EVALUATING CLOUD COMPUTING RISKS:
Recounting PBB’s Journey into the Cloud
March 2015 Keith S. Chan, ABCP
www.pbb.com.ph
AGENDA
About Philippine Business Bank
Case Study: SaaS/Community Cloud
Case Study: IaaS/Private Cloud
Understanding Risks on Cloud Computing
www.pbb.com.ph
PBB was incorporated
and began operations
• Expansion to 18 branches
• FCDU operations approved by
the BSP
• Approval to undertake trust
operations
• Accredited as GS Eligible Dealer
ACS increased to
PHP1.0bn
• Acquired Kabalikat Rural
Bank (incl. 5 branches) &
obtained approval for 13 new
branches
• Expanded to 32 branches
• Integrated ATM operations
• First savings bank allowed to offer
trade finance
• Established foreign correspondent
bank network
Expanded
to 65
branches
Increase in ACS
to PHP10 bn
Listed at PSE
On FEB 19
The 5th largest thrift bank in the Philippines in terms of asset size in the thrift bank
industry.
Part of the Yao Group of companies with business interests spanning food and
beverages; air transportation; trade and marketing ; real estate development; and
financial services.
Deliberately focused on the SME market
PBB has 116 branches as of 2014 all over the country.
www.pbb.com.ph
PBB opened an average of 5 branches per year in the past 15 years
'97 '98 '99 '00 '01 '02 '03 '04 '05 '06 '07 '08 '09 '10 '11 '12 '13 '14
1
9 14 14 14 16 18 20 21 22 27 32
48
55
65
78
100 102
4
Branch Network Expansion
Note: 2014 Figure is as of June 30, 2014
1997-2008 > 32 branches (avg. 3 branches/year)
2008- Dec 2012 > 46 branches (avg. 11 branches/year)
2013 > 22 branches
116 branches in 2014
116
www.pbb.com.ph
PBB’S JOURNEY INTO CLOUD
2009, PBB became the 1st
savings bank to be granted the
authority to issue Foreign
Letters of Credit and
pay/accept/negotiate
import/export drafts/bills of
exchange by the Bangko
Sentral ng Pilipinas.
The International Banking
Group was created with one
business requirement for IT… to
join SWIFT in electronic
payment transmission of MT
messages.
July 2010 - PBB signed with a
SWIFT SaaS provider for the
electronic messaging and it
went production in 1 month.
March 2012 - PBB migrated
to SWIFT Ver 7.0 by SaaS
provider.
Plans underway for 2013 to
virtualize data center on
the success of SaaS.
Integrated on-premise Treasury
System with the SWIFT on
SaaS for straight-through-
processing.
Data center virtualization
completed mid 2013 with core
banking system running on a
private cloud.
Mid 2014 Completed Virtual
Disaster Recovery Facilities
www.pbb.com.ph
2010 SWIFT CHALLENGE (SaaS/Community Cloud)
First thrift bank to be granted authority to
issue Foreign Letters of Credit and
pay/accept/ negotiate import/export drafts/bills
of exchange by the Bangko Sentral ng
Pilipinas.
One of the Bank’s International Banking
Group strategy is to be a member of SWIFT.
Information Technology Group tasked to
provide the SWIFT payment gateway…
soonest possible time.
OPTIONS: Traditional on-premise or
Software-as-a-Service
www.pbb.com.ph
THE BUSINESS CASE: SWIFT on SaaS
•IT Strategy adopted SWIFT on SaaS due to faster time-to-market and
lower IT expense. Satisfied client’s requirement and enabled the bank
to make available the service at the quickest possible time.
Traditional
On-premise
SaaS/Cloud
Time to Market 3 months 1 month
Investment 196% higher 51% lower
Annual cost 238% higher 42% lower
www.pbb.com.ph
BABY-STEP 2: VERSION UPGRADE
Version 6.+
Version 7.0
www.pbb.com.ph
CLOUD INTEGRATION?
In 2013, Straight-
Through-Processing
(STP) Integration from
an on-premise Treasury
System to the SWIFT on
SaaS.
www.pbb.com.ph
BENEFITS
Financial – Low upfront investment,
tiered pricing based on transaction
volume – competitive advantage.
Agility and Rapid Deployment –
Application was ready 1 week after
contract signing. Applications can be
accessed from any computer with the
proper VPN.
Availability – SLA defined commitment
of the SaaS provider.
Scalability – resource provisioning with
provider.
Ease of Technology Management –
Version upgrade by provider, no servers
to maintain.
Environmental Friendly - less energy
consumption of Data Centers.
www.pbb.com.ph
2012 IT INFRASTRUCTURE CHALLENGE
(IaaS/Private Cloud)
Need to replace old slow servers (aged 8-
10 years), modernize to provide higher data
center service level and increase computing
resources at the same time reduce operating
cost and minimize technology risks.
