Welcome!

Cloud Security Authors: Xenia von Wedel, Pat Romanski, Kevin Jackson, Mehdi Daoudi, Elizabeth White

Related Topics: @DXWorldExpo, @CloudExpo, Cloud Security

@DXWorldExpo: Blog Post

Focus on Security Paves the Way for Expanding Services | @BigDataExpo #Security #BigData

Securing data provides Canadian online bank rapid path to new credit card business

The next BriefingsDirect data and security transformation use-case scenario describes how Tangerine Bank in Toronto has improved its speed to new business initiatives by gaining data-security agility.

We'll now learn how improving end-user experiences for online banking and making data more secure across its lifecycle has helped speed the delivery of a new credit card offering.

Here to explore how compliance, data security technology, and banking innovation come together to support a digital business success story is  Billy Lo, Head of Enterprise Architecture at Tangerine Bank in Toronto. The discussion is moderated by me, Dana Gardner, Principal Analyst at Interarbor Solutions.

Here are some excerpts:

Gardner: First, tell us a little bit about digital disruption in the banking industry. Obviously, there are lots of changes in many industries these days, but it seems that banking is particularly within the cross-hairs of disruption.

Lo: No doubt about that. Our bank used to be known as ING Direct. It started in Canada about 20 years ago. Our founders initially recognized this need and started a journey. Since then, we've been full-speed ahead. We're seeing the savings that we get out of being branchless and passing that back to the clients. That message resonates very well with our client base, and so far, so good.

Gardner: When you say online banking, there are no branches or no brick-and-mortar buildings with the word "bank" on the front. It's all done by mobile, via online. Am I missing anything?

Lo: On top of the fully digital experience, we also actually dive into a little bit of the physical as well, but not in a traditional way.

At Tangerine, we have a couple of other in-person kinds of channels. One is what we call a café. In an informal setting, you can get a coffee or orange juice at the café and get some advice. But most of the functionality is available through the digital channel, through a tablet onsite with someone guiding you along the way.

We've recently been exploring a concept called Mobile Pop-Ups, but not at malls. We refurbished containers and put them into different location to introduce the concept within your bank to different geographies. We also found that very rewarding, because you can reach many people online, but there are still some who need a little extra nudge to get comfortable with starting a banking relationship online.

User expectations

Gardner: That brings up an interesting topic. User expectations are also rapidly evolving in our world. Is there something about somebody who is attracted to online banking that you need to be aware of? Is there something about speed or agility? What is it about the banking customer who prefers online that you need to cater to?

Lo

Lo: Dana, you're right on the point. In this case, both speed and agility are expected from a bank that highlights their services in terms of user experience online. They're now used to the Gmail inbox, Facebook, instant messaging. The good old days of submitting a form and waiting for someone to come back to you is gone, really gone.

From an expectation point of view, we're heavily impacted by the consumerization of technology. All those things that you see on a smartphone, taking pictures and depositing a check, are almost, as we call it, table stakes. We have to work harder at inventing things that surprise and delight our clients.

Gardner: Of course a big part of being able to delight your customers is to know them and have data about them that you can use to allow services to be customized and personalized. So data is essential, but at the same time, you're in a highly regulated business where privacy issues and security are big concerns. How are you achieving the balance between data availability and data protection?

Lo: We in the banking business are in the business of trust. In everything that we do, trust has to be number one. We have to be ready for any kind of questions from our client base on how we handle the information. There's no doubt that transparency will help, and over time, with transparency, our clients learn that we're up-front in how we're using information. And it's not just transparency, but also putting the information in a way that's easily understandable up-front.

If you look at our registration process, one of the first thing that we tell people is "Here is our not-so-fine print." It's in big, bold fonts and that’s very important, because especially in a digital bank, a lion's share of the interactions are through non-face-to-face kind of interactions. If you invest the time in being transparent, invest the time in building up your security infrastructure to protect your information, and be vigilant about all of the current things that are happening. It can be done.

We in the banking business are in the business of trust. In everything that we do, trust has to be number one./div>

Gardner: Tell us a little bit about your journey toward this new credit-card offering and why putting the blocks of infrastructure investment in place in advance is so important for agility and for quality of service in a new offering.

