It was mentioned by both eSentire’s Steve McGeown and Eze Castle’s Steve Schoener during our recent webinar that internal threats to security are just as likely to occur when it comes to cybercrime and security breaches.

A recent Wall Street Journal article, IT Protects the Company, Who Protects IT, included statistics from a PricewaterhouseCoopers survey of executives about economic crimes. Several jarring statistics were provided, including:

• 56 percent of respondents who said they had experienced economic crime in the past 12 months said the main perpetrator of the most serious fraud was someone inside the organization;
  
• 53 percent of respondents who saw a risk of cybercrime within their organization said there was a risk of it coming from the IT department – the highest percentage from any department; and
  
• 18 percent of frauds reported by respondents in 2011 were detected by electronic monitoring of suspicious activity and transactions, up from 5% in 2009.

But it’s not just a firm’s IT department that could pose a risk. Anyone at the company with a certain level of access could gain control of sensitive information. This is why we recommend firms employ the principle of least privilege. In its simplest terms, this means only allowing access to data, documents and resources to personnel who need it. Members of the IT staff likely need more access than employees in the Human Resources or Marketing departments, for example.

We’ve talked about these before, but here are a few internal security best practices to keep in mind:

• Maintain a strong password policy. In addition to creating a strong password and changing it frequently, be sure not to write it down or give it out. Creating a tough password means nothing if it can be easily discovered by a coworker. And remember, "password" is not a good password.
  
• Use multi-factor authentication. In order to access certain systems or data, your firm should employ at least two-factor authentication practices. This means that in addition to providing a password for access, employees would also need to provide a separate PIN number, for example. For access to a data center, firms may want to use biometric screening as a second authenticator.
  
• Take control of company-sanctioned mobile devices. What about when an employee leaves the firm? Can he/she still access company data and information from their mobile device? It’s important to remember that even if an employee leaves, access may not be automatically terminated. Firms should ensure they restrict access when employees leave and are also able to wipe devices remotely if necessary.

Just remember: when it comes to protecting your company’s sensitive information, don’t just train your eyes outward. Look inside too.

Want More on Hedge Fund Security?

• Hedge Fund Security Part 1: Six Basic but Overlooked Security Practices
  
• Malware Definitions & Security Tips: Hedge Fund Security Part 2
  
• Hedge Fund Security Part 3: How secure are your iPhone and iPad?

Source: Wall Street Journal
Photo Credit: eHow

Scalable, Flexible and Available

The cloud offers firms the option of scalability without the serious financial commitments required for infrastructure purchase and maintenance. With cloud services there is no vendor lock-in or implied commitment beyond duration so firms have the flexibility to easily evolve their IT environment.

Another benefit is the ability to seamlessly add more users and/or computing resources to match the firm’s requirements. A hedge fund private cloud can deliver the infrastructure, bandwidth and network resiliency to accommodate business requirements for high speed access, storage and applications.

Finally, a cloud solution offers advantages around time to deployment since the timely element of a custom build-out is eliminated.

Cost Containment

Through cloud services firms gain the opportunity to convert from Capex to Opex. While building out a comm room or data center requires capital expenditures, using an external cloud service that offers a pay-as-you-go service falls into ongoing operating expenditures. The transition to a cloud service provides many cost-savings beyond just eliminating the need to purchase and refresh equipment.

When weighing the costs associated with maintaining a server and other data center equipment in-house it is important to consider:

• Direct costs including power, real estate/floor space, storage, and IT staff to manage the resources
  
• Indirect costs including network and storage infrastructure and IT staff to manage the environment
  
• Overhead costs including procurement, accounting and IT

When added to the cost of an internal server, these factors significantly raise the monthly overall cost to host a server and make cloud services more attractive.

Increased Operational Efficiencies

The cloud delivery model also offers many benefits around increasing operational efficiencies at hedge funds that translate into streamlined technology oversight and potential cost savings. These include:

• Eliminating server technology refreshes in-house while also ensuring a firm has the latest technology powering it
  
• Reducing IT overhead by using a third party, such as Eze Castle Integration, to handle all infrastructure maintenance, monitoring and management
  
• Decreasing the cost of designing and deploying new applications due to the standardized infrastructure that is fully managed

For more on how your hedge fund can benefit from cloud computing contact us or visit our Cloud Forum.

Speaking on the webinar were two great security experts: Steve McGeown, VP of Marketing and Product Management at eSentire, and Steve Schoener, VP of Client Technology here at Eze Castle Integration.

Below is a short summary of the key points addressed by our expert speakers.

Why are Hedge Funds at Risk?

The truth is that there is a lot of animosity towards firms on Wall Street, and this distaste has spurred the increase in potential threats to hedge funds and investment firms. Since the US recession began in 2008, people have been looking for someone to blame, and oftentimes that blame has been placed on hedge funds. In some cases, hackers or “hactivists” are merely looking to steal information, and in other cases, they may be looking to tarnish and take down funds that they believe are responsible for our current economic state. Hackers have stepped up their games and even made a point to target specific firms in order to seek revenge.

In addition to external threats, some of the biggest risks to your company may be located internally. One example that eSentire's Steve McGeown provided of this was an instance in which a company’s employee was caught downloading an entire CRM database onto her personal Gmail account. Instances like this are prime examples of how important it is to maintain strict internal policies and procedures to keep your firm’s information safe at all times. (We’ll be dedicating an entire blog article to this topic next Thursday, 5/17, so be sure to come back then!).

Hedge Fund Security Best Practices

Hedge funds and investment firms may be easy targets for hactivists, but with proper policies and procedures in place, firms can ensure their sensitive data and information doesn’t fall into the wrong hands. On the most basic level, firms should employ anti-virus software and network firewalls to minimize the amount of traffic into the firm’s network. To take things a step further, firms can utilize systems like intrusion detection to more accurately and aggressively monitor inbound threats.

Having the right systems in place can only get you so far. Your firm also needs to underscore the importance of security by maintaining strict policies that outline acceptable behavior and security best practices.

Following are a few policies we recommend your firm employ:

• Access Control Policy: Provides direction for managing and granting access to information systems
  
• Acceptable Use Policy: Outlines acceptable use of Internet/Extranet/Social Media/etc.
  
• Incident Response Management Policy: Outlines the requirements and procedures for dealing with an information security breach or incident
  
• Personal Communications Device Policy: Describes requirements for use of personal communication devices

To hear more from our expert speakers, Steve McGeown and Steve Schoener, listen to the complete webinar recording here: Network Security Threats Exposed: How to Keep Your Firm’s Data and Infrastructure Safe.

Also, be sure to check out these articles:

• Cyber Security Threats: Is Your Fund Protected?

• Hedge Fund Security Part 1: Six Basic but Overlooked Security Practices

• Malware Definitions & Security Tips: Hedge Fund Security Part 2

So, as part of our ongoing effort to provide educational content to our loyal Hedge IT readers, we have compiled a list of the most commonly used cloud computing terms. We hope this A-to-Z "dictionary" will serve as a valuable reference guide for you in your exploration into the world of cloud technology!

To learn more about cloud computing, be sure to check out our new
educational site, the Cloud Forum, as well as these additional resources:

Knowledge Center: Cloud Computing Resources for Hedge Funds Article: Doing Your Cloud Homework: Answering Legal, Tech & Security Qs eBook: Examining Cloud Computing in the Investment Industry Webcast: Moving to the Cloud: Critical Considerations for Fund Managers

Not only was the Cloud Summit the first event of its kind, but it was also where we debuted Eze Castle TV! Some of our attendees were brave enough to face the camera and tell us what they thought of our event. Watch the video below to see what they had to say!

To watch more of our videos, visit www.YouTube.com/EzeCastleECI.

So…drumroll please… We are excited to unveil the newest member of the Eze Castle Integration thought leadership family – Cloud Forum!

On the Cloud Forum you will find rich information:

• 

  What is Cloud Computing
  • History of Cloud Computing
    
• Cloud Architecture
  • Types of Cloud Computing Models
  • Unified Cloud Architecture Overview
    
• Operating in the Cloud
  • Application Hosting
    
• Cloud Security
  • Top Threats
  • Best Practices
  • Questions to Ask Cloud Providers
    
• Cloud Computing Dictionary A-Z
  
• Cloud Resources: Articles, Videos and Events

Here is a snapshot of our newest family member:

Visit Cloud Forum Now

We hosted our first-ever Hedge Fund Cloud Summit earlier this week at the Sofitel New York, bringing together over 100 operational and technology professionals from the investment industry for what truly was an exciting day.

Event hosts Bob Guilbert and Vinod Paul kicked off the afternoon by offering their perspective on the changes within the hedge fund market relative to cloud computing and why it has steadily become a reliable technology option for firms of all sizes and strategies. Five years ago, most hedge funds were involuntarily relying on traditional on-premise infrastructures marked by intricate Comm. Room build-outs and heavy upfront capital expenditures. The average cost for servers, storage, networking and other equipment? Two hundred to five hundred THOUSAND dollars.

As the industry has changed and technology has evolved, the cloud has emerged as a beneficial solution for firms looking to increase their efficiencies and reduce their CapEx. Hedge funds and investment firms are using the cloud in a multitude of ways and for a variety of reasons. We’ve come a long way from back in 2008 when respondents of an InformationWeek survey said that “cloud” was just a carelessly used marketing term.

But times have changed. And the Cloud Summit was the perfect opportunity for fund professionals on both the operations and technology levels to gather together and gain insight into some of the key cloud-related discussion point being heard throughout the industry. And, as expected, the most popular panel of the day was focused on cloud security.

We hope you share more insights from the Cloud Summit with you soon, but in the meantime, check out some of our expert panelists on display! Also, be sure to visit our new Cloud Forum website that answers (almost) every question you could have about cloud computing for hedge funds.

Examining the changing role of the hedge fund CTO/CIO are Moderator Bob Guilbert (Eze Castle Integration)
and panelists Chris Turek (Evercore Partners), Doug Kline (Deutsche Bank) and Perry Vais (BlueMountain Capital Partners)

Discussing cloud security before the panel starts are Moderator Mike Abbey (Eze Castle Integration)
and panelists Eldon Sprickerhoff (eSentire), Steve Schoener (Eze Castle Integration),
Tom Smykowski (Goldman Sachs) and Elad Yoran (Vaultive/Cloud Security Alliance)

As we look forward to this great event, we got to thinking about our own help desk team and support teams in general. What makes one help desk better than another? What are the key ingredients in providing the best possible IT support to clients?

Here are our thoughts.

Recipe for Help Desk Success

Ingredients:

• A team of experts –available around the clock – with the technical skills and resources necessary to efficiently respond to and resolve clients’ IT issues
• Proactive system maintenance to help prevent common issues before they become costly, and to ensure all client systems are up-to-date with the latest patches and enhancements
• A well-documented escalation procedure for more challenging IT issues, especially those that may require on-site assistance

Directions:

Combine all ingredients.

Start with high-quality technical support to all clients via both email and telephone communication. For basic client questions, the help desk analysts should be well-trained in handling incoming requests. For slightly more challenging or intricate issues, the analysts should have easy access to all appropriate resources necessary to resolve the issue.

Next, incorporate a team of personable and quick-working resource coordinators to assist clients with more advanced issues by providing access to on-site support engineers. These individuals dispatch field engineers to the clients’ offices if the issue calls for that level of hands-on support.

