EY Trajectory Final

50
EY Trajectory Program Binghamton Bank IT Solutions Implementing the Cloud f SAAS TEAM EUGENE BRIZO, JOHN MONTESANO, JESSICA VINOKUR, DANIEL WANG IAAS TEAM BRIAN HUM, CHRIS LO, ROBERT PIM, ANNA PRIGL 1

Transcript of EY Trajectory Final

Page 1: EY Trajectory Final

EY Trajectory Program

Binghamton Bank IT SolutionsImplementing the Cloud

f

SAAS TEAM

EUGENE BRIZO, JOHN MONTESANO, JESSICA VINOKUR, DANIEL WANG

IAAS TEAM

BRIAN HUM, CHRIS LO, ROBERT PIM, ANNA PRIGL

1

Page 2: EY Trajectory Final

EY Trajectory Program

Agenda• Executive summary• Cloud computing overview• Risks of cloud computing• Software as a service (SaaS) overview• Infrastructure as a service (IaaS) overview• Big data• Business impact analysis tool overview• Timeline• Questions

2

Page 3: EY Trajectory Final

EY Trajectory Program

Executive Summary• Binghamton Bank Corporation, under the head of a new CEO, has a new goal to

transform their current systems to match business needs• Better understand the future needs of their customers and investors• Track and identify customer buying patterns and investor needs• Upgrade financial applications and underlying infrastructure

• The bank has undergone some technological failures in the past year• February 2014 – software upgrade froze the bank’s systems• July 2014 – the bank’s web application went down

• Binghamton Bank’s CIO suggested to move existing applications to the cloud• Allow flexibility and scalability to better suit the needs of the company

• Binghamton Bank can also stay ahead of its competition by working with big data• Reduce costs, increase efficiency, and create insights to customer and investor data

3

Page 4: EY Trajectory Final

EY Trajectory Program

Cloud Computing Overview• Cloud computing is the practice of using remote servers over the Internet to store and

access data rather than connecting to a local network• Cloud computing has three main services:

• Infrastructure as a service (IaaS) is the most basic layer of cloud computing services. The provider offers hardware to the user via a virtualized interface.

• Platform as a service (PaaS) is the next layer. The provider offers hardware plus a computing platform to the user

• Software as a service (SaaS) is the third and most complex layer of cloud computing services. The user is able to access different types of applications from the provider.

4

Page 5: EY Trajectory Final

EY Trajectory Program

Cloud Computing Overview

Applications

Runtimes

Security

Databases

Servers

Virtualization

Server Hardware

Storage

Networking

Applications

Runtimes

Security

Databases

Servers

Virtualization

Server Hardware

Storage

Networking

Applications

Runtimes

Security

Databases

Servers

Virtualization

Server Hardware

Storage

Networking

Applications

Runtimes

Security

Databases

Servers

Virtualization

Server Hardware

Storage

Networking

Traditional IT IaaS PaaS SaaS

Managed InternallyManaged by Cloud Provider

5

Page 6: EY Trajectory Final

EY Trajectory Program

Cloud Computing: SaaS• Software-as-a-service is a simple way to distribute software. SaaS providers host these

applications and they are made available to a customer over the internet• With software-as-a-service individuals no longer download and install programs on

individual computers• Programs are now all updated and maintained by the SaaS provider• The programs offered on the cloud are accessible from almost anywhere

6

Page 7: EY Trajectory Final

EY Trajectory Program

Risks & Mitigation of Cloud Computing

Risk of Cloud Computing Mitigation of Risks: SaaS

Data Breaches: • Cloud service providers host information from customers spread

across the world• This makes them large targets for information hackers

• Create long, complex passwords every 60 to 90 days• Encrypt data through the use of keys, digital signatures,

and other security applications

Outages:• Reporting outages due to power failures, natural disasters, etc.

takes longer due to longer lines of communication between the business and the cloud service provider

• Develop a Disaster Recovery/Business Continuity plan, including recovery services

• Keep customers informed throughout the disaster response process

Compliances:• The company must follow all legal and regulatory requirements that

apply to its information being stored on the cloud.• These requirements include: SOX, GLBA, ISO, etc.