Future Proof the IT Infrastructure, able to
address short, mid and long term business IT
Infrastructure.
Preserve low cost advantage of mission
critical applications. No major issues on
core banking system.
Transform data center without disruption
to business. Risk on changes to processes
and systems can be disruptive to growth
momentum when replacing core systems.
Improve Disaster Recovery Response.
OPTIONS: 1:1 replacement of servers or
transform to a virtual/private cloud.
www.pbb.com.ph
Weather Forecast: Virtualization as a Future Proofing
Strategy
www.pbb.com.ph
Financial – IT Optimization (10:1 ratio),
no new capex for mission critical
application replacement.
Agility and Rapid Deployment –
Software definable servers no waiting
time.
Availability – Built-in Redundancy with
virtual DR Site
Scalability – IT resources can be grown
in Virtualization – future proofing the
data center
Ease of Technology Management –
Transformation of IT Operations -
Simplified.
Environmental Friendly – lessen
energy consumption of Data Centers.
BENEFITS
www.pbb.com.ph
LESSONS FROM LEVERAGING ON CLOUD
MODELS
Virtualization is only the technology, but the strategic used that
transformed and future proof our data center on an enterprise level
without business disruption and maintaining the financial advantage,
meet the short, medium and long term business needs while
sustaining scalability and reliability, fiscalized the value of cloud
models to meet and scale up to business demands.
IT optimization can be achieved through reduction of data center
real estate, energy consumption, simplified IT operations and
furthermore, it can extended the life of mission critical applications
specially if it is the competitive advantage of the bank and speed up
time to market. It could level the playing field for mid-sized banks to
compete with the economies of scale of the larger banks.
www.pbb.com.ph
CLOUD COMPUTING RISKS
Regulatory Framework
Critical Business Data Exposed
Skill Shortage
Reliance on Third Parties/Outsourcing
Guaranteed Performance/Service Levels
Service Provider Outrages/Disaster
Recovery
Broadband Availability/Reliability
Cost-savings Benefits Disappear as
Demand Grows
Unwanted Updates and Functions
Vendor Lock-in/Restoring to On-Premise
Cost
Data Sovereignty
“There is no such a thing as risk free.
Who dares… Make things happen!”
www.pbb.com.ph
ASSOCIATED RISKS IN CLOUD MODELS
Data Sovereignty
Financial
Technology
Data Security
www.pbb.com.ph
Fixed Cost
NUMBER OF TRANSACTIONS
C
O
S
T
COST BEHAVIOR OF PAY-PER-USE
Variable Cost
Pay-per-use
www.pbb.com.ph
Fixed Cost
NUMBER OF SERVERS
C
O
S
T
COST BEHAVIOR OF PRIVATE CLOUD
Variable Cost
www.pbb.com.ph
New Regulatory Guidelines on Cloud
Computing
(Philippines)
August 1, 2013 – BSP approved Circular
808 stating the Guidelines on Information
Technology Risk Management for All
Banks and Other BSP Supervised
Institutions.
Annex 75e Section 4 – IT Risk
Management Standards and Guidelines
on IT Outsourcing/Vendor Management –
Emerging Technologies
www.pbb.com.ph
The use of cloud
services is no
different to any
form of
technology
outsourcing.
www.pbb.com.ph
Source: https://defyingshadows.wordpress.com/2014/09/10/baby-steps/
www.pbb.com.ph
CLOUD IS A SERVICE MODEL ALTERNATIVE
• Software-as-a-Service –
Cost effective/fast
deployment outsourcing
model.
• Cloud Infrastructure
(Virtualization/Private
Cloud) – a model to future
proof, transform and
optimize IT infrastructure.
“Look for the cloud model that fits your business case.”
www.pbb.com.ph
Recipient of the following Awards:
• 2014 – “Best Banking Technology, Philippines”,
Global Banking and Finance Review, London.
• 2014 – “Philippine Domestic Technology and Operations of the Year”,
Asia Banking and Finance, Singapore
• 2013 – “Philippine Domestic Technology and Operations of the Year”,
Asia Banking and Finance, Singapore
IDC Financial Insights Innovation Awards: Cited among the top 30 Financial Technology Initiatives in the
Asia/Pacific regions.
• 2014 - “Future Proofing with Enterprise Data Center-Virtualization” (The only Philippine based bank on the list.)
• 2012 – “SWIFT on SaaS”
• 2011 – “SWIFT on SaaS”
IDC Asia/Pacific Published Case Study:
• March 2014, “Philippine Business Bank: Data Center Transformation to Meet Future Business Demands” by the
International Data Corporation (IDC) Asia/Pacific Headquarters, Singapore. [IDC #AP246107]
Awards, Citations and Case Studies on
PBB’s Technology Initiatives
www.pbb.com.ph
Keith S. Chan, ABCP
FVP, Information Technology Group
Philippine Business Bank
chan_ks@pbb.com.ph
kschansr@yahoo.com
Contact Information

Evaluating Cloud Computing Risk :Recounting PBB’s Journey into the Cloud - Keith S. Chan

  • 1.