Then, mix in a top notch system maintenance group which keeps client service standardized by completing maintenance testing checklists on an ongoing basis. This team should document and analyze any trends they find during scheduled maintenance periods. This proactive service method helps mitigate the incoming traffic to the other help desk sub-groups, whose services are, by nature, more reactive. If a maintenance team analyst discovers something amiss in a client’s system, they should escalate the matter to the resource coordination group so that an engineer can be dispatched to investigate and resolve the issue.

Finally, combine all of the previously mentioned ingredients together and implement a clearly-defined client issue escalation procedure that is documented and thoroughly understood by all analysts on the help desk team. A formalized process for escalating challenging issues to the most capable internal resources ensures that even the most in-depth issues are addressed in a timely manner, with as little disruption as possible on the client’s end.

Serves:

All clients around the world, 24 hours a day, seven days a week, 365 days a year

For more information on the Eze Castle Integration Global Support Desk, check out the following video or contact an Eze Castle representative today!

The report found a 27% rise in cyber security vulnerabilities between 2009 and 2010 and noted that “early in 2011 officials at the International Monetary Fund revealed that it had been targeted by a sophisticated cyber attack – a threat that was considered so serious, the World Bank severed the computer ties through which the two organisations shared information.”

Another example cited was that “in June 2011 a black-hat hacker group known as LulzSec (or “Lulz Security”) targeted the website of the CIA in the US using a denial-of-service attack. This was the latest in a string of similar attacks against a range of government and public sector bodies.”

While these two examples occurred at large organizations, the risks facing smaller firms (read: hedge funds) are just as real. To that end, we recently had eSentire into our Boston office to speak with a group of hedge fund CTOs about the security landscape and their managed security technology. Feedback on eSentire’s offering and approach was positive and the spark for this tech spotlight article.

The Spotlight

Eze Castle Integration and eSentire are working together to give hedge funds using the Eze Private Cloud or on-premise IT complete protection from security risks that could jeopardize operations and threaten proprietary information.

eSentire’s core solutions combine advanced security technology with highly trained security experts to proactively identify potential vulnerabilities, detect and prevent intrusion, and conduct forensic traffic analysis for predictive threat profiling. Core components of eSentire’s eSentinel managed security services are network interceptor and Security Operations Center (SOC). These deliver:

Network Interceptor

• Intrusion Detection / Intrusion Prevention
• Bandwidth Tools
• EXE Blocking / Quarantine / DPI
• DNS Interception
• SSL Interception/Proxying
• Attachments and End-of-Day Reports
• Forensic Traffic and Incident Analysis

Security Operations Center

• Service Level Objectives
• Change/Release Control
• Operational Reporting/Relationship
• SOC Escalation/Resolution Mechanisms
• Root Cause Analysis Functions
• Systems Group Maintenance

Up Next

This coming Thursday (April 18, 2012) we are hosting a webinar with eSentire titled “Network Security Threats Exposed: How to Keep Your Fund's Data & Infrastructure Safe.” The webinar will provide attendees details on:

• Specific network security threats, including data leakage and network intrusion;
  
• Understanding of security threat management practices such as intrusion detection and prevention, forensic traffic analysis and web and application assessments; and
  
• Specific policies and procedures to employ for optimal security management.

Register for the webinar HERE.

Want More on Hedge Fund Security?

• Hedge Fund Security Part 1: Six Basic but Overlooked Security Practices
  
• Malware Definitions & Security Tips: Hedge Fund Security Part 2
  
• Hedge Fund Security Part 3: How secure are your iPhone and iPad?
  
  

Today is the second birthday for Hedge IT, our sweet, informative blog. So I know exactly what I was doing two years ago – I was writing and posting our first Hedge IT article, aptly titled “Welcome to Hedge IT.”

Sticking with the theme of ‘welcome to…’ and giving a nod to our upcoming Hedge Fund Cloud Summit, today’s post is a welcome to the changing world of IT – now that the business world is going to the cloud.

Paradigm shifts are commonplace in the IT world. When talking to an IT veteran about cloud, he/she will likely reflect on the move from centralized computing (mainframes/mini-computers) to decentralized computing (Windows NT/Novell) and now back to centralized computing with the cloud.

The prevalence of the cloud means IT will shift from hands-on work with hardware and installations to resource management, integration, capacity planning, and technical architecture. IT roles will evolve from “Systems Admins” and “Systems Architects” to “Cloud Admins” and “Cloud Architects.” This evolution is exciting and likely scary all at once. The well-known book, “Who Moved My Cheese?,” provides the following insights for coping with and preparing for change:

• Change Happens. They Keep Moving the Cheese.
  
• Anticipate Change. Get Ready For The Cheese To Move.
  
• Monitor Change. Smell the Cheese Often So You Know When It Is Getting Old.
  
• Adapt To Change Quickly. The Quicker You Let Go Of Old Cheese, the Sooner You Can Enjoy New Cheese.
  
• Change. Move with the Cheese.
  
• Enjoy Change! Savor The Adventure And Enjoy the Taste Of New Cheese!
  
• Be Ready To Change Quickly and Enjoy It Again. They Keep Moving The Cheese.

To support your expedition to enjoy the big cheese in the sky, here is a snapshot of the technical and non-technical skills that make a knowledgeable Cloud Admin or Cloud Architect.

Technical Must-Have Skills

Non-Technical Must-Have Skills

We'll explore this topic futher at our Hedge Fund Cloud Summit in NYC, and be sure to write a follow up article for those of you unable to attend.

Enjoy the tides of change!

Photo credits: Smabs Sputzer, Will Clayton

But with so much buzz in the industry about the cloud, it seemed fitting to organize an event dedicated solely to this topic. Alas, it’s finally here.

In just two short weeks, Eze Castle Integration will be honored to host the 2012 Hedge Fund Cloud Summit – a half-day conference in New York City designed to dive deep into the critical areas of cloud computing that hedge funds and investment firms are compelled to think about on a daily basis.

The Cloud Summit will bring together more than 100 of the investment industry’s best and brightest technology and operations professionals and will feature expert speakers from some of the leading hedge funds, prime brokers and technology application vendors in the industry.

Below is a sneak peek at the four panel sessions that will highlight the Hedge Fund Cloud Summit in its inaugural year. For a full agenda or to register for the conference, click here.

Making the Business (and Financial) Case for the Cloud

In addition to the technology specifics involved in leveraging cloud computing, there are also important operational considerations to think about. What is the business proposition for hedge funds moving to the cloud? Is the cloud really more cost-effective? How do investors feel about the cloud? Our expert panelists will answer these questions and more as they examine the business case for the cloud.

Examining the Changing Role of the Hedge Fund CTO/CIO in the Cloud Era

The role and responsibilities of the hedge fund CTO has evolved in recent years. With the emergence of cloud computing, as well as increased focused on compliance, regulations, reporting and transparency, individuals responsible for technology are juggling more than ever before. Hear directly from current and former hedge fund CTOs as they examine how the role has changed so far and what else to expect in the future.

Hosting Your Applications in the Cloud: What You Need to Know

Your fund uses a host of different financial, trading and risk applications on a daily basis. And many of these can now be supported in a cloud environment. But how do you know when the cloud is a good fit for your applications? This panel includes experts from companies that taut some of the leading hedge fund applications on the market and will examine the pros and cons of hosting your key hedge fund applications in the cloud.

Practicing Safe Security in the Cloud

It’s the question that has lingered in the industry for years – is the cloud secure enough to store sensitive data? With fears of data mingling and cyber attacks, investment firms need to be sure their information lies in a safe place. This panel will explore possible security risks that exist in the cloud and provide best practices for maintaining a safe and secure virtual environment.

Click here for more information on the 2012 Hedge Fund Cloud Summit.

NOTE: The Hedge Fund Cloud Summit is open to hedge fund and investment firm professionals only. Space is limited, and service providers will not be permitted to attend.

• Simon Eyre, Service Director at Eze Castle Integration
• Bill Prew, COO at James Caird Asset Management
• Gus Black, Partner at Dechert LLP
• Jae Yung Kwon, EMEA Prime Brokerage, J.P. Morgan

Numerous topics were covered including investment strategies, approaches to raising capital, regulatory considerations, service provider selection, and technology systems. In today’s article we’d like to dive a little deeper into the key technology requirements that all funds must consider when starting up. These include infrastructure, telecommunication and compliance and archiving.

Secure, Available Infrastructure

One of the first decisions a new start up needs to make when it comes to technology is whether they will use a traditional on-premise model or go with a cloud computing service. The cloud model is increasingly winning out as most hedge funds do not view IT as a core competency and value having a third party manage everything. When it comes to the cloud provider’s environment, you want to ensure the infrastructure is N+1 and has a multi-tiered security approach for physical and virtual security.

Internet Service

Hedge funds wanting maximum availability should select a T1 line and consider using two service providers in case one Internet line goes down. Tip: look for a provider that can offer proactive monitoring and security features to achieve 24/7 availability.

Data Protection

Disaster recovery and business continuity plans are vital to every hedge fund of every size. When you are creating your disaster recovery and business continuity plans consider the following factors:

• What are the mission critical applications and processes?
• What are the RTO and RPO for your business?
• Who are the key people? How are they going to be notified of an emergency?
• How often is your DR plan tested? (Quarterly is ideal.)

Compliance and Archiving

Email archiving is important for firms to comply with legislation and regulations regarding the archiving of electronic mail for eDiscovery reasons and other legal issues. Email and IM data should be saved for the required length of time as prescribed by law. Data should be stored in WORM (Write Once, Read Many) format so that nothing can be changed or deleted. Records need to be indexed in searchable files to aid in providing only the information that is requested. The best way to store data is on its own offsite server, accessible via the Internet.

Service Provider Selection

Once you have assessed your firm’s technology requirements the next step is to select the right service provider. When it comes to selecting the right service provider there are many factors to consider, such as:

• Experience in Deployment
• Breadth of Solutions
• Depth & Quality of Staff
• Technical Expertise
• Project Management Experience
• Disaster Recovery Policies & Procedures
• Reputation
• Geographic Reach
• Flexibility

It is also good to find a service provider with a “Can Do” approach that takes ownership for the task, pro-actively identifies and resolves issues promptly and keeps to the timetable.

Launching a hedge fund can be a complicated process, so we have listed some useful resources to help you get your firm successfully off the ground.

Additional Resources:

• Hedge Fund Launch Kit
• The Keys to Successfully Launching a Hedge Fund
• Launching a Hedge Fund? Don’t Overlook These Tech Considerations
• A Guide to Technology Outsourcing for Hedge Funds

• Public vs. Private vs. Hybrid Clouds
• The Migration from Traditional IT to the Cloud
• Impact of Reduced Costs in the Cloud
• Real-world Examples of Cloud Utilization
• Examining the Technology Environment for Startups
• Scalability with the Cloud
• Cloud Security Best Practices
• The Future of the Cloud

Here is the interview for your viewing pleasure!

I recently sat down with Chris to pick his brain on the importance of continued international expansion, as well as to get his thoughts on some important lessons that he’d like to share with other CFOs and organizations that may be undertaking similar growth strategies.