• Define the services used through the SaaS provider, with any restrictions, regulations or compliance issues that need to be satisfied

7

Page 8: EY Trajectory Final

EY Trajectory Program

SaaS Cloud Provider List

Best Customer Relations Management Tool $3,000/Month

Private Cloud Offering $4,240/Month

Big Data Analytics Application $2,500/Month

Most Application & Service Offerings to Banking

Industry$1,890/Month

Competitive Advantage CustomersCost Per Office

8

Page 9: EY Trajectory Final

EY Trajectory Program

SaaS Cloud: Oracle & Workday

Yes No

No, Offers SaaS Extension on PaaS

Yes, Provides Pre-Built Applications

Yes, Multiple Preventative Security Procedures

Yes, Received TrustE Trusted Cloud Certification & More

$4,240 Per Month $2,500 Per Month

Private Cloud Offering

Standalone SaaS

Security and Disaster-Recovery

Price Per Office

9

Page 10: EY Trajectory Final

EY Trajectory Program

Spotfire Data Analysis• Test optimization of data analysis in the cloud

• Example: Spotfire Data Analytics• Immediately converts data sets into graphical displays that are easily manipulated

• Determine trends and draw conclusions with increased speed and accuracy• Provides significantly more options for creating relationships between different

variables in a data set• Comparison to Excel

• Pivot charts are more complicated to calibrate to the exact specifications of a relationship• Excel is less cooperative in displaying meaningful trends

10

Page 11: EY Trajectory Final

EY Trajectory Program

Data Analysis: Services vs. Age

11

Page 12: EY Trajectory Final

EY Trajectory Program

Data Analysis: Services vs. Education

12

Page 13: EY Trajectory Final

EY Trajectory Program

Recommendations from Data Analysis

• Total Average Services vs. Age• Older individuals tend to use more of Binghamton Bank’s services• Utilize SaaS mobile banking applications, appealing to younger audiences through increased

accessibility• Applications should be simple and easy to use for older users

• Total Average Services vs. Education• People with less education tend to utilize more of the Bank’s services• Applications should sustain usability to retain that less experienced audience• Develop cloud applications that cater directly to those with more education and banking

experience

13

Page 14: EY Trajectory Final

EY Trajectory Program

Utilization of Big Data• The use of data analytics in the cloud can be enhanced via a “big data” system

• Big data allows for an organization to handle data with velocity, variety and volume• The use of big data can help Binghamton Bank to respond to problems faster while

incurring fewer costs • The scalability of computing power will allow Binghamton Bank to run processes faster• The elimination of on-site hardware will allow Binghamton Bank to decrease costs

• Big data can help to improve customer relations management and make Binghamton Bank more efficient

14

Page 15: EY Trajectory Final

EY Trajectory Program

Utilization of Big Data

15

Page 16: EY Trajectory Final

EY Trajectory Program

Cloud Computing: IaaS• Infrastructure-as-a-service provides the hardware, storage, and memory capacity

necessary for a company wanting to utilize their services• With infrastructure-as-a-service, users have the ability to scale how much storage and

memory they need• Companies have more control over how much they use based upon how much they

need• Infrastructure-as-a-service is also accessible from any location, provided there is an

internet connection

16

Page 17: EY Trajectory Final

EY Trajectory Program

Risk and Mitigation of Cloud Computing

Risk of Cloud Computing Mitigation of Risks: IaaS

Data Breaches: • Cloud service providers host information from customers spread

across the world• This makes them large targets for information hackers

• Extend access management services into the IaaS cloud provider

• Ensure that Binghamton Bank has access to the necessary resources needed to ensure the applications and systems are secure.

Outages:• Reporting outages due to power failures, natural disasters, etc.

takes longer due to longer lines of communication between the business and the cloud service provider

• Develop a Disaster Recovery/Business Continuity plan, including recovery services

• Perform periodic backups of sensitive data

Compliances:• The company must follow all legal and regulatory requirements that

apply to its information being stored on the cloud.• These requirements include: SOX, GLBA, ISO, etc.