Lo: Let's take this journey back a little bit as far as our credit-card offering is concerned. We started out as a savings bank and highlighted our high-interest offering at the beginning. That resonated well, and we quickly recognized the fact that we're going to need to expand our product offering. People actually wanted to use us as an everyday bank.

Unfortunately, at the time, we didn’t have the complete suite of products that our clients would need. So, over time, we built up with mutual funds, investments, and mortgages, and the last piece of the puzzle is credit cards. Once we have that, we can officially say to everybody that we're not just a peripheral bank, but have real full-service functions that you can have to support your everyday life.

In our case, efficiency and the speed of adoption is key. Every month that we wait for this offering to come out of the door, we're losing opportunities to turn a regular client into a full-service client. So, we were starting from scratch. We had zero infrastructure. We hired. We built up the technology behind it, partnered with a few of our trusted partners to build up the infrastructure, but the foundation does take time to do it right.

Foundational effort

One thing that not a whole lot of people understand is the foundational effort. If you spend a month or two on building up the right foundation, the saving going forward is actually exponential. With HPE, we adopted the tokenization solution to help protect [credit] card number information. We were able to complete the whole journey in a very quick fashion. That saves us a lot of time, because everything revolves around the card number. If we don’t get the foundation done right at the beginning, quickly, the cost and schedule impact is exponential.

Gardner: So quality is important because you want to get it right the first time. It's not just doing it quickly; it’s also doing it correctly. If you have to go back and redo infrastructure, that can be a huge tax on your innovation and really put a cultural drag on how things proceed.

Lo: Right on, and I don’t even want to think about it. Seriously, on the adoption of these foundational components, speed is key and that saves us a lot of hassle going forward in conversion as well as data cleansing. Once the cat is out of the bag, if you will, it’s so much harder.

Gardner: Billy, I've heard from other organizations that recognize that moving data around in the old-fashioned way doesn't work. Being PCI compliant, having privacy issues met, in fact, having less data and detailed information about a customer is much more desirable. Is that the case with you and the tokenization process and encryption use? How would you describe about what data to keep, what data to transact, and what's the right balance?

Lo: Just as any other security person would tell you, you have to know where the walls and the doors are with security information. We made a conscientious effort in identifying where we would need the actual card number available, such as for collections or for some operational process, and identify who needs them, where the door needs to be, and then lock them up. Tokenization allows us to do that without too much overhead, and overall, our experience has been definitely well worth investing the time.

Now, I have one place to monitor, and one door to monitor. As soon as I allow access to that information, I'll have an audit trail of who accessed what, when, and how. That gives me the comfort level that I have. Our clients specifically demand it, both on the business side and the front-end client point of view. They appreciate that.

Gardner: For some of our audience, who are not security folks per se, describe what secured data and stateless tokenization means. How does that work -- just an idea architecturally of how this actually works?

Lo: Imagine your card number or any kind of personally identifiable information (PII) that is important to you. Think of it as a piece of fruit, an apple, and you pass it around identifying yourself. Tokenization, and the Stateless Tokenization technology that HPE offers in particular, is that you have an exchange process. The middleman takes your apple, turn it into a pear through a specific algorithm. The reverse process can be applied when someone gives me a pear and ask for an actual apple; the visual is coming back to you.

So, every time, every piece of information that is passed along in the message exchange, they go through this process. The key term here is stateless, of course, so that we don’t have a rack of this mapping information stored somewhere, which becomes yet another vulnerability. That makes our operations a lot easier, especially in a multi data-center environment.

Gardner: So, you get the use of that tokenized data, but you don’t have to store it. It’s not in the state in different places that then have to be protected. There are fewer spots where somebody could be liable to expose it or get access to it.

Difficult to guarantee

Lo: No doubt. In fact, if you think about a larger-scale environment where pieces of information are stored in the cloud, in multiple data centers, in some cases, you may not even know physically where they are. It's very difficult to make that guarantee and say that we know where our information is, and that’s just online. There are the backups that are necessary to run a successful operation.

Gardner: We've heard now that you started from scratch with your credit-card activities. You put in the necessary infrastructure, recognizing that doing it right and fast is a great saver over time. Tell us a little bit about the actual credit card project. How has it come about, and where are you in its delivery to the market?

