their perimeters, knowing that
when they fail, our customers’ data remains secure. And, in contrast with products designed for big enterprises, we’ve
created a solution that can be installed, configured, and afforded by small businesses without IT staff.
Financial services find CloudMask’ data protection a sound asset.
Over the last few decades, the financial sector has outgrown banks, as financial engineering, digital money and regulatory
changes have evolved. Assets managed by financial firms (equity and various types of debt) are larger, as corporate debt
has surpassed federal, state and local government’s debt. The US banks’ share of assets under management (AUM)
accordingly declined from 58% in 1907 to 27% in 2008, while pension, mutual funds and non-depository firms (e.g., private
equity and hedge funds) have grown substantially.
A Bain & Company study projects that huge amounts of financial assets created post 2008 financial crisis will keep the return
on capital low in medium term. As a result pressure is put on getting better returns and forcing financial companies to lower
their internal costs. This, in turn, creates an urgent need to move to the cloud for IT resources if the underlying security
issues can be met.
Bain & Company’s 2015 survey of 158,000 consumers and 70 insurers across 18 countries shows that established firms
have been slow to adopt digital business models, ceding space to a number of tech-oriented start-ups. The survey finds:
 35-70% of customers are digitally active (varies by country), with 79% wanting to use digital interaction channels.
 8-11% of products were sold online in 2014, set to double in 2015.
 31% of insurers are focused on big data and analytics in terms of technology.
 20% of insurers plan to invest in digital distribution and servicing of products.
 11% of insurers want to use IT to make their operations more effective.
 21% of insurers have no clear digital strategy and 43% are unsure of their plan, because they are missing key
elements, e.g., a clear vision, or compliance and risk processes.
However, as echoed by Oliver Wyman, firms that align the digital and physical worlds will yield higher customer loyalty and
advocacy.
From the large number of financial technology start-ups impacting payments, trading and insurance, to use of analytics,
technology is a big disruptor in the financial sector. That is why Ovum Research found that despite continuing uncertainty,
financial institutions increased ICT investment in 2015. Nearly 65% of the firms surveyed are considering cloud-based
services as an option. A focus on restoring top-line growth is driving adoption of cloud computing, especially for order
management systems (OMS) and portfolio management systems (PMS).

3. The key benefits of cloud computing for capital market firms include:
Capital Market Need Benefit of Cloud Adoption
Financial-services firms experience high daily
demand spikes around market open-and-close
times.
On-demand scaling solution enables superior
customer experience and capacity.
Load on internal datacenters is reduced by
sourcing capacity during peak load times from
private/public cloud. Superior customer
experience differentiates the firm and increases
customer loyalty while cutting operational costs.
Algorithm testing increases complexity and cost
as it needs historical data, involving establishing
data feeds and maintenance of large amounts of
data on hand.
Multisource services reduce data-management
costs by placing data on the cloud to be easily
accessible by clients.
Resources to manage reference data, e.g.,
counterparty data and trade data, requires
significant resources to collect, standardize and
manage.
Multisource services allow capital markets firms
to reduce costs of managing and refreshing
reference data.
Cost of maintaining low-latency trading. Firms
co-locate their trading infrastructure with
exchange providers to conduct low-latency
trading.
A multisource infrastructure allows sell-side firms
to dramatically reduce the costs of the trading
infrastructure when low-latency trading is offered
as a cloud.
Why do Financial Companies Shy Away from the Cloud?
When it comes to considering adopting the cloud for their operations, the top reasons stated by respondents were:
• Security concerns (100%)
• Regulatory restrictions (71 %)
• Concerns over public breach notification (43%)
Of financial institutions surveyed, 60% ranked data confidentiality as their highest concern, followed by loss of control of data
(57 %) and data breach (55%).
A 2016 survey shows 75% of enterprises implemented additional security measures, suggesting the cloud is not secure
enough, out-of-the-box. The measures included data encryption (61%), identity access policies (52%) and regular audits
(48%). Additional security costs enterprises between $10,000 and $500,000 annually.
The Current Approach is Outdated
However, we must accept that a static compliance approach to security is outdated. Our approach should accept that it is
unrealistic to expect that defenses will prevent all incidents. A better method is to accept that there will be a breach in security
and that the hacker will gain access. Having accepted this, cloud security must ensure that the breach will not result in loss
of data and that customers will not be impacted. The solution must also ensure that financial companies are not required to
disclose publicly that there has been a breach. This can only happen if all data is secured and encrypted at all time, including
when it is being processed.
This can only happen if data is protected at all times – during rest, transmission and processing. While securing data at rest
is easy, the real problem arises in protecting data during processing. Most traditional applications will not work with encrypted
data during processing. Applications sharing data among several providers will find it even more difficult to work with
encrypted data.
Does this mean that the financial sector will not be able to use cloud resources to the fullest? Is there another solution?