• Have a team devoted to ensuring the data is under the right encryptions and controls in place

• Make a thorough overview of the IaaS Provider of their security measures as well as level of segregations

17

Page 18: EY Trajectory Final

EY Trajectory Program

IaaS Cloud Provider List

Breadth and Integration of Wide Range of Services $70/Month

Supports High Demanding Cloud Applications $428/Month

Suitable Infrastructure for Big Data Analytics $86/Month

Global Servers and Granular Control over

Infrastructure$74/Month

Competitive Advantage CustomersCost Per Office

18

Page 19: EY Trajectory Final

EY Trajectory Program

IaaS Cloud: IBM & Amazon EC2

SoftLayer Elastic Compute Cloud

Ten Data Centers Across Five Continents

Data Centers Across Four Continents

Full Range of Cloud ServicesMigration of Applications

Variety of Services (Simple Storage Service, Elastic

Block Storage) and Monitoring Tools

$428 per Instance $70 per Instance

IaaS

Data Spread

Competitive Advantage

Estimated Price Per Month/Instance

19

Page 20: EY Trajectory Final

EY Trajectory Program

Business Impact Analysis and Risk Prioritization Tool

Determines the risks associated with having Binghamton Bank’s applications on the cloud

Calculates impact scores that allow users to easily compare risks and determine which are the most significant.

Generates procedures to help mitigate theses risks for Binghamton Bank.

20

Page 21: EY Trajectory Final

EY Trajectory Program

Impact Calculations

Input •Breaks all input into four main categories: financial impact, regulatory impact, customer impact, and public image impact•There is a fifth category that is used to label the risk

Calculate •All input regarding each category is quantified on a scale from 0 to 100. With 100 having the most impact•Certain categories are weighted more than others for the total impact score•The order of importance from most to least is as follows: Financial, Customer, Public Image, and Regulatory

Assign •Assigns each risk a rating of significance in a five tier system•These ratings allow for easy comparison between risks

21

Page 22: EY Trajectory Final

EY Trajectory Program

Risk Classifications

High

Medium-High

Medium

Medium-Low

Low

ImageMonetaryOperational

Relative Impact

Ris

k Ty

pe

22

Page 23: EY Trajectory Final

EY Trajectory Program

Tool Demonstration

23

Page 24: EY Trajectory Final

EY Trajectory Program

Data Analysis• Utilized the tool to analyze data on hypothetical cloud failures that were provided by

Binghamton Bank• Used Spotfire to put the data in graphical form

• Found some key applications that were at risk and that should be treated with caution• Devised some strategies to mitigate the risks associated with moving these applications to the

cloud• Detected some key failures that would significantly impact Binghamton Bank

• Created recommendations to ameliorate the risks associated with these impacts

24

Page 25: EY Trajectory Final

EY Trajectory Program 25

Significance of Issues and Data Types

Page 26: EY Trajectory Final

EY Trajectory Program 26

Significant and Insignificant Applications

Page 27: EY Trajectory Final

EY Trajectory Program

Recommendations: Cloud Migration• Moving the PayNow application and the Loan Default Management application over

to the cloud first will help to limit the risks of migration• These are the only two applications on this chart that aren’t currently on the cloud, and

moving these over to the cloud will pose minimal risks to Binghamton Bank• Migrating Change Detect, Core Banking Application, and Card & ATM Management to

the cloud last will allow for the team to acquire experience before moving significant applications• The Enterprise Content Management application is already on the cloud, so the IT Team at

Binghamton Bank should use the migration of this application as an example for the eventual migration of the applications listed above

27

Page 28: EY Trajectory Final

EY Trajectory Program

Recommendations: Cloud Migration

PayNow (SaaS)

Loan Default Management

(SaaS) Card & ATM Management

(IaaS)

Core Banking Application (IaaS)

Change Detect (SaaS)

28

Page 29: EY Trajectory Final

EY Trajectory Program

Cloud Migration - Projected Timeline• Cloud Assessment

• Perform an assessment of the cloud in terms of finances, security, and technical capabilities to determine if the cloud provider is suitable for Binghamton Bank

• Proof of Concept• Select a cloud provider based upon the assessment• Begin deploying small miniature applications to the cloud to ensure the application is running

smoothly on the cloud• Data Migration

• Consider different storage options and develop a data segmentation strategy to effectively migrate sensitive data over to the cloud

29

Page 30: EY Trajectory Final

EY Trajectory Program

Cloud Migration - Projected Timeline• Application Migration

• Determine strategy that will least disrupt current business activities when migrating to the cloud to ensure that business functions are still operating while applications are moving to the cloud