Lo: It’s been very exciting for us. Our clients have been looking forward to this. We started a public launch in March this year, after about six month’s trial within the bank and with some selected clients. We're now full force and we’ve been running campaigns.

How do we do this? How do we attract our clients? First of all, being transparent. Our product features are very specific, and we don’t hide the interest rate. We're very upfront about fair fees. We're offering promotions right now in three categories. We have four percent cash back for our product, which is a very attractive offering that the market is looking forward to. It’s been working really well.

Well over 80 percent of the merchants in the Canadian marketplace are already Tap and Go and chip ready.

Gardner: And what’s the name of the card? Is it just Tangerine Bank card or is there a branded name to it?

Lo: There is nothing fancy about it right now. This is our only card; so, it can’t go wrong.

Gardner: And is it both debit and credit?

Lo: We've had a debit card for a while now. In this case with the credit card, we have the technology behind it that uses the typical chip-card infrastructure as well as the MasterCard PayPass Tap and Go. And we're also venturing into a mobile payment in the very near future.

Gardner: That was my very next question. Now that you’re a full service bank online, more and more people are wondering how to automate this payment process, particularly with a mobile device. We’ve seen other organizations attempt this, but it doesn’t seem to have gone mainstream yet. Tell us about what you foresee for mobile payments and how you think you might be a leader in that market?

Lo: In the Canadian marketplace, the merchant landscape is very different from most other geographies. Well over 80 percent of the merchants in the Canadian marketplace are already Tap and Go and chip ready.

With the adoption of mobile payments in big-vendor environments such as Apple Pay as well as Android Pay, we're very, very optimistic. Tap and Go is already a significant component of the payment process, especially for small amounts. Naturally, this is just an extension, whether it’s through the mobile phone or your watch. The impediments that other geographies have around merchants’ reluctance or infrastructure constraints doesn’t really exist in the Canadian market place. So, we're ready.
Extra distance

Gardner: It seems to me that, given the emphasis on user experience and convenience, those organizations like yours that go the extra distance and make that user experience simple, transparent and worthwhile in terms of convenience and productivity, that customers will just put more and more and more of their transactions into that card. It could become so central to their lives. Is that part of your strategy?

Lo: Yes, in many ways. The Tap and Go payment process, once the merchant environment supports it, is very, very efficient. The more information we have around where our client is spending their time, the more we can customize our offering to cater for their specific needs and personalize insights that support their everyday life. No doubt about that. In fact, speaking of the credit card offering and differentiation factor, one of the things that we made very clear is that convenience comes with a cost in terms of people’s comfort level in using that product.

The more information we have around where our client is spending their time, the more we can customize our offering.

Now, if you lose your phone, what’s going to happen? We made it a very high priority to enable our client to freeze the card very easily. Let’s say, if I leave my card in a restaurant, I just pick up my phone or go to an Internet-connected device, freeze my card -- don’t cancel it, freeze it -- until I find it. So, we take quite a bit of time in exploring and making sure that people will feel comfortable using this new channels.

Gardner: It sounds like we're only just scratching the surface on these ancillary services that could be brought to bear when you have the underlying infrastructure in place, the security and data availability in place. It’s going to be interesting in the next several years how convenience can be even completely redefined.

Lo: Yes. We can't wait to continue to innovate for our clients, and in many ways, our clients are looking forward to all of these things as we progress. Banking is our everyday life.

You may also be interested in:

More Stories By Dana Gardner

At Interarbor Solutions, we create the analysis and in-depth podcasts on enterprise software and cloud trends that help fuel the social media revolution. As a veteran IT analyst, Dana Gardner moderates discussions and interviews get to the meat of the hottest technology topics. We define and forecast the business productivity effects of enterprise infrastructure, SOA and cloud advances. Our social media vehicles become conversational platforms, powerfully distributed via the BriefingsDirect Network of online media partners like ZDNet and IT-Director.com. As founder and principal analyst at Interarbor Solutions, Dana Gardner created BriefingsDirect to give online readers and listeners in-depth and direct access to the brightest thought leaders on IT. Our twice-monthly BriefingsDirect Analyst Insights Edition podcasts examine the latest IT news with a panel of analysts and guests. Our sponsored discussions provide a unique, deep-dive focus on specific industry problems and the latest solutions. This podcast equivalent of an analyst briefing session -- made available as a podcast/transcript/blog to any interested viewer and search engine seeker -- breaks the mold on closed knowledge. These informational podcasts jump-start conversational evangelism, drive traffic to lead generation campaigns, and produce strong SEO returns. Interarbor Solutions provides fresh and creative thinking on IT, SOA, cloud and social media strategies based on the power of thoughtful content, made freely and easily available to proactive seekers of insights and information. As a result, marketers and branding professionals can communicate inexpensively with self-qualifiying readers/listeners in discreet market segments. BriefingsDirect podcasts hosted by Dana Gardner: Full turnkey planning, moderatiing, producing, hosting, and distribution via blogs and IT media partners of essential IT knowledge and understanding.