Q. Congratulations on your recent promotion! Could you tell our readers a little about yourself and your background in the industry?
A. Thanks! As you mentioned, I have been with Eze Castle for almost nine years now. I manage our financial operations and spearhead the establishment of international operations. Most recently, I helped facilitate our expansion into London, Geneva, Singapore and Hong Kong. As part of this process, I oversee the company’s global finances, as well as the accounting, insurance, legal and real estate functions.

Prior to joining the Eze Castle team, I worked as a principal at The Parthenon Group, which is a global strategic advisory firm. While at Parthenon, I enjoyed the data-driven, financial aspects of the consulting engagements I worked on. This led me to pursue a finance position at a privately held company, thus bringing me to Eze Castle. I am a graduate of Dartmouth College, where I received a Bachelor of Arts degree in mathematics.

Q. Great! Could you tell us a little more about the company’s international growth? What were the driving factors behind the decision to expand beyond the United States?
A. Most of our growth is driven by the needs of our clients and the size of the market opportunity in a particular country or region. Our first international office, in London, was established as a result of the fact that we had a large client in New York who also had a significant presence in the UK. They were pleased with our level of service in New York and asked if we’d consider supporting them in London as well. The support from our client base, coupled with the size of the hedge fund market in London, made this an easy decision.

When we first opened in London, we focused our support on existing US clients that have London offices. Once we were comfortable that we were maintaining a consistently high level of support, we then looked to scale our efforts. We began selling our solutions and services to the local UK hedge fund market and adding new clientele. Subsequently, we have started the process of replicating this strategy as we expand into Asia. Our geographic breadth has since opened us up to opportunities with global financial institutions to which we would not have otherwise been exposed.

Q. Since some of our readers may be considering growing their own firms into new territories, can you walk us through the major steps involved in establishing a new office overseas?
A. A good place to start is often the inward investment branch of the government in the country or city to which you are looking to expand. They often have offices in the US and are eager to discuss expansion opportunities. They are a great (free!) resource and can provide contacts for everything from talent recruiters to tax advisors. They will also make you aware of any special tax incentives available for hitting certain revenue and/or job creation milestones.

From an operational standpoint, it’s important to choose the appropriate entity type to ensure it will fit into your overall corporate structure from both a tax and legal perspective. Once the entity choice is made you can focus on establishing how you will handle accounting, tax, audit, banking/foreign currency and legal/contracts.

It’s important to have all of the tactical aspects of running the business in place before supporting clients and selling products and services. Certainly, the sales and support strategy should be tackled in parallel so that client work can begin once the compliance initiatives are complete. If you have a realistic timeline and budget and partner with the right people, the process is not as daunting as it might seem.

Q. I understand you will be making a trip over to Europe soon. What will be your top priorities for this visit?
A. Yes, I will be in both the UK and Switzerland. I have three main objectives for the trip. The first is to handle all of the compliance requirements that need to be addressed in person. The second is to meet with all of our tactical partners in both locations. I have meetings set up with bankers, lawyers, tax advisors, auditors and regulatory agencies. My third goal is to spend time with the employees in our London office. That office has grown substantially since we opened it in 2007, and has recently moved to a new location so I’m looking forward to seeing that.

In today’s highly connected world there is so much that can be done over the phone and via email, but there still is no substitute for a face-to-face meeting. I see real value in that and plan to take full advantage of this upcoming opportunity.

Q. What are some important lessons that you have learned throughout this process that you feel are important to share with other CFOs or anyone leading a company through a similar undertaking?
A. One of the major lessons I’ve learned is that there is so much that can be discovered on the job. If you have an interest in what you are working on, an aptitude for learning and a logical thought process you can accomplish anything. Five years ago we didn’t have any foreign offices or anyone with experience opening or operating a foreign office. As a team we figured out what we needed to do, developed a plan and executed on that plan. We certainly made some mistakes along the way, but we have learned from them and have been able to refine the process in order to become more efficient with each subsequent expansion. This knowledge, constantly evolving over time, will certainly serve us well in the future.

Considering expanding your organization to a new city or region? Be sure to check out our “Expanding Your Hedge Fund Internationally” Knowledge Center, or contact an Eze Castle Integration representative.

Having an understanding of your firm’s technology needs will take you far, particularly when it comes to satisfying increasingly technology-savvy investors. But gaining that knowledge can sometimes be a challenge for fund employees who are pressed for time and busy focusing on strategic goals.

We’ve made it our mission to be a constant source of information for our hedge fund clients and partners - our Hedge IT blog is a prime example! In addition to our wealth of blog posts, we have a dedicated Knowledge Center devoted entirely to helping educate investment professionals on what’s new and exciting in hedge fund technology. Below are a few of our most popular knowledge centers, easily configured by category to help you find exactly the information you’re looking for.

Hedge Fund Launch Kit

Are you looking to launch a hedge fund? It can be a complicated process – we know. Our #1 Knowledge Center is designed to walk you through the launch process and ensure you don’t leave any stone unturned. With so much to think about - from real estate and operational infrastructure to marketing and technology – we’ve compiled a variety of resources to help you get your firm off the ground successfully.

Technology Outsourcing for Hedge Funds

Before your launch (or even after), you may decide managing your own IT is not feasible. Instead, you may opt to leverage technology outsourcing as part of your operational strategy, allowing a third-party to take over and handle day-to-day IT functions and you to focus on your core business efforts.

There are a variety of outsourcing options available to firms, including cloud computing and managed services, colocation, staffing and more. Read up on outsourcing to see which of these options suits your firm’s unique needs.

Cloud Computing for Hedge Funds

In 2011, we saw a significant number of hedge funds turn to the cloud to meet their technology requirements. For startup funds, especially, the cloud offers an intriguing model. We have deep experience in helping firms leverage the cloud and have a variety of resources available detailing its benefits, challenges and more.

Disaster Recovery & Business Continuity

One of the most important aspects of technology your investors will want to see is a disaster recovery and business continuity plan. With the potential for a disaster to strike at any minute, you need to ensure your firm is prepared to remain operational no matter what the disruption. View our complete list of resources on DR and BCP so you'll be prepared if disaster strikes.

To speak with an Eze Castle representative and learn more about any of the above technology topics, contact us today.

Photo Credit: Sean MacEntee

The number of people for the Olympic Games is expected to rise by 300,000 with the number using public transport increasing by over 80,000. Transport networks will be stretched as hundreds of thousands of people use public transport, which means staff may not be able to get to work as easily as usual.

When preparing for any major events, many hedge funds and investment firms will focus on preparing their technology: making sure data is backed up, files are secure, and access to market data remains intact. But often firms forget about the business and operations aspect that is equally as important to keeping a hedge fund's technology operational through a disaster.

In any type of disaster situation, it becomes a necessity to have a business continuity plan in place. Firms will need to ensure their employees know how to access their technology and how to communicate with each other if they are unable to get to the office during the Olympics.

There are certain business continuity best practices that firms should follow in order to ensure their business processes are not interrupted:

The Importance of Communication

The reality is, you can have all the processes and procedures in place to prepare for a disaster, but if they are not properly communicated to your employees and external parties, then their effect with be minimal. Consider creating a call tree or implement an Automated Messaging System that can be configured to send notifications to all employees simultaneously. Using the automated messaging system ensures all employees receive the same message immediately via email, phone call and/or text message.

Remote Access Technologies

Employees will be forced to work from home or an alternative work location if they are unable to get into the office. But ensuring your employees actually know how to work remotely will go a long way in validating the effectiveness of your BCP plan.

There are a few different options for remote access, notably Virtual Private Network (VPN), Citrix, and Outlook Web Access (OWA).

• VPN: IPSec or SSL VPN technologies work by connecting your home computer to that which resides in your office. You are able to “remote desktop” and run all of the applications which live on your work computer’s server.
  
• Citrix: With a Citrix server, you are able to log into a website via any computer and get access to the applications that live on the Citrix server in your office. When you click any application icon, it will appear as if it is running locally despite being housed on your office server.
  
• OWA: For those companies who use Microsoft Outlook for email, you can log into OWA to access your email account from an external computer.

Whichever technology or combination of technologies your firm decides to employ for remote access, the key is ensuring your employees know how to properly use them and test them prior to a disaster.

Employee Remote Access Test

Testing remote access beforehand will make employees more comfortable with the process and ensure that any unexpected challenges are addressed before an incident impacts your office. Here are some recommended steps to have your employees follow as part of the testing process:

• Validate successful communication to internal and external dependencies
  
• Confirm full functionality of required applications
  
• Perform all high level business functions
  
• Confirm access to vital records
  
• Redirect office phones to home/mobile phone

With 127 days until the Olympic Games 2012 begins, it is essential for firms and their employees stay safe and productive, organisations must have a fully planned, well-tested business continuity plan and methods to ensure your workforce can work from any location at any time.

Additional Resources:

• London 2012 Games Planning Information for Business
  
• Business Continuity Planning: The Importance of Table Top Exercises
  
• Blog Article: What is involved in a DR test?
  
• Five steps to Business Continuity Planning

However, the Dodd-Frank Act continues to spark change and much debate throughout the financial services industry. Just today the U.S. Commodity Futures Trading Commission (CFTC) “completed Dodd-Frank Act rules requiring swaps brokers to decide within minutes whether to clear a trade in an effort to reduce risk in the $708 trillion global swaps market,” according to Bloomberg news.

Dodd-Frank also requires that swap entities establish and maintain written business continuity and disaster recovery plans designed to enable them to resume operations with minimal disturbance to counterparties and to recover all required documentation and data.

Not every deadline has been met. Law firm Davis Polk publishes a monthly Dodd-Frank Rulemaking Progress Report “to help market participants and policymakers assess the progress of the rulemaking and other work that has been done by regulators under the Dodd-Frank Act.” Following is a peek at the findings from the March 2012 report:

• As of March 1, 2012, a total of 225 Dodd-Frank rulemaking requirement deadlines have passed. This is 56.3% of the 400 total rulemaking requirements, and 78.7% of the 286 rulemaking requirements with specified deadlines.
  
• Of these 225 passed deadlines, 158 (70.2%) have been missed and 67 (29.8%) have been met with finalized rules. Regulators have not yet released proposals for 24 of the 158 missed rules.
  
• Of the 400 total rulemaking requirements, 99 (24.75%) have been finalized and 154 (38.5%) have been proposed. 147 (36.75%) rulemaking requirements have not yet been proposed.

The following graphic shows the progress by agency:

The exact impact of Dodd-Frank will not be known for a while, but speculation is sure to continue. At Eze Castle Integration we are focused on helping hedge funds and alternative investment firms cope with the technology requirements, including disaster recovery plans and systems, that come with Dodd-Frank.

Visit our Dodd-Frank Knowledge Center for resources on ensuring your IT systems meet the new regulations.

Companies whose power came back Wednesday morning experienced minor inconveniences, such as having employees who worked late Tuesday night have to travel down 46 flights of stairs since the elevators weren’t working. Other companies who were without power all day Wednesday weren’t so lucky. As of 3:00 p.m. today (Thursday) power is still out at Boston’s Prudential Center.

This unfortunate incident is precisely why disaster recovery and business continuity planning are so important. So important in fact that we are going to re-run an oldie but goodie from our interview last year with Lisa Smith, a Certified Business Continuity Planner at Eze Castle Integration.

Here it goes…ASSUMPTION: Your office building is inaccessible.

How will employees be notified of the building closure?