• Adopt a forklift application strategy or hybrid application strategy• Create a “cloud-aware” code for the application to help adjust the application when moving to

a different computing platform• Leverage the Cloud

• Expand scalability and attempt to automate elasticity to offer the extra benefits of using a cloud versus the legacy system

• Ensure the right encryption and security measures are in place in order to be in compliance with regulations

• Implement a dashboard to help monitor use of cloud resources

30

Page 31: EY Trajectory Final

EY Trajectory Program

Cloud Migration - Projected Timeline• Optimization Phase

• Observe different load patterns to help manage elastic environments more effectively• Continuously run the application over the cloud to find the best practices and update the

application when different regulations are enacted• Employee Integration

• Inform company of success of migration and train employees on how to utilize the application to help employees feel at ease with the new software

• Gather employee feedback to optimize success of cloud applications

31

Page 32: EY Trajectory Final

EY Trajectory Program

Cloud Migration - Projected Timeline

32

Page 33: EY Trajectory Final

EY Trajectory Program

Questions

33

Page 34: EY Trajectory Final

EY Trajectory Program

Appendix

34

Page 35: EY Trajectory Final

EY Trajectory Program

Tableau Data Analysis

35

Page 36: EY Trajectory Final

EY Trajectory Program

Tableau Data Analysis

36

Page 37: EY Trajectory Final

EY Trajectory Program

Tableau Data Analysis

37

Page 38: EY Trajectory Final

EY Trajectory Program

Tableau Data Analysis

38

Page 39: EY Trajectory Final

EY Trajectory Program

Recommendations from Data Analysis

• Diversify into other geographical areas• Iowa and New Jersey have the lowest debt to income ratios which shows that they can take

on more debt• District of Columbia and New Hampshire have the highest monthly incomes which shows they

can pay off more loans• Expand the sub-prime credit business

• Make loans to people to the sub-prime segment (625-650 FICO)• Expanding economy will improve the ability for people to make payments• Take advantage of low debt to income ratio trend in sub-prime sector

• Expand loan allocation towards housing and home improvement segment• Take advantage of an improving housing market• Diversifying loan purpose away from debt consolidation and credit card loans

39

Page 40: EY Trajectory Final

EY Trajectory Program

IBM Managed Cloud Offerings• Very large cloud provider with 10 data centers spread throughout 5 continents

• They are looking to expand to 40 data centers located in every major financial center

• Created for enterprises that value security and ease of access • Just opened a Cloud Resiliency Center in North Carolina to cut recovery times by 24-48 hours• Payment Card Industry Certified, HIPPA Compliant• Unique security and authentication model with a firewall with an optional VPN gateway• Data centers use IBM Power Systems and System X servers with Tier-1b storage

• Their cloud environment allows for IT Teams to set up applications within days

• IBM provides compliance services and other IT advisory services

40

Page 41: EY Trajectory Final

EY Trajectory Program

IBM Managed Cloud Costs and Risks

• IBM Managed Cloud Services has one of the highest costs• Our comparative cost put it at $428.32 per month• The average billing for a month of services was $7,000• Lost a CIA contract in part due to their billing mechanisms but have fixed the problem

• Having data centers spread throughout the world adds some risk to the platform• If Binghamton Bank stores data overseas then they will have to watch international laws• Having data overseas also opens up Binghamton Bank to data breaches• IBM allows for customers to select which data facilities they want their data in

41

Page 42: EY Trajectory Final

EY Trajectory Program

Amazon EC2 Offerings• Very large cloud provider with many data centers spread throughout four continents

• Amazon EC2 has a wide variety of customers• Many start-ups take advantage of Amazon’s cloud services and the CIA also uses Amazon

• The Amazon EC2 Platform also has many built-in security features• Created customer access points that allow for secure HTTP access• AWS Identity and Management tool allows customers to control the level of access for users• Users can also have the data and objects encrypted using Advanced Encryption Standard 256

• Amazon Cloud Watch provides real-time monitoring on resource utilization• Also allows for one to set up an automatic scaling features to manage instances

42

Page 43: EY Trajectory Final

EY Trajectory Program

Amazon EC2 Cloud Costs and Risks• Amazon has designed their payment plans so that you pay for what you use