    EVALUATING CLOUD COMPUTINGRISKS: Recounting PBB’s Journey into the Cloud March 2015 Keith S. Chan, ABCP
  • 2.
    www.pbb.com.ph AGENDA About Philippine BusinessBank Case Study: SaaS/Community Cloud Case Study: IaaS/Private Cloud Understanding Risks on Cloud Computing
  • 3.
    www.pbb.com.ph PBB was incorporated andbegan operations • Expansion to 18 branches • FCDU operations approved by the BSP • Approval to undertake trust operations • Accredited as GS Eligible Dealer ACS increased to PHP1.0bn • Acquired Kabalikat Rural Bank (incl. 5 branches) & obtained approval for 13 new branches • Expanded to 32 branches • Integrated ATM operations • First savings bank allowed to offer trade finance • Established foreign correspondent bank network Expanded to 65 branches Increase in ACS to PHP10 bn Listed at PSE On FEB 19 The 5th largest thrift bank in the Philippines in terms of asset size in the thrift bank industry. Part of the Yao Group of companies with business interests spanning food and beverages; air transportation; trade and marketing ; real estate development; and financial services. Deliberately focused on the SME market PBB has 116 branches as of 2014 all over the country.
  • 4.
    www.pbb.com.ph PBB opened anaverage of 5 branches per year in the past 15 years '97 '98 '99 '00 '01 '02 '03 '04 '05 '06 '07 '08 '09 '10 '11 '12 '13 '14 1 9 14 14 14 16 18 20 21 22 27 32 48 55 65 78 100 102 4 Branch Network Expansion Note: 2014 Figure is as of June 30, 2014 1997-2008 > 32 branches (avg. 3 branches/year) 2008- Dec 2012 > 46 branches (avg. 11 branches/year) 2013 > 22 branches 116 branches in 2014 116
  • 5.
    www.pbb.com.ph PBB’S JOURNEY INTOCLOUD 2009, PBB became the 1st savings bank to be granted the authority to issue Foreign Letters of Credit and pay/accept/negotiate import/export drafts/bills of exchange by the Bangko Sentral ng Pilipinas. The International Banking Group was created with one business requirement for IT… to join SWIFT in electronic payment transmission of MT messages. July 2010 - PBB signed with a SWIFT SaaS provider for the electronic messaging and it went production in 1 month. March 2012 - PBB migrated to SWIFT Ver 7.0 by SaaS provider. Plans underway for 2013 to virtualize data center on the success of SaaS. Integrated on-premise Treasury System with the SWIFT on SaaS for straight-through- processing. Data center virtualization completed mid 2013 with core banking system running on a private cloud. Mid 2014 Completed Virtual Disaster Recovery Facilities
  • 6.
    www.pbb.com.ph 2010 SWIFT CHALLENGE(SaaS/Community Cloud) First thrift bank to be granted authority to issue Foreign Letters of Credit and pay/accept/ negotiate import/export drafts/bills of exchange by the Bangko Sentral ng Pilipinas. One of the Bank’s International Banking Group strategy is to be a member of SWIFT. Information Technology Group tasked to provide the SWIFT payment gateway… soonest possible time. OPTIONS: Traditional on-premise or Software-as-a-Service
  • 7.
    www.pbb.com.ph THE BUSINESS CASE:SWIFT on SaaS •IT Strategy adopted SWIFT on SaaS due to faster time-to-market and lower IT expense. Satisfied client’s requirement and enabled the bank to make available the service at the quickest possible time. Traditional On-premise SaaS/Cloud Time to Market 3 months 1 month Investment 196% higher 51% lower Annual cost 238% higher 42% lower
  • 8.
    www.pbb.com.ph BABY-STEP 2: VERSIONUPGRADE Version 6.+ Version 7.0
  • 9.
    www.pbb.com.ph CLOUD INTEGRATION? In 2013,Straight- Through-Processing (STP) Integration from an on-premise Treasury System to the SWIFT on SaaS.
  • 10.
    www.pbb.com.ph BENEFITS Financial – Lowupfront investment, tiered pricing based on transaction volume – competitive advantage. Agility and Rapid Deployment – Application was ready 1 week after contract signing. Applications can be accessed from any computer with the proper VPN. Availability – SLA defined commitment of the SaaS provider. Scalability – resource provisioning with provider. Ease of Technology Management – Version upgrade by provider, no servers to maintain. Environmental Friendly - less energy consumption of Data Centers.