Calling all employees through a manual phone tree can be very time-intensive. Some may not receive the message in time to avoid reporting to an inaccessible office, which could cause confusion and further time loss. Also, if managers and employees are busy calling one another to spread the message, this prevents them from performing more productive work-related activities.

One way to avoid this challenge is to implement an Automated Messaging System that can be configured to deploy a notification to all employees simultaneously. Using this system ensures that all employees receive a consistent message immediately via email, phone call, and/or text message. These systems tend to vary in terms of cost but a base level system can be installed for as low as $8.50 per employee per year.

Where will employees work from?

In advance of the inclement weather let employees know whether they will report to an alternate site or begin conducting their work from a home office. If using an alternate site, be sure it has the capacity to accommodate all critical employees that may need to work from there in the case of an office closure (i.e. extra desks or tables, adequate number of Citrix licenses, phone lines, etc.).

If the plan is to have employees work from home, steps should be taken to ensure that they will have access to all resources necessary for performing their daily tasks. In either case, the alternate work location procedures should be clearly communicated to all employees, and regular testing should be conducted in advance to ensure that any unexpected challenges are dealt with before a major storm shuts down your office space.

How will employees communicate with each other and with external contacts?

Before inclement weather strikes, each employee should compile a list of the phone numbers and other contact information for all individuals on whom their jobs are dependent. For example, it is common among hedge fund firms for people in the trading and operations departments to be highly dependent on one another. Employees in both functional areas should have the home and cell phone numbers of each of their counterparts to avoid a loss of communication when your office is inaccessible.

Additionally, employees should save the contact information of all external parties, such as vendors, investors, and broker-dealers with whom they need to regularly communicate in order to do business. This information should be stored in a location that is accessible from both the office and the employees’ alternate work locations.

Other considerations

There will undoubtedly be some unforeseen challenges associated with the closure of your office building. For example, what should an employee do if he needs a signature from another employee or a manager and both individuals are working from home? How should an employee go about wiring money or carrying out similar transactions from her home office?

The best way to address these issues in advance of inclement weather is to conduct business continuity plan testing days in which employees work from their designated alternate locations and report back on any challenges they faced. This will allow you to make your business continuity plan even more comprehensive, while forcing employees to think about how they will continue doing their jobs effectively if they do not have access to their regular offices.

Want some more? Check out:

• ASSUMPTION: Your office building IS able to remain open.
  
• A Hedge Fund's Guide to Disaster Recovery Planning
  
• Business Continuity Planning: The Importance of Table Top Exercises
  
• Preparing for Winter Weather: Remote Access & Business Continuity Strategies

Eze Castle Integration’s Business Continuity Planning services (Eze BCP) focus on the critical operations and processes that a hedge fund or investment firm must have available if a disruption occurs. Our experienced team of certified business continuity professionals work with clients to address the full-spectrum of BCP. To learn more, visit our Disaster Recovery & Business Continuity Knowledge Center, or contact an Eze Castle representative.

Photo credit: Tayloraldredge

Enjoy!

Eze Castle's "Best of Hedge IT Awards"

Increased Adoption of the Cloud

According to our managing director, Vinod Paul, over 80 percent of the new clients we brought on board last year are utilizing the cloud in some way, shape or form. As hedge funds continue to battle for institutional dollars, the smaller firms, in particular, are able to leverage the cloud for enterprise-level technology at an often reduced cost.

Speaking of cost, it’s one of the main drivers for firms moving to the cloud. Three to five years ago, hedge funds typically had to pay $300-500K dollars to set up an initial IT environment. In today’s rapidly changing landscape, firms are looking to pay less money out-of-pocket, as well as decrease their initial deployment times.

With the cloud, resource deployment and allocation only take days or weeks instead of months. The increased flexibility with the cloud is an enormous driver, allowing firms to customize how they use this technology platform. The cloud can easily work on a different scale for small and large firms, with smaller startups outsourcing their entire IT landscape and larger firms having the flexibility to use a hybrid model and determine which aspects of their environment they want to manage in-house or outsource.

Is the Cloud Regulated?

To regulators such as the SEC and FINRA, the term “cloud computing” doesn’t really resonate. They tend to use the word “outsourcing” when defining rules for investment advisers and broker-dealers. Broker-dealer rules, in particular, have become more specific in recent years, and there is currently a proposed rule which would prevent BDs from outsourcing arrangements that involve moving cash or securities. Additionally, BDs are required to provide advanced notice to FINRA and the SEC about outsourcing their recordkeeping.

Under the Dodd-Frank Act, investment advisers (including most hedge funds) are required to maintain records of all activites related to their business, but the rules are not as specific in regards to if those records are outsourced. Firms must also complete Form ADV, which requires the disclosure of firms’ service providers and their level of involvement. In the coming years, we may see changes in regards to how regulatory bodies govern the cloud, but for now, there is a lot of ambiguity.

Cloud Security Best Practices & Evaluating Your Service Provider

The threat of a cyber attack is a reality for all organizations, whether they are using the cloud or not. Regardless of a firm’s IT infrastructure, it should take all measures to protect the firm and its sensitive information. For both on-premise and cloud technology, where data is stored in a colocation facility somewhere, you’ll want to ensure that proper physical security procedures are in place, including biometric screening and authentication, monitored cabinets and cages and 24x7x365 surveillance. On the cloud level, you’ll also need to ensure your service uses proper virtualization security, meaning your data needs to be isolated from that of other firms using the same cloud.

It’s also important to consider the type of cloud you are leveraging. Security practices and principles may differ between public and private clouds. Consider the following:

• Who can access your data and at what level? Not every employee needs access to everything on the network.
  
• Can your service provider share an audit trail which logs who has accessed what?
  
• What is the viability of your firm’s cloud service provider? Can they provide audited financials? Can they sustain business in the long run?
  
• Does your provider offer a Service Level Agreement (SLA) and what is the agreed upon uptime? In the hedge fund industry, in particular, downtime is not an option.

To listen to the complete replay of our Feb 28^th webinar, Doing Your Cloud Homework: Legal, Tech & Security Questions Answered for Investment Firms, click here.

Ready for the cloud? Check out the Eze Private Cloud or contact us.

Since we frequently work with our alternative investment clients on developing comprehensive business continuity plans (BCPs), we feel it is important to review and test our own BCP procedures on a regular basis to ensure they will meet our most current business needs in the event of a disaster. To this end, Lisa Smith - one of our certified business continuity professionals - and her team recently conducted a BCP table top exercise with our management team here at Eze Castle. After this successful meeting, we thought it would be valuable to share some insights on the BCP table top exercise process with our readers to spotlight the importance of this activity.

What is a BCP table top exercise?

A BCP table top exercise is an informal brainstorming session used to encourage participation from business leaders and other key employees. Typically, a business continuity consultant leads the executive team through a discussion, which is focused on the steps that the business’s leaders would carry out together in order to activate the firm’s BCP procedures during a disaster. The group covers all of the actions necessary to ensure all employees are safe and accounted for and the business can continue to operate.

How they are conducted and what is covered?

Gather the firm’s executive team (and any other individuals within the organization that play a leadership role in the BCP activation process) in a conference room-type setting that is conducive to open discussion and interaction.

To begin, the consultant or group leader should develop a hypothetical disaster scenario to use as an example. Scenarios may include a regional electricity outage, building fire, terrorist attack, violent storm, or the like. Be sure to hash out all of the details of the scenario, including a hypothetical date and time, an assessment of the immediate impact of the event and how employees are being affected.

Once the scenario has been established, the members of the management team will break down what steps need to be taken (and in what order) to ensure all employees are safe and accounted for, communications are made to all necessary parties and the business remains operational. The group should identify realistic and unrealistic expectations and work together to bridge any gaps between leadership and the established BCP plans. Other items that should be covered include: Who needs to be contacted or alerted about the disaster (i.e. employees, vendors, investors, etc.)? What potential road blocks may arise and how can they be averted? What residual effects may occur as a result of the disruption?

Why are these exercises important?

A company’s ability to recover quickly from an unexpected disruption is directly associated with the quality of the preparations that have been completed prior to the event. BCP table top exercises are conducted to provide an example of how the management team would work together to get the organization through a disaster. These exercises are important for businesses to undertake so that the “kinks” in the written BCP plans can be worked out before a disruption occurs. They also serve as a reminder that these events can happen at any time and often occur rapidly and without warning.

---------------

Eze Castle Integration’s Business Continuity Planning services (Eze BCP) focus on the critical operations and processes that a hedge fund or investment firm must have available if a disruption occurs. Our experienced team of certified business continuity professionals work with clients to address the full-spectrum of BCP. To learn more, visit our Disaster Recovery & Business Continuity Knowledge Center, or contact an Eze Castle representative.

Tiers – Data centers can occupy one room, one or more floors, or entire buildings. They are classified in terms of Tier Levels from Tier I to Tier IV, with Tier IV being the most advanced in terms of redundancy, security and availability.

Energy costs – As the cost of energy increases, analysts predict IT energy costs today are but a fraction of what future costs will be at current growth rates. Additionally, current trends indicate that server operating costs have the potential to equal their capital costs within three to five years.

Design innovation – Data center design is becoming increasingly important for improving operational efficiency. The foundation of data center design philosophy contains five core values: simplicity, flexibility, scalability, modularity and sanity.

HVAC – The efficiency and effectiveness of a data center HVAC system is heavily influenced by the path, temperature and amount of cooling air delivered to the IT equipment. The key to an efficient airflow design is to eliminate mixing and recirculation of hot equipment exhaust air. This can be accomplished by:

1. Optimizing the location of HVAC units
2. Specifying a “Hot Aisle/Cold Aisle” design configuration
3. Implementing rigid enclosures
4. Blanking unused rack positions
5. Selecting racks with good internal airflow
6. Supplying air directly to the loads
7. Positioning supply and returns to minimize mixing and short circuiting

Plumbing - Relative humidity (RH) measures the amount of moisture in the air at a given temperature in relation to the maximum amount of moisture the air could hold at that temperature. Humidification specifications and systems in data centers have often been found to be excessive or wasteful. In some cases, provisions for humidification are simply poor. Too much humidification leads to a build-up of condensation, which results in hardware corrosion and early system component failure. Conversely, too little humidification makes equipment especially susceptible to electro-static discharge.

Electrical – Protection from power loss is a common characteristic of data center facilities. However, such protection comes at a significant up-front price and also carries a continuous power usage cost that can be reduced through careful design and selection. Methods for reducing electrical consumption include:

1. Maximizing unit loading
2. Selecting the most efficient UPS possible
3. Not over-specifying power conditioning requirements
4. Eliminating standby generators
5. Recovering waste heat for local uses
6. Generating cooling at off-peak intervals for use at peak intervals

Lighting – Lighting is often taken for granted in data center designs. Light levels are expressed in the metric unit “lux.” One “foot candle” is approximately 10 lux. A typical US corporate office is lit to an illumination of 30 to 100 foot candles. As a typical rule of thumb, data centers and computer rooms should be lit to an illumination of between 40 and 50 foot candles. The energy consumption of such illumination levels can be safely reduced via the implementation of occupancy sensors and bi-level lighting.

Fire protection – Data center fire protection comes in two types, active and passive. Active fire protection systems are triggered by action or response. They fall into the following categories: fire suppression, sprinklers and fire detection. Passive fire protection systems include compartmentalization of the overall building structure, and typically include fire rated walls, floors and partitions as well as designated fire refuge areas.