@ThingsExpo Stories
Coca-Cola’s Google powered digital signage system lays the groundwork for a more valuable connection between Coke and its customers. Digital signs pair software with high-resolution displays so that a message can be changed instantly based on what the operator wants to communicate or sell. In their Day 3 Keynote at 21st Cloud Expo, Greg Chambers, Global Group Director, Digital Innovation, Coca-Cola, and Vidya Nagarajan, a Senior Product Manager at Google, discussed how from store operations and ...
"There's plenty of bandwidth out there but it's never in the right place. So what Cedexis does is uses data to work out the best pathways to get data from the origin to the person who wants to get it," explained Simon Jones, Evangelist and Head of Marketing at Cedexis, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
In his session at 21st Cloud Expo, Carl J. Levine, Senior Technical Evangelist for NS1, will objectively discuss how DNS is used to solve Digital Transformation challenges in large SaaS applications, CDNs, AdTech platforms, and other demanding use cases. Carl J. Levine is the Senior Technical Evangelist for NS1. A veteran of the Internet Infrastructure space, he has over a decade of experience with startups, networking protocols and Internet infrastructure, combined with the unique ability to it...
SYS-CON Events announced today that CrowdReviews.com has been named “Media Sponsor” of SYS-CON's 22nd International Cloud Expo, which will take place on June 5–7, 2018, at the Javits Center in New York City, NY. CrowdReviews.com is a transparent online platform for determining which products and services are the best based on the opinion of the crowd. The crowd consists of Internet users that have experienced products and services first-hand and have an interest in letting other potential buye...
"MobiDev is a software development company and we do complex, custom software development for everybody from entrepreneurs to large enterprises," explained Alan Winters, U.S. Head of Business Development at MobiDev, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
SYS-CON Events announced today that Telecom Reseller has been named “Media Sponsor” of SYS-CON's 22nd International Cloud Expo, which will take place on June 5-7, 2018, at the Javits Center in New York, NY. Telecom Reseller reports on Unified Communications, UCaaS, BPaaS for enterprise and SMBs. They report extensively on both customer premises based solutions such as IP-PBX as well as cloud based and hosted platforms.
WebRTC is great technology to build your own communication tools. It will be even more exciting experience it with advanced devices, such as a 360 Camera, 360 microphone, and a depth sensor camera. In his session at @ThingsExpo, Masashi Ganeko, a manager at INFOCOM Corporation, introduced two experimental projects from his team and what they learned from them. "Shotoku Tamago" uses the robot audition software HARK to track speakers in 360 video of a remote party. "Virtual Teleport" uses a multip...
Gemini is Yahoo’s native and search advertising platform. To ensure the quality of a complex distributed system that spans multiple products and components and across various desktop websites and mobile app and web experiences – both Yahoo owned and operated and third-party syndication (supply), with complex interaction with more than a billion users and numerous advertisers globally (demand) – it becomes imperative to automate a set of end-to-end tests 24x7 to detect bugs and regression. In th...
"Space Monkey by Vivent Smart Home is a product that is a distributed cloud-based edge storage network. Vivent Smart Home, our parent company, is a smart home provider that places a lot of hard drives across homes in North America," explained JT Olds, Director of Engineering, and Brandon Crowfeather, Product Manager, at Vivint Smart Home, in this SYS-CON.tv interview at @ThingsExpo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
"IBM is really all in on blockchain. We take a look at sort of the history of blockchain ledger technologies. It started out with bitcoin, Ethereum, and IBM evaluated these particular blockchain technologies and found they were anonymous and permissionless and that many companies were looking for permissioned blockchain," stated René Bostic, Technical VP of the IBM Cloud Unit in North America, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Conventi...
"Cloud Academy is an enterprise training platform for the cloud, specifically public clouds. We offer guided learning experiences on AWS, Azure, Google Cloud and all the surrounding methodologies and technologies that you need to know and your teams need to know in order to leverage the full benefits of the cloud," explained Alex Brower, VP of Marketing at Cloud Academy, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clar...
It is of utmost importance for the future success of WebRTC to ensure that interoperability is operational between web browsers and any WebRTC-compliant client. To be guaranteed as operational and effective, interoperability must be tested extensively by establishing WebRTC data and media connections between different web browsers running on different devices and operating systems. In his session at WebRTC Summit at @ThingsExpo, Dr. Alex Gouaillard, CEO and Founder of CoSMo Software, presented ...
A strange thing is happening along the way to the Internet of Things, namely far too many devices to work with and manage. It has become clear that we'll need much higher efficiency user experiences that can allow us to more easily and scalably work with the thousands of devices that will soon be in each of our lives. Enter the conversational interface revolution, combining bots we can literally talk with, gesture to, and even direct with our thoughts, with embedded artificial intelligence, whic...
SYS-CON Events announced today that Evatronix will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Evatronix SA offers comprehensive solutions in the design and implementation of electronic systems, in CAD / CAM deployment, and also is a designer and manufacturer of advanced 3D scanners for professional applications.
Leading companies, from the Global Fortune 500 to the smallest companies, are adopting hybrid cloud as the path to business advantage. Hybrid cloud depends on cloud services and on-premises infrastructure working in unison. Successful implementations require new levels of data mobility, enabled by an automated and seamless flow across on-premises and cloud resources. In his general session at 21st Cloud Expo, Greg Tevis, an IBM Storage Software Technical Strategist and Customer Solution Architec...
To get the most out of their data, successful companies are not focusing on queries and data lakes, they are actively integrating analytics into their operations with a data-first application development approach. Real-time adjustments to improve revenues, reduce costs, or mitigate risk rely on applications that minimize latency on a variety of data sources. In his session at @BigDataExpo, Jack Norris, Senior Vice President, Data and Applications at MapR Technologies, reviewed best practices to ...
An increasing number of companies are creating products that combine data with analytical capabilities. Running interactive queries on Big Data requires complex architectures to store and query data effectively, typically involving data streams, an choosing efficient file format/database and multiple independent systems that are tied together through custom-engineered pipelines. In his session at @BigDataExpo at @ThingsExpo, Tomer Levi, a senior software engineer at Intel’s Advanced Analytics gr...
When talking IoT we often focus on the devices, the sensors, the hardware itself. The new smart appliances, the new smart or self-driving cars (which are amalgamations of many ‘things’). When we are looking at the world of IoT, we should take a step back, look at the big picture. What value are these devices providing? IoT is not about the devices, it’s about the data consumed and generated. The devices are tools, mechanisms, conduits. In his session at Internet of Things at Cloud Expo | DXWor...
Everything run by electricity will eventually be connected to the Internet. Get ahead of the Internet of Things revolution. In his session at @ThingsExpo, Akvelon expert and IoT industry leader Sergey Grebnov provided an educational dive into the world of managing your home, workplace and all the devices they contain with the power of machine-based AI and intelligent Bot services for a completely streamlined experience.
SYS-CON Events announced today that Synametrics Technologies will exhibit at SYS-CON's 22nd International Cloud Expo®, which will take place on June 5-7, 2018, at the Javits Center in New York, NY. Synametrics Technologies is a privately held company based in Plainsboro, New Jersey that has been providing solutions for the developer community since 1997. Based on the success of its initial product offerings such as WinSQL, Xeams, SynaMan and Syncrify, Synametrics continues to create and hone inn...