4. Fortunately, there is a solution. If data was to be masked or tokenized instead of being encrypted, critical information would
be replaced by a meaningless value in the same format as the original data. Since the format of the data is preserved, all
processing can go on as usual. However, as the original value is never revealed, security is preserved.
The SaaS Security Problem – Simplified
SaaS applications use best-practice security protocols and rely on their cloud provider to secure the infrastructure the
application runs on.
One vendor explains it this way: “We ensure that your communications are secure using bank-grade 256-bit SSL
encryption. All of (our) infrastructure is hosted using physically secure, managed data centers that meet the rigid SSAE 16
specifications. Geo-redundant backups are performed multiple times per day, and site security and privacy are routinely
audited by respected third parties.”
By means of 256-bit SSL encryption, the connection between your browser or app and database servers is secured. When
you submit a query or update, the data is encrypted as it transits the internet. Once the data reaches the data center, it is
decrypted for insertion into the app’s database.
The data center itself (e.g., Amazon Web Services) has a rigorous set of security controls and protocols, meaning that only
employees with the proper identification and access passwords can physically or virtually access the servers that hold the
application’s data. SSAE 16 is a standard according to which data centers are audited for their degree of compliance with
policy.
There are three vulnerabilities that should concern executives:
1. Anyone who tricks a user into revealing their username and password can impersonate that user and log in
from any browser in the world.
Such a hacker can impersonate the user and perform administrator functions. You don’t have to be a fool to have this
happen to you. Even a sophisticated user like CIA Director John Brennan has fallen prey to high school-age hackers.
2. Any insider (employee of the data center) can turn from “good” to “bad” overnight or have their credentials
stolen, meaning that an authorized system administrator could access application data for malevolent purposes.
Insiders don’t need to be “bad” to present a threat. They can simply be careless.
A recent report on cybersecurity suggests that less than 50 percent of organizations have adequate policies in place to
mitigate insider-threat risks. The challenge here is that executives depend on their SaaS provider, who in turn rely on their
cloud service providers to maintain security hygiene. That’s a lot of blind faith.
3. Governments have the desire, capacity and experience to tap into the cloud-service providers who hold the
world’s data.
The problem here is manifold. On the one hand, the government can access specific information based on a warrant. On
the other hand, it is an entirely different matter to access everything on an as-needs basis, under cover of National Security
Letters or their equivalent. Despite their best efforts to security screen and oversee intelligence and law enforcement
operations, the government also falls prey to “trusted” staff performing unauthorized actions. These vulnerabilities impact
the firm’s liability for data breaches and the capacity to deliver on a promise of client confidentiality and privacy.
In storing sensitive personal and other data, the firm is considered a data controller. As a data controller, the firm is subject
to a variety of data protection laws and regulations. Such regulations increasingly create a costly burden to notify
individuals affected by data breaches and to purchase several years of identity-theft protection. Emerging European laws
impose heavy fines for firms who violate data protection regulations.
If you think the solution is not to use cloud, think again.
The concerns outlined above have caused many organizations to have misgivings about adopting cloud-based solutions,
presuming that an on-premise solution (a server running in your office) is safer. Unfortunately, that is not the case. Your
office or server room isn’t nearly as secure as an access-controlled data center.

5. CloudMask: a silver lining for SaaS
CloudMask addresses these vulnerabilities in a way that enables executives to immunize their firms against data-
breaches, differentiate by offering highly secure data management and communications, and using economical cloud
services with confidence.
CloudMask can provide SaaS users with an easy-to-install browser extension that automatically masks sensitive data
before it enters the 256-bit encryption channel to the data center. When that data arrives at the data center where the 256-
bit protection ends, CloudMask data stays masked.
This process also works in reverse, as in the case when the user requests sensitive data. Here the masked data is double-
encrypted as it moves through the secured communications channel. When it arrives in the browser, the 256-bit encryption
is removed, and CloudMask seamlessly unmasks to present the data in the clear.
Alongside controlling users and their access rights, practice management account owners/administrators have the capacity
to select specific fields to be masked. Not all data needs to be masked and protected, but data categorized as sensitive
personal data, personally identifying, or otherwise confidential, can be selected for automated, seamless masking and
unmasking.
From a functional perspective, CloudMask resolves the concerns that executives
might have with respect to using SaaS applications:
1. Each user authorized to access the SaaS account installs a CloudMask browser extension that is activated through a
simple process generating the personal, private and public keys required for the encryption process. What’s more, the
extension can be installed on multiple personal devices, each of which is personalized with a private key. Thus, even if a
username and password are somehow compromised, which under normal circumstances would allow anyone anywhere in
the world to log into the account and see data in the clear, the unauthorized user cannot do so without access to the
specific devices configured with the personalized browser extension.
2. The data stored under care of the data center remains masked while at rest or in motion. Neither the practice
management SaaS vendor, nor CloudMask administrators, nor data center administrators, have keys that can be used to
unmask the data. If the data center suffers a breach (e.g., an unauthorized insider penetrates the database, or a
government agency serves a National Security Letter), data the user has designated as sensitive remains protected.
3. The data stored under care of the data center is masked in such a way (“tokenization”) that anonymizes what was
previously sensitive data. Thus, even if that data is stolen, it is no longer considered sensitive personal information or
personally identifying information, so it no longer falls under data protection regulations or requirements. In other words,
breaches of systems holding tokenized data do not trigger the costly response and remediation efforts associated with
breaches of systems holding sensitive personal information.
The Technical Story
A separate e-book explains the technical details behind this process and the software that automates it, as well as
describing the benefits of encrypting and tokenizing data, which we collectively refer to as “masking.” The e-book also
provides a brief explanation of the well-established public/private key methods used by the encryption process.
Grounded Confidence
CloudMask is unique in having its “CloudMask engine” certified through a Common Criteria for Information Technology
Security Evaluation (Common Criteria) process, which is used by twenty-six federal governments to evaluate security
products for their own use.
The process of independent evaluation assesses whether a product’s functional claims live up to the way it is coded and
performs. Many products claim to be “bank-grade” or “military-grade,” both of which are subjective assessments.
CloudMask is the only data-masking product capable of working with SaaS offers to achieve Common Criteria certification.
More expensive competitors like Cipher Cloud and Ionic have not achieved such objective criteria. Technical advisors can
access CloudMask’s Common Criteria Assessment here.
It’s easy to get started with CloudMask. Visit www.cloudmask.com