Eze Castle Integration has deep experience in helping hedge funds evaluate the considerations associated with data center and colocation facilities. Contact us to discuss your needs and learn more about best practices.

We have again signed on as a Hedge Funds Care global sponsor and are looking forward to attending this week’s Open Your Heart to the Children Benefit in NYC. This year the New York Committee of Hearts is awarding the HFC Founder's Award to former Yankees manager Joe Torre for his accomplishments with the Joe Torre Safe at Home Foundation, which is dedicated to ending the cycle of domestic violence.

Here is a video of Joe Torro talking about his experiences and foundation.

At the end of the month (March 23 to be exact), Eze Castle Integration has the honor of sponsoring the 100 Women in Hedge Funds –Stanford PACs Conference, which is the first hedge fund conference to donate all net proceeds to philanthropy and focus on a double bottom line -- how investors can innovate both absolute and social returns.

Momentum around the conference is building and, as a committee member and Bostonian, I’m proud to see this one-of-a-kind conference being held in Boston. All conference proceeds will support The Alliance for a Healthier Generation organization, which was founded by President Clinton’s foundation and the American Heart Association. Plus, Seth Klarman, president of The Baupost Group, is the keynote speaker.

To whet your appetite, here is a great video of Seth Klarman discussing investing and philanthropy.

Last but not least, in preparation for this great event, Eze Castle Integration has committed to donate $1 to The Alliance for a Healthier Generation for every new ‘Like’ we receive on Facebook in March 2012. Like us now!

We hope you’ll consider supporting these worthy organizations as well.

Application Recovery
A component of Disaster Recovery that deals with the restoration of business system software and data, after the operating system environment has been restored or replaced.

Business Recovery Team
A pre-identified group of individuals that is reponsible for maintaining and executing the recovery process.

Business Continuity
A system of planning for, recovering and maintaining both the IT and business environments within an organisation regardless of the type of interruption. In addition to the IT infrastructure, it covers people, facilities, workplaces, equipment, business processes, and more. Be sure to read our articles on the difference between DR & BCP and preparing for a worst case scenario.

Business Impact Analysis
A collection of information on a wide range of areas from recovery assumptions and critical business processes to interdependencies and critical staff that is then analysed to assess impact a disaster may have.

Disaster Recovery
The process of restoring and maintaining the data, equipment, applications and other technical resources on which a business depends.

High Availability
High availability describes a system’s ability to continue processing and functioning for a certain period of time - normally a very high percentage of time, for example 99.999%. High availability can be implemented into a firm's IT infrastructure by reducing any single points of failure using redundant components.

Hot Sites versus Remote Sites
A disaster recovery hot site is a remote physical location where you can maintain copies of all of your critical systems, such as trading applications, data, and documents. A remote site provides a secondary instance or replica of your IT environment—without physical desks and office infrastructure—that you and your firm’s employees can securely access and use remotely, through standard Internet connections from anywhere.

Want to know more? We have a whole article on the difference between hot sites and remote sites.

Mission-critical
A computer system or application that is essential to the functioning of your business and its processes.

Production or Primary Site
In the context of a primary and secondary site, the primary site contains the original data that cannot be recreated.

Recovery Time Objective (RTO)
The RTO is the duration of time and service level within which a business process must be restored after a disruption in order to avoid unacceptable losses. RTO begins when a disaster hits and does not end until all systems are up and running.

Recovery Point Objective (RPO)
The RPO is the point in time to which a firm must recover data as defined by the organisation. In other words, the RPO is what an organisation determines is an “acceptable loss” in a disaster situation. The RPO dictates which replication method will be required (i.e. nightly backups, snapshots, continuous replication).

Redundancy
A system of using multiple sources, devices or connections so that no single point of failure will completely stop the flow of information.

Risk Assessment
The identification and prioritisation of potential business risk and disruptions based on severity and likelihood of occurrence.

Secondary Site (or DR Site)
The secondary site contains information and applications that are built from the primary repository information. This site is activated should the primary site become unavailable.

What's missing from the list? Help us expand this DR dictionary.

Additional Resources:

• Disaster Recovery Guidebook
• eBook: Preparing for the Worst: Disaster Recovery and Business Continuity Planning for Investment Firms
• Blog Article: Common Disaster Recovery Misconceptions

Photo credits: Muffet on Flickr

According to the CIO Global Cloud Computing Adoption Survey (January 2012), hybrids are growing in popularity with nearly 20% of enterprise deployments using this model today. Hybrid clouds, which mix the benefits of private and public clouds, offer flexibility and choice of deployment methods without requiring trade-offs around performance, control and security.

While not ideal for many hedge funds today, it is still important to understand the concepts and benefits behind hybrid clouds as their applicability will continue to increase. Let’s take a look at what makes hybrid clouds appealing to some organizations:

• Agility & Flexibility: A hybrid cloud model can allow a company to combine its own computing assets with assets from a public or private cloud provider to scale on-demand and increase agility. This model may be ideal for a company looking to handle bursts in workloads.
  
• Potential Cost Savings: A hybrid cloud model, according to research from TrendMicro, has the ability to “optimize the infrastructure spending during different stages of the application lifecycle. Public clouds can be tapped for development and testing while private clouds can be used for production.”
  
• “Painless” Application Migration: A hybrid model can allow companies to migrate applications to a cloud environment in a phased process where some components reside on the cloud, such as web and storage levels, while others remain on a dedicated physical infrastructure. Over time the application can be upgraded to run completely in the cloud environment.

Hybrid Cloud Use Scenarios

Some of the most common uses for hybrid clouds across the technology industry, according to a TrendMicro survey, include:

• Using the private cloud for mission-critical applications and using public clouds for non-critical applications. A firm, for example, may use a private cloud for production deployment and a public cloud for test and development of lower-tier applications.
  
• Another example is non-destructive Disaster Recovery (DR) testing. Organizations can test if their production environment is DR-ready by tapping the public clouds without any disruption.

To learn more, be sure to read:

• The Cloud Computing Knowledge Center
  
  
• Cloud Computing Part Two: Eight Questions to Ask Vendors
  
• Cloud Computing: Application Hosting Considerations

The song’s main messages include the importance of having dignity and self-respect. If you want your life to have meaning, start by making sure you stand for something regardless of the challenges this may require. Developing and practicing dignity and self-respect is the foundation upon which everything else is built upon, including your career.

In the field of project management, resting all your techniques and methodologies upon a foundation of dignity and self-respect will give you and everyone around you tremendous trust and confidence.

Here are 12 ways to kick-start your quest for dignity and self-respect at the project workplace:

1. Put the client’s interests ahead of your own. You are where you are because the client needs you. Strive to deliver more value than expected. You will be rewarded for it down the road.

2. Be honest. Stay independent and have the courage to tell the truth as you see it regardless of the popularity of your views or the effect on your fees.

3. Build integrity into sustainability practices. Your role impacts people’s lives. Be conscious about the effect your decisions have on the people around you and align your decisions closely to what you believe is right. Uphold integrity and show respect to customs, cultures and deadlines. Start your project plan with a self-assessment survey.

• Know the marketplace in which you are operating.
• Set clear expectations for ethical behavior.
• Hold employees consistently accountable at all levels.
• Continually assess stakeholders.
• Do the right thing, especially when nobody is watching.

4. Forget about the Joneses. Don’t get caught up worrying about how you will impress. Concentrate on being yourself and let your work ethic, solid planning and execution skills do the impressing for you. Everything else will take care of itself.

5. Provide Opportunity. Give everyone the opportunity to add value as individual leaders amongst a group of leaders. Acknowledge hard work. Be a believer in the power of teamwork.

6. Learn to handle criticism. Although it is human nature to be emotional, allowing emotions to rule a project is usually a recipe for disaster. Rely on facts and don’t take criticism personally. Because most criticism is meant constructively, take the opportunity to instead reflect and learn from it. Then move on.

7. Keep up time. Respond to emails on time and show respect for requisitions, help or clarification requests. If you cannot respond in a timely fashion, acknowledge receipt of the communication and prioritize your responses as quickly as possible.

8. Resist gossip. Gossip is a bi-product of human nature and running into it is usually unavoidable in the workplace. But you can most certainly avoid engaging in it. It is not productive and is rarely ever helpful. It can cause issues where there are none. There is a right and wrong way to network and obtain information –via gossip is the wrong way.

9. Define the line between personal and business relationships. Resist the temptation of having personal relationships at the workplace. They can affect your performance, impair your judgment and create an uncomfortable environment for everyone around you. Know your limits, draw your line and be professional at corporate outings and events. If you work a lot more than you live and feel the workplace is the only platform available for you to have a personal life, consider restructuring your priorities.

10. Don’t be a slave to fashion, but do take care of yourself. Surely looks are not everything, but know that the way you handle them tells a lot more about you than you might imagine. There is no need to be a slave to fashion trends, but do mind your appearance. Dressing smart for the right occasion shows respect and gives self-confidence.

11. Forgive yourself and others. Mistakes happen. Recognize this, learn from it and plan for it. Forgiveness is not a weakness nor will it change the past, but it will most certainly change the future.

12. Be humble. The road to having self-respect is not through a bloated sense of pride. Remain humble through your success when you are praised for your work. Stephen Dorff once said, “I guess what I learned most was to feel lucky with what I have been able to accomplish and what I have and to feel humble about the people I have been able to work with.”

Demetrios Gianniris is Director of Project & Technology Management (PTM) at Eze Castle Integration. He is responsible for overseeing the daily administration and operations of the Project Management team, including project design development, construction management, professional services and information technology consulting. Follow Demetrios on Twitter at www.twitter.com/dgianniris.

Our goal is always to help educate our clients so that they can improve their internal processes and be better prepared for disasters. So, to that end, I’d like to take this opportunity to clear up a few of the most common DR misconceptions to ensure that your fund is fully prepared to maintain normal business operations in the event of an outage.

Misconception #1: DR system testing is unnecessary.
All firms that have a disaster recovery site need to test it regularly. Eze Castle Integration routinely recommends quarterly testing for all clients so that users can become familiar and comfortable working within the DR environment. Testing also helps ensure the DR site meets the firm’s current business needs (which typically evolve over time) and provides an opportunity for the client to review its most current site documentation.

We find that each client requires changes to their production environments as they develop and grow their business. Likewise, the DR site needs to evolve to continuously meet business requirements. By regularly testing your DR site, you can help ensure it meets your firm’s needs during a disaster. Failing to test the system regularly could leave your fund vulnerable to a disaster, as the DR site may not meet current business requirements, and therefore, users may not have the ability to continue normal operations.

Misconception #2: DR documentation is not necessary to read until a disaster strikes.
Often times, we find that clients fail to thoroughly review the documentation that is provided to them with their quarterly tests. This can pose a serious risk to a firm for the following reasons:

• During a disaster, the firm may realize that users do not fully understand the documentation. At that time, it may be too late and they may experience harmful downtime.
• The firm may miss or overlook key changes that have been made to the DR site (contact information for authorized activators, users, application versions, replication paths, etc.).

It is always important for all organizations to review their DR documentation in detail and ensure that all information is accurate. Be sure to ask your provider questions about anything you do not understand – don’t wait until a disaster strikes!