• In our comparative cost analysis Amazon charged the typical rate for a cloud provider• Pricing model is extremely scalable and allows for flexibility in computing power

• Amazon has been in the news for data center outages and service problems• In April 2011 the EC2 system crashed and took down many websites of some very prominent

companies and also wiped out some firms’ data• In October 2012 a data center outage took down Foursquare and Flipboard• In August 2013 an EC2 data center in North Virginia experienced a hardware failure and caused

problems for Instagram, Vine, AirBnB, and Flipboard

43

Page 44: EY Trajectory Final

EY Trajectory Program

Google Compute Engine Offerings• Google Compute Engine is built on the same global infrastructure as their other japplications like YouTube and Gmail• Google also has a built-in load balancing service that spreads heavy workloads over their global

infrastructure• Google’s offers many services and a large global infrastructure which allows for fast processing

speeds throughout the world

• Google’s Auth 2.0 allows you to leverage Google Cloud Storage• Google’s virtual machines run with Linux applications

• Google is certified by ISO 27001 and SSAE-16

• Completed SOC 1 2 and 3

44

Page 45: EY Trajectory Final

EY Trajectory Program

Google Compute Engine Costs and Risks

• Google’s pricing is very scalable and is dependent on computing power• In our comparative cost analysis Google was the most expensive excluding IBM

• Google’s security has come into question recently• Google handles large quantities of confidential information (Gmail, Payment Information, etc.)• In March 2011 150,000 accounts were deleted from Google’s system• In September 2014 5 million Gmail usernames and passwords were stolen in a data breach• Brings into question the security of Google’s cloud platform

45

Page 46: EY Trajectory Final

EY Trajectory Program

OpSource Offerings• OpSource has nine data centers spread over five continents

• The services that they offer are called Private Compute as a Service• This service allows for controls over virtual servers, tiered storage, and networking• Allows clients a private cloud environment for computing supported by Dimension Data

• OpSource employs an Applications Programming Interface to automate and control the fvirtual server, storage, and network environment

• The platform has a 99.99% SLA and 24/7 support that assists its cloud services

• OpSource takes many security measures including firewall technology, VPN, and jIntrusion Detection Systems• They also have a Dimension Data Security Incident Response Team• OpSource is compliant with PCI, SSAE 16, and SAS 70 Type 2 certifications

46

Page 47: EY Trajectory Final

EY Trajectory Program

OpSource Costs and Risks• OpSource offers a very scalable monthly pricing model

• Pricing is based on storage utilized and processing power• For our comparative pricing calculation OpSource had comparable pricing to Amazon EC2

• OpSource has data centers spread throughout the world which brings up many risks• OpSource limits the risk of having data centers spread throughout the world by having strong

location protections • OpSource builds all of their data centers are built above sea level and are built in areas with

seismic compliance

47

Page 48: EY Trajectory Final

EY Trajectory Program

Comparative Cost CalculationAssumptions:

• 730 hours in an average month

• 264 operating hours (9AM-9PM each

week day; 34 hours of maximum operating

activity per month, 44 high activity, 186

medium activity)

• 174 remaining hours of medium activity

• 292 remaining hours of low activity

Activity Level Hours/Month

Low Activity 292

Medium Activity 360

High Activity 44

Max Activity 34

48

Page 49: EY Trajectory Final

EY Trajectory Program

Comparative Cost Calculation

Activity Level Cost/HourLow Activity $0.036Medium Activity $0.133High Activity $0.266Max Activity $0.532

Activity Level Hours/MonthLow Activity 292 Medium Activity 360High Activity 44 Max Activity 34

Activity Level Cost/Hour Hours/Month Cost/Month

Total Cost/Month

$88.184

Low Activity $0.036 292 $10.512Medium Activity $0.133 360 $47.880High Activity $0.266 44 $11.704

Max Activity

$0.532 34 $18.088 49

Page 50: EY Trajectory Final

EY Trajectory Program

Cloud Provider Comparison

Cost Security Financial Stability Services Provided2.0

2.5

3.0

3.5

4.0

4.5

5.0

IBM Managed Cloud Services Amazon EC2 Cloud Services Google Compute Engine OpSource

50