  • 11.
    www.pbb.com.ph 2012 IT INFRASTRUCTURECHALLENGE (IaaS/Private Cloud) Need to replace old slow servers (aged 8- 10 years), modernize to provide higher data center service level and increase computing resources at the same time reduce operating cost and minimize technology risks. Future Proof the IT Infrastructure, able to address short, mid and long term business IT Infrastructure. Preserve low cost advantage of mission critical applications. No major issues on core banking system. Transform data center without disruption to business. Risk on changes to processes and systems can be disruptive to growth momentum when replacing core systems. Improve Disaster Recovery Response. OPTIONS: 1:1 replacement of servers or transform to a virtual/private cloud.
  • 12.
  • 13.
    www.pbb.com.ph Financial – ITOptimization (10:1 ratio), no new capex for mission critical application replacement. Agility and Rapid Deployment – Software definable servers no waiting time. Availability – Built-in Redundancy with virtual DR Site Scalability – IT resources can be grown in Virtualization – future proofing the data center Ease of Technology Management – Transformation of IT Operations - Simplified. Environmental Friendly – lessen energy consumption of Data Centers. BENEFITS
  • 14.
    www.pbb.com.ph LESSONS FROM LEVERAGINGON CLOUD MODELS Virtualization is only the technology, but the strategic used that transformed and future proof our data center on an enterprise level without business disruption and maintaining the financial advantage, meet the short, medium and long term business needs while sustaining scalability and reliability, fiscalized the value of cloud models to meet and scale up to business demands. IT optimization can be achieved through reduction of data center real estate, energy consumption, simplified IT operations and furthermore, it can extended the life of mission critical applications specially if it is the competitive advantage of the bank and speed up time to market. It could level the playing field for mid-sized banks to compete with the economies of scale of the larger banks.
  • 15.
    www.pbb.com.ph CLOUD COMPUTING RISKS RegulatoryFramework Critical Business Data Exposed Skill Shortage Reliance on Third Parties/Outsourcing Guaranteed Performance/Service Levels Service Provider Outrages/Disaster Recovery Broadband Availability/Reliability Cost-savings Benefits Disappear as Demand Grows Unwanted Updates and Functions Vendor Lock-in/Restoring to On-Premise Cost Data Sovereignty “There is no such a thing as risk free. Who dares… Make things happen!”
  • 16.
    www.pbb.com.ph ASSOCIATED RISKS INCLOUD MODELS Data Sovereignty Financial Technology Data Security
  • 17.
    www.pbb.com.ph Fixed Cost NUMBER OFTRANSACTIONS C O S T COST BEHAVIOR OF PAY-PER-USE Variable Cost Pay-per-use
  • 18.
    www.pbb.com.ph Fixed Cost NUMBER OFSERVERS C O S T COST BEHAVIOR OF PRIVATE CLOUD Variable Cost
  • 19.
    www.pbb.com.ph New Regulatory Guidelineson Cloud Computing (Philippines) August 1, 2013 – BSP approved Circular 808 stating the Guidelines on Information Technology Risk Management for All Banks and Other BSP Supervised Institutions. Annex 75e Section 4 – IT Risk Management Standards and Guidelines on IT Outsourcing/Vendor Management – Emerging Technologies
  • 20.
    www.pbb.com.ph The use ofcloud services is no different to any form of technology outsourcing.
  • 21.
  • 22.
    www.pbb.com.ph CLOUD IS ASERVICE MODEL ALTERNATIVE • Software-as-a-Service – Cost effective/fast deployment outsourcing model. • Cloud Infrastructure (Virtualization/Private Cloud) – a model to future proof, transform and optimize IT infrastructure. “Look for the cloud model that fits your business case.”
  • 23.
    www.pbb.com.ph Recipient of thefollowing Awards: • 2014 – “Best Banking Technology, Philippines”, Global Banking and Finance Review, London. • 2014 – “Philippine Domestic Technology and Operations of the Year”, Asia Banking and Finance, Singapore • 2013 – “Philippine Domestic Technology and Operations of the Year”, Asia Banking and Finance, Singapore IDC Financial Insights Innovation Awards: Cited among the top 30 Financial Technology Initiatives in the Asia/Pacific regions. • 2014 - “Future Proofing with Enterprise Data Center-Virtualization” (The only Philippine based bank on the list.) • 2012 – “SWIFT on SaaS” • 2011 – “SWIFT on SaaS” IDC Asia/Pacific Published Case Study: • March 2014, “Philippine Business Bank: Data Center Transformation to Meet Future Business Demands” by the International Data Corporation (IDC) Asia/Pacific Headquarters, Singapore. [IDC #AP246107] Awards, Citations and Case Studies on PBB’s Technology Initiatives
  • 24.
    www.pbb.com.ph Keith S. Chan,ABCP FVP, Information Technology Group Philippine Business Bank chan_ks@pbb.com.ph kschansr@yahoo.com Contact Information