Misconception #3: Third-party vendor communication is not a crucial aspect of DR.
In order for a DR solution to function and be maintained properly it is important to have an open line of communication between all third-party vendors. Firms should be sure that all of their vendors are aware that they have a DR solution in place and that the DR provider is permitted to communicate to each vendor directly on their behalf to coordinate DR efforts. Firms should also be sure to have the necessary contracts in place with each vendor to cover the DR site in the event of application upgrades, patches, testing and activation support. Many of our clients tend to overlook this aspect of their solution, which can cause unnecessary delays and other challenges.

Misconception #4: We have a DR solution in place, so we do not need a business continuity plan.
Clients commonly make the mistake of believing that their DR site equates to a sufficient business continuity plan (BCP). Although a typical DR solution addresses the server infrastructure side of a client’s business, it does not necessarily incorporate the operational aspects. Without a business continuity plan in place, firms will experience significant bumps in the road during a disaster. We recommend that all clients work with a certified BCP professional to develop and document a comprehensive continuity plan for their organizations. It is also crucial for the fund’s leaders to circulate the completed BCP to all employees, vendors and investors so that everyone understands the procedures they must adhere to in the event of a disaster. Effective business continuity plans are extremely important in helping to protect companies from suffering costly outages.

----------------------

For more on hedge fund disaster recovery and business continuity planning, check out our “Establishing Business Continuity and Disaster Recovery Plans—A Hedge Fund Manager's Guide” or contact Eze Castle Integration to speak with one of our disaster recovery experts or certified business continuity planners about best practices.

Also, don’t miss these great Hedge IT articles for more on DR and BCP for investment firms:

• Preparing for a Disaster: Is Your Hedge Fund Technology Up to Par?
• Experts Weigh In On Hedge Fund Disaster Recovery, Business Continuity Planning
• Five Steps of Business Continuity Planning for Hedge Funds

Virtualization is more than just server consolidation and resource utilization. Yes, there is an inherent benefit in consolidating servers to reduce the instance of unused resources by allowing multiple operating systems and applications to run on one server.

But the business value of virtualization far exceeds simply reducing your firm’s physical footprint and the number of servers you maintain in your Comm. Room or data center.

Following are some key virtualization features that can allow your firm to operate on an enterprise level without the traditional enterprise investment.

• Resilient, High Availability (HA) Infrastructure

o Virtualization can significantly reduce downtime associated with hardware maintenance.

o Inherent high availability into servers means less hardware purchases and reduced power and cooling costs in the long run.

o Despite multiple virtual machines operating on a single piece of hardware through virtualization, the underlying components provide the option for isolation and dedicated resources to applications.

• Portability to Disaster Recovery (DR)

o Virtual servers are easily portable between physical host servers for flexibility.

o In the event of a disaster or hardware failure, data and applications would remain intact as the virtual machine can be easily started on another server.

• Backup and Restoration

o With virtualization, firms can use snapshots to take images of their servers and desktops and store that information on a storage platform, such as a storage area network (SAN). In a disaster situation, these snapshots can be restored to another server located away from the disaster area if replicated via a SAN, for instance.

o Production snapshots can also be easily taken for debugging or patch testing purposes.

• Ease of Maintenance and Monitoring

o The level of maintenance required to troubleshoot virtualization issues is far less than with traditional server-based infrastructures. Maintenance can be coordinated in a more timely and efficient manner because IT can troubleshoot via remote access.

o Because multiple virtual machines operate on the same piece of hardware, there is a unified approach to monitoring.

To learn more about virtualization and cloud computing, visit our Hedge Fund Cloud Computing Knowledge Center.

Photo Credit: VMware

1. Who needs to know?
2. What do they need to know?
3. Where do they need to know?
4. When do they need to know?
5. Why do they need to know?
6. How do they need to know?

You will quickly realize there are many different people who need to know different things about a project in different ways at different times via different communication vehicles. How do you possibly keep everyone informed while maintaining project effectiveness and staying focused on milestones and goals?

The answer is to form something called Project Communication Channels.

Generally speaking, all project communication can be broken into three main channels (or avenues) as illustrated in the image below.

Upward Communication

Upward Channel Communication focuses on communication to corporate executives by highlighting risks, issues, exceptions and expectations. The goal of this channel is to get critical buy-in from the top of the organization. Upward communication is generally achieved through status reports, project charts, email updates, face-to-face meetings and a comprehensive communication plan.

Lateral Communication

Lateral Channel Communication focuses on communication to clients, vendors and functional managers by highlighting scope, resources, budgets and time allocations. The goal of this channel is to ensure the client will be satisfied with end results and the project will be deemed successful. Lateral communication is generally achieved through communication plans, statements of work, contracts, emails, meetings and projects status reports.

Downward Communication

Downward Channel Communication focuses on project manager communication within the team members. This is the most common form of communication and aims at directing the team members, assigning and coordinating tasks and accounting for project progress as well as change and conflict management. Downward communication is generally achieved through verbal interactions, emails, agendas, schedules, team meetings, project charts, briefings and plans.

Based on the above criteria, you can proceed to develop the communication plan using the following five-part template:

• Part I: Introduction - The introduction is a brief description of the purpose of the communication plan. It also contains the names of team members, the company name and the customer or department for which the project is being developed.
  
• Part II: How Information Was Gathered and Stored - In part two of your document, the methods you employed in the gathering and storing of information should be identified, including both formal and informal communication. Generally, formal communication includes status retinas, status reports and any formal lists discussing potential risks or issues. Informal communication includes email, telephone or visits among team members.
  
• Part III: Communication Structure - This section of the document deals strictly with the formal communication involved in the project. Here you will outline the schedule of any formal communication that will or has taken place, including the communication vehicle, names and titles of the people involved and the dates and times for each of these communication sessions.
  
• Part IV: Communication Matrix - While part three of the document is essentially a written outline of all formal communication, part four is a visual representation. This is performed using a matrix which includes, at minimum, the following:
  
  
  • category of each type of communication (meetings, status reports, etc.);
  • the communication’s instigator;
  • names and titles of those receiving the communication;
  • the frequency at which these communications took place; and
  • sources used in delivering the communication .
    
• Part V: Conclusion - Summarize the communication involved in the project. This includes formal and informal communication, the source(s) of the information, the originator of the communication session, the names of those who received the information and the dates those communications took place.

Developing a comprehensive project communication plan, assuring stakeholder understanding of this plan, and following it closely throughout the project is very much a dress-for-success strategy which will have a tremendous impact on the outcome your project.

For more on project management, check out these other recent articles by Demetrios Gianniris:

• Project Management Emotional Intelligence
• Developing a Project Structure for Your Hedge Fund Project
• Obstacles of Project Management

Demetrios Gianniris is Director of Project & Technology Management (PTM) at Eze Castle Integration. He is responsible for overseeing the daily administration and operations of the Project Management team, including project design development, construction management, professional services and information technology consulting. Follow Demetrios on Twitter at www.twitter.com/dgianniris.

*Image Credit: TechRepublic

Forbes, Forbes and more Forbes

First up is the article on How To Start, And Run, A Hedge Fund. This article looks at the ins and outs of starting a hedge fund, as traders leave the prop trading desks of large investment banks due to the Volcker Rule.

Next, up is an article on Reporting Values and Risks In Private Equity Funds And Funds Of Funds that looks at the “development of new tools for tracking private equity, venture capital and funds of funds” and includes quotes from Mark Coriaty, who heads Eze Castle Integration’s sister company, Ledgex.

Closing out our Forbes streak, Mark Coriaty is also quoted in an article on Market Data Sales Drop In Market Slowdown; Thomson Reuters Off.

We love the others too

As any good Hedge IT subscriber likely knows, one topic we love is cloud computing and its use within the hedge fund industry. So it should be no surprise that we were thrilled to be included in Wall Street & Technology’s cloud computing article titled, The Rise of Cloud Computing on Wall Street.

In the article, Managing Director Bob Guilbert talks about the benefits of the cloud and the wider availability of applications specifically targeted to the financial markets. He also points to Eze Castle's New York hedge fund hotel as an example of how hedge funds may become operational quickly and efficiently with the use of cloud computing.

Not to play favorites, we also enjoyed HFMWeek’s article on Cloud Control that explores the potential benefits and costs of cloud computing by hedge funds. Our Managing Director Vinod Paul is quoted saying that “nearly all of the 44 launches the company worked with last year adopted [cloud] technology, while five clients worth more than $5bn made the switch towards the end of the year.”

And the winner is…

Since we can’t play favorites, which is your favorite article about your favorite hedge fund technology provider (that’s us!)?

It is no surprise that the investment industry landscape is becoming more and more competitive. As this trend continues, investors are raising their expectations and looking towards funds that display the highest levels in operational excellence. One important way to ensure your firm meets these high standards is to complete a due diligence questionnaire (DDQ) that can be shared with potential investors.

A comprehensive DDQ covers a wide range of topics, from assets under management to audited financial statements and investment strategies. One major area of focus is the fund’s IT and accompanying security policies and procedures. At Eze Castle, we frequently assist our hedge fund clients in completing DDQ questions on technology, and we often see the same types of questions popping up. So, to help you get started, we have compiled the following list of some frequently asked DDQ questions.

Technology Provider Selection

• Has the firm performed thorough due diligence on its current and/or potential IT vendors?
• Does the firm have established, documented service level agreements in place with its technology partners to ensure a stable computing environment?

Information Security Policy

• Has the organization developed a formal and well-documented information security policy?
• Is the policy regularly reviewed to determine whether the controls are operating as intended? Are changes and enhancements to the policy implemented when necessary?
• Do the appropriate management officials approve the policy and any changes that may be made?

Access Control Policy

• Does the organization have a formal and well-documented access control policy in place?
• Is the policy regularly reviewed to determine whether the controls are operating as intended? Are changes and enhancements to the policy implemented when necessary?
• Does the firm’s IT staff (or technology partner) ensure appropriate access control to applications and sensitive company data? Are there robust procedures in place to grant or deny access to applications?
• How does the firm manage employee remote access? Are procedures in place to ensure remote access is delivered securely?
• Has a password policy been implemented throughout the organization? Have all employees been trained on best practices for password security?
• Are policies in place to force password changes periodically?

Network Security Policy

• Has the organization developed a formal and well-documented network security policy?
• Is the policy regularly reviewed to determine whether the controls are operating as intended? Are changes and enhancements to the policy implemented when necessary?
• Does the firm have a robust firewall in place at the network level? Are policies configured to defend against external security threats? Are the firewall logs monitored regularly?
• Does the firm employ an intrusion detection system (IDS) to prevent unauthorized access?
• Is a solution in place to protect email systems against spam?
• Is a solution in place to ensure mobile devices and laptops are secure in the event of loss or theft? Are email and text messages encrypted and archived?

Physical Security Policy

• Has the organization developed a formal and well-documented physical security policy?
• Is the policy regularly reviewed to determine whether the controls are operating as intended? Are changes and enhancements to the policy implemented when necessary?
• Are access controls in place for the Server Room? How does the firm ensure only authorized personnel gain access critical systems?
• Are procedures in place to manage visitors in the office? Are steps being taken to ensure visitors do not have the ability to observe or access sensitive employee systems and documents?

Business Continuity & Disaster Recovery Plans

• Has the organization developed a formal and well-documented business continuity plan?
• Is the policy regularly reviewed to determine whether the controls are operating as intended? Are changes and enhancements to the policy implemented when necessary?
• Has the firm tested the BCP from both a technical and operational perspective? How often are these tests performed?
• Has the firm established a dedicated location to retain backup copies of all critical data? Is offsite data encrypted and stored securely?
• Has a secondary working location been established to which employees should report in the event of a disruption or outage?
• Do all employees clearly understand the BCP procedures? Have appropriate training and documentation been established and shared with all personnel?
• Is a comprehensive disaster recovery solution in place to provide system redundancy and ensure protection of critical data in the event of a disaster or system failure?
• Has the firm determined its crucial recovery point objectives (RPOs) and recovery time objectives (RTOs)? Does the DR solution meet these guidelines?

Interested in learning more about the due diligence process? Download our webcast on Hedge Fund Operational Due Diligence or contact an Eze Castle Integration expert for more information!

According to Search Cloud Computing, a private cloud (also called internal cloud or corporate cloud) is a term for a proprietary computing architecture that provides hosted services to a limited number of people behind a firewall.

Attributes of a private cloud, versus a public cloud, include providing a hedge fund more control over their data, excellent client service/response times, and greater integration with hedge fund vertical-specific applications such as order management or portfolio management systems.

Now for the segmentation -- a private cloud can be:

1. Deployed on-site by an enterprise IT department and used only by the enterprise. This approach of an internal private cloud is typically used by large enterprises looking to expand or enhance the existing infrastructure and services delivered to users.
   
   OR
   
2. Managed and delivered by a third-party private cloud service provider, such as Eze Castle Integration. This option is ideal for hedge funds and other firms drawn to the simplification and economic benefits derived from fully managed hosted IT solutions.

Analyst Thomas Bittman at Gartner helps provide greater color by saying, [a private cloud is a] “form of cloud computing where service access is limited or the customer has some control/ownership of the service implementation.”

“Graphically, that means that either the provider tunnels through that opaque boundary and limits service access (e.g., to a specific set of people, enterprise or enterprises), or the customer tunnels through that opaque boundary through ownership or control of the implementation (e.g., specifying implementation details, limiting hardware/software sharing). Note that control/ownership is not the same as setting service levels – these are specific to the implementation, and not even visible through the service.”

The following graphic shows the difference between customer private clouds and provider private clouds.

At Eze Castle Integration, our Eze Private Cloud Services are designed to provide hedge funds and investment firms seamless access to the technology and business applications they require to effectively and efficiently run their businesses.

To learn more about cloud computing at hedge funds, DOWNLOAD our eBook or check out our other HedgeIT articles HERE on the topic.

Photo credits: Gartner

While there are countless applications in the marketplace designed to meet the unique needs of investment management firms, we thought we’d highlight a few here that our hedge fund clients use regularly to support their trading operations.

Order/Execution Management

Via an OMS solution, hedge fund firms have the ability to review performance, exposure and risk profiles in real time, monitor pre- and post- trade compliance results and enhance audit trails on a daily basis.

Eze OMS

Respondents from our 2011 Hedge Fund Operations & Technology Benchmark Study overwhelmingly named Eze OMS as their order management system of choice. Part of the ConvergEx Group, Eze Castle Software’s Eze OMS is used by more than 400 buy-side firms worldwide and “provides functionality to support portfolio management, compliance, trading and operations in a single platform.”

Portfolio Management/Accounting

A hedge fund’s portfolio management system is arguably its most critical daily application. With a PMS, investment firms can make real-time trading decisions as well as capture daily trading activity via an integrated technology platform.

Tradar’s Insight

Tradar’s Insight platform is available for the front, middle and back office and offers “improved efficiency by reducing costs, mitigating operational risk and by providing full portfolio transparency.” More than 200 global firms with assets ranging from $10mm to $10bn use Insight on a daily basis to control their trade processing and reporting.

Advent’s Geneva

Geneva – once considered solely a back office accounting platform – has evolved into a fully integrated portfolio management tool for hedge funds, asset managers, family offices, and fund administrators, and is currently supported by more than 250 firms worldwide. Geneva’s features include real-time, out-of-the-box dashboards for accurate P&L, general ledger and NAV calculation, and middle-office functionality such as trade capture and allocation.

If you’re a fund-of-fund, family office or pension/endowment fund, be sure to read up on Ledgex – a comprehensive platform that delivers portfolio management and monitoring, investor relations, reporting, security and compliance.

Click here to learn more about the benefits of hosting your hedge fund applications in the cloud.

Additional Resources:

• Cloud Computing: Application Hosting Considerations, Part One
• Cloud Computing Part Two: Eight Questions to Ask Application Hosting Vendors

Mobile Hotspot
The ability to turn my BlackBerry into a mobile hotspot got my attention after some recent trips to NYC where I enjoyed the snail-pace of Acela’s free Wi-Fi. The Mobile Hotspot feature is found under ‘managed connections’ and allows you to connect up to five Wi-Fi devices at once.

BlackBerry warns that additional charges might apply for Mobile Hotspot use and tha,t during phone calls, Internet traffic to and from connected devices will be suspended until the call ends.

For reference, it was $20/month to add the Mobile Hotspot data service to my Verizon BlackBerry. The package includes 2GB of data, which the Verizon rep said even heavy users typically never reach.

While Wi-Fi hot spots are pervasive, the Mobile Hotspot capability may come in handy for frequent travelers.

BlackBerry Tag
Full-disclosure, I haven’t tried this new feature yet but can see the value, especially when I don’t have a business card handy or want to quickly share a photo or document.

With BlackBerry Tag, users can tap their NFC (Near Field Communications) BlackBerry (i.e. Bold 9900/ 9930 and Curve 9350/9360/9370) against another NFC enabled BlackBerry and easily share information. The uses BlackBerry mentions in their press release include “invite a friend to BBM, exchange contact information, documents, URLs, photos and other multimedia content.”

Looking ahead, BlackBerry may use this NFC capability to create apps that turn the device into a virtual wallet, but, for now, we can more easily share information and invite a friend to BBM.

Wi-Fi Calling
Available for a more limited audience, BlackBerry 7.1 OS also supports carrier implemented Wi-Fi calling services (aka UMA or GAN where available), allowing users to make Wi-Fi calls from their BlackBerry smartphone that don’t eat into their airtime minutes. Not all carriers offer such a service – Verizon is one that does not.

FM Radio (Bold users need not apply)
Only for BlackBerry Curve 9360 or 9380 users, the device can now serve as an FM radio so users can enjoy local FM radio stations while on the go.

All-in-all BlackBerry 7.1 OS has some nice add-ons, but in reality most only have applicability to a subset of BlackBerry users.

Photo credits: BlackBerry

Following are five key cloud computing trends to look for in 2012:

1. Education will remain important.

The industry came a long way in 2011 in terms of learning about the cloud – what it is, how it works and more. But believe it or not, there is more to be learned. In 2012, we expect conversations to go to a deeper level and focus on topics such as cloud security, operational best practices within the cloud and cloud technology specifics.

2. Cloud security practices will expand.

According to a 2011 cloud computing survey by VMware, fifty-one percent of IT executives named security as their top cloud computing concern. As security standards evolve and come to fruition, organizations such as the Cloud Security Alliance (CSA) will continue to put forth best practices for maintaining secure cloud environments – whether public, private or hybrid. You can read more about the latest version of the CSA’s “Security Guidance for Critical Areas of Focus on Cloud Computing” here.

The type of cloud environment does still play a role in security (or at least concerns about security). According to VMware’s “Global Cloud Computing Adoption: Transformation Is in the Air,” more companies are leveraging hybrid enterprise clouds that combine the best of both public and private cloud environments.

“Public clouds without transparent security controls, that can’t be audited against security standards organizations demand today, are unlikely to support their business or IT transformation. This makes them less appropriate for hosting data that is mission-critical or subject to compliance requirements.”

3. Cloud technology will evolve.

The foundation technology the supports cloud computing will continue to evolve as more and more enterprises adopt this platform. At Eze Castle, we rely on technology hardware and software experts such as VMware, NetApp, Cisco and Microsoft to provide our clients with best-in-breed technologies and platforms. As cloud traffic continues to increase, these vendors will need to expand and evolve their product sets to meet the growing demand and maintain the speed, reliability and predictability that come with the cloud.

4. IT staffing requirements will change.

One question on a lot of minds is what the effect of increased cloud adoption means for IT staffing. And while the first thought is to assume staffing needs will be cut due to the cloud, it is not necessarily the case. The cloud does change requirements for IT professionals, however.

In 2012, we expect to see demand for new IT skill sets, particularly as they relate to the cloud. “Cloud credentials” will come into play and may give a boost to both current employees and new applicants. As the cloud continues to evolve, so too must the knowledge and understanding of those IT professionals who manage it.

5. Service Level Agreements will be top of mind.

Like with any other technology, end users and technology providers will need to work together to create and maintain comprehensive Service Level Agreements (SLA) to protect both sides. SLAs relative to the cloud should include key criteria not limited to:

• Availability and performance requirements
• Security and privacy controls
• Disaster recovery expectations
• Escalation and troubleshooting processes and procedures
• Change management procedures

Be sure to subscribe to Hedge IT to stay up-to-date on everything you need to know about cloud computing; or contact us to discuss the Eze Private Cloud.

Source: VMware
Photo Credit: Flickr

Titled ‘Disaster Recovery: An ounce of prevention is worth a pound of cure,’ we covered a range of topics with the overarching theme being that there is no excuse for a hedge fund not to have disaster recovery in place. To quote one panelist, “Nobody Gets a Pass” – including service providers.

Here are some of the highlights from the panel:

The difference between DR and BCP?

• BCP focuses on the people, processes and operations while DR looks at the IT systems necessary to maintain business as usual should an incident occur.

How has the DR and BCP landscape changed over the last five years?

• From a regulatory perspective, more is expected from hedge funds, and regulators are more knowledgeable about what IT systems and safeguards should be in place.
  
• Beyond regulators, investors not only expect hedge funds (regardless of AUM) to have DR and BCP in place, but they want proof the systems accurately reflect the business processes and risk landscape. A simple ‘check the box’ approach to DR is no longer enough to satisfy investors.
  
• The IT landscape for DR has changed as well. The prevalence of cloud-based DR services has driven down the cost of DR substantially making it economical for funds of all sizes. Additionally, the cloud has lifted the technology management burden off many hedge fund managers.

360-degree due diligence emerging as the new norm

• Investors are scrutinizing hedge funds and, in turn, hedge funds must scrutinize their service providers. To quote one panelist, “Trust but verify. No one gets a free pass in this day and age.”
  
• Conducting due diligence on your service providers is essential to drive out unknown risks and protect your firm. A DR system becomes valueless if your IT provider is unable to fulfill their role of activating the system. Ask your provider how they would handle a multi-client activation scenario – do they have the staff to activate 30 clients simultaneously? What is the provider’s plan if their primary office becomes unavailable?

Are DR hot seats necessary anymore?

• The resounding answer from the panel was “no,” with the caveat that it is a personal choice that really comes down to a team’s dynamics and how they work together. If a portfolio manager is most comfortable having his team together should an incident occur than securing hot seats is the ‘right’ choice. However, today’s technology makes it unnecessary for hot seats to continue operations.

Electricity and Internet connectivity are the oxygen for any DR system. What happens if these items aren’t available?

• This is where planning comes into play. As part of the BCP and DR planning process firms must run through a thorough Risk Assessment and Business Impact Analysis to understand the most likely threats/risks and associated business impact.
  
• One panelist (a West Point grad) referenced the concept of P-A-C-E followed in the US military, which he uses to guide his hedge fund’s business continuity planning. P-A-C-E (Primary, Alternate, Contingency, and Emergency) is used by operational planners to ensure that they have a minimum of four different ways to accomplish a critical task.

Planning is great, but how do you ensure accountability?

• The importance of DR testing and preparation must be set at the top of the organization. At Eze Castle Integration we advise clients to test their DR systems quarterly to help ensure users are comfortable logging in and that the DR environment matches the primary location files and applications. Read our article HERE on what is included within a DR test.

For more information download our 18-page Guidebook on Business Continuity Planning and Disaster Recovery for Hedge Funds or contact us.

BYOD refers to the so-called “consumerization of IT” trend that has emerged, in which the culture of enterprise IT is shifting such that the end user is now the one who has cutting-edge technologies first, as opposed to the organization. As a result of this trend (which is frequently attributed to the advent of such Apple products as the iPhone and iPad), individuals are now starting to prefer using their personal devices in place of company-issued products.

Some organizations have begun to embrace these preferences and have implemented BYOD programs to facilitate the use of employees’ personal mobile devices for business use. So far, many of these firms have reported positive results, although lingering concerns remain. Let’s take a look at some of the pros and cons of introducing a BYOD program at your organization.

Advantages

1. Cost Savings – Companies with BYOD programs in place frequently report significant cost reductions in IT. This is the result of a reduction in the volume of desktop support requests from employees to internal IT departments. Additionally, when employees supply their own mobile devices they typically absorb hardware costs and, at least, a portion of the accompanying voice and data service fees. In fact, according to the Good Technology State of BYOD Report, about 50% of companies with BYOD models in place require that their employees cover all costs associated with their mobile devices – and most are more than happy to do so.
   
2. Employee Satisfaction – People buy and use the cell phones, laptops and tablets they have for a reason: they have done research and determined that those devices are the best for them. They quickly become accustomed to the intricacies of those specific devices and are able to efficiently maneuver them to perform daily tasks. Given the opportunity, many employees would prefer to use these devices in the workplace in lieu of company-issued hardware.
   
3. Flexibility – Today, employees do not want to be constantly tethered to a desktop PC. They want the freedom to work remotely if necessary, especially if travel is a major aspect of their jobs. In order to do so, they need mobile computing devices that can maintain the speed and efficiency of in-office equipment. There are now several devices available in the marketplace which make this possible.
   

4. Green/Sustainability Benefits – Employees who use only desktop PCs tend to leave them on all night. Although computers are much more energy efficient than they once were, they still require far more energy to operate than laptops, cell phones or tablets. Also, these mobile devices are generally more likely to be turned on and off between uses, thereby reducing the company’s environmental impact even further.

Concerns

1. Loss of Control – When an organization agrees to allow employees to supply their own devices, it inherently loses control over the hardware and how it is used. When employees use the same device for both personal and professional use, governing where the line between the two should be becomes difficult.
   
2. Security Risks – Mobile devices that are provided by a company’s IT department are usually equipped with enterprise-level security tools to prevent a potentially costly breach. The IT team then has the ability to continuously upgrade and enhance these tools over time to ensure ongoing protection. The same cannot be said for an employee’s personal device, so the risks are much greater.
   
3. Compliance Risks – Many industry regulators require specific data protection measures that may be difficult to maintain with a BYOD model.
   
4. Handling Employee Departures – When an employee leaves the organization, there must be a way for the company to retrieve any proprietary or sensitive information from the individual’s mobile device and sever future access to the network.

As the BYOD trend continues to grow, it will become increasingly difficult for organizations to ignore. Nearly all employees now have personal mobile devices, and it will become continuously more convenient to handle both personal and business tasks on them. Whether your firm chooses to adopt a BYOD program or not, be sure you have a clearly defined policy in place that outlines what is and is not acceptable and clearly states what the expectations are.

For more information, contact an Eze Castle Integration representative today!

In this spirit, I spoke with some internal experts here at Eze Castle Integration to gain their thoughts on a few areas in which hedge funds could consider making enhancements in 2012. Check out our list of the top five resolutions every hedge fund should make:

Resolution #1: Investigate the Cloud.
Cloud computing was certainly a hot topic in the investment industry in 2011. This year, the conversation is getting deeper and more technical as hedge fund managers seek to gain a more thorough understanding of this technology and consider implementing it within their firms. Whether you are a startup fund preparing to launch this year, or an established firm looking to improve efficiencies and reduce costs, the cloud provides real opportunities for improvements in 2012. Advantages include increased flexibility and scalability, less required maintenance and reduced expenditures. There are also potential challenges associated with cloud computing, such as privacy and data security concerns. Resolve to learn more about the cloud in 2012, as many of your competitors are likely doing the same.

Resolution #2: Test Your Disaster Recovery (DR) Systems Regularly.
We frequently talk about the importance of disaster recovery for investment firms, but many fund managers lack a strong understanding of the importance of testing DR systems on a regular basis. Routine tests can help your firm ensure that its DR site meets all current business needs. Since these needs are likely to evolve and grow as your organization does, changes will be made to the production environment to reflect these ongoing developments. Likewise, the DR site should be adapted in order to continuously mirror the changing business requirements. By engaging in regular disaster recovery system tests, firms can ensure they will be fully prepared to continue operations in the event that a disaster knocks out the production environment.

Resolution #3: Locate, Review and Evaluate All Current Telecom Contracts.
Telecom contracts that you signed 1-3 years ago are probably coming due in the near future. To assess, begin by locating any contracts that are currently in place. Be aware of the re-term dates, as some contracts may have automatic renewal features which could lock you into the same terms without renegotiating. Make note of the contract expiration dates and plan to renegotiate or research better options before renewing for 2012 and beyond.

Additionally, stop assuming that carrier bills are accurate, and double-check to make sure you are not being overcharged and that no billing errors have occurred. Many organizations are not as automated as you may think. Be sure you can validate all costs and taxes on your invoices. If missed, these can be repetitive errors that you pay excessively for over time.

Finally, ask an Eze Castle telecom expert about making technology upgrades. For example, is making the switch from a land line or PRI over to VoIP right for your company? Can your phones or voicemail systems be upgraded? Does your firm require more bandwidth? Once you have spoken to an Eze Castle representative about your current setup, an audit can be performed to determine how your current environment runs and whether any other options exist to enhance it.

Resolution #4: Ensure Your Business Continuity Plan (BCP) is SEC/Dodd-Frank Compliant.
With increasingly stringent guidelines coming down from the SEC in recent years (including the implementation of the Dodd-Frank Act, part of which goes into effect in 2012) it is crucial to examine your firm’s business continuity plan to ensure compliance. Be sure to keep these important considerations in mind when determining whether your firm’s BCP is compliant:

• Do you have a designated evacuation site?
• Do you have all of the resources necessary to ensure your business can continue operations during a disaster?
• Do your employees know how to access all crucial applications if your office becomes inaccessible?
• Do you have accurate contact information for all employees?
• Does building management know who to contact from your organization in the event of a disaster or building closure?

Resolution #5: Perform a Comprehensive IT Systems Audit.
At Eze Castle, we recommend that our clients perform an annual IT systems audit and “checkup” under the guidance of a senior systems engineer. For fund managers whose primary focus is making sound investment decisions, making the time to thoroughly assess the firm’s IT environment is a task that can easily be overlooked.

However, this process is extremely important, as it provides perspective on the health of the firm’s current technology and can bring to light any areas where changes or enhancements should be made. Performing an annual IT audit is also helpful for management when outlining roadmaps and budgets for the new year. In an age when technology is quickly becoming a competitive differentiator in the investment industry, firms cannot afford to let inefficiencies persist in their IT systems.

Photo Credits: New Year's Resolutions Generator

Your First IT Decision of 2012? On-premise or Cloud

One of your first technology decisions of the year is your most important one: do you want your fund to operate on a traditional, on-premise technology infrastructure or utilize private cloud services? This decision will affect many of your other technology choices, notably the type of office hardware and connectivity you will require, so we urge you to do your due diligence and select the option that best suits your firm’s needs.

Once you’ve made your infrastructure selection, there is a seemingly endless list of additional technology requirements for your firm. Luckily, I’ve whittled them down here to focus on some top technology priorities for you to focus on as you enter 2012.

Infrastructure/Hardware

• Desktop computers, monitors, laptops, servers and printers
• Network connectivity featuring N+1 redundancy
• Wireless and Local Area Network (LAN) capabilities
• Physical and technical infrastructure security for Comm. Room and/or colocation facility (wherever your firm’s infrastructure is stored)

Software/Hedge Fund Applications

• Trading and order management system
• Accounting and/or portfolio management system
• Market data and analytics tool(s)
• Installation, maintenance and upgrades for all software

Telecommunications/Mobility

• Internet connectivity
• Voice systems (traditional or VoIP)
• FIX connectivity to brokers
• Mobile devices

Business Resiliency & Protection

• Disaster Recovery system, including remote/hot site
• Business Continuity Plan, including written processes and procedures
• Email Archiving solution to meet investor/legal requirements (e.g. Dodd-Frank)

As a follow up to this checklist, on Thursday we’ll offer our New Year’s resolutions that every hedge fund and investment firm should make in 2012. Stay tuned!

Want more now? Download our Guide to Technology Outsourcing.

Photo Credit: Google

We expect these trends to continue to permeate the blog through 2012, and we’ll continue to expand our reach by bringing you relevant and interesting content to read (and watch) come next year. If you have suggestions or feedback on the Hedge IT blog, please feel free to contact us.

Alas, here are our most popular hedge fund technology blog posts from 2011:

Dodd-Frank IT Implications for Hedge Funds: Disaster Recovery, Archiving

We provided a snapshot of the Dodd-Frank Wall Street Reform Act as it relates to hedge fund technology, notably system safeguards and record keeping. Non-exempt firms must comply by March 30, 2012.

State of the Hedge Fund Industry in 2011

Following a panel seminar we hosted in New York, we outlined the key market trends for 2011 in the hedge fund industry, including new fund launches, regulations and cloud computing. Presentation included!

Top Ten Questions to Ask a Cloud Services Provider

One of the most popular topics on Hedge IT is cloud computing, and this article breaks down our own Bob Guilbert’s top ten questions to ask a cloud services provider during the evaluation process.

Trends in Hedge Fund Technology Outsourcing

In accordance with the release of our newest guidebook, A Guide to Technology Outsourcing for Hedge Funds, we provided an overview of the key trends in technology outsourcing, including cloud computing, outsourced staffing and colocation services.

We’ve Got MORE Questions: RFP Questions on Business and Data Protection

Our most popular blog article in 2011 on the topic of business resiliency was this one, which outlines sample RFP (Request for Proposal) questions relative to disaster recovery, BCP, security, backup and more.

Hard Drive Shortage in Thailand Affecting Supply Chain for Resellers, Consumers

One of the biggest technology stories in late 2011 was (and still is) the hard drive disk shortage that transpired in the aftermath of flooding in Thailand. Read more about the situation and how it could continue to affect the technology industry in 2012.

Eze Castle Speaks: What We’re Thankful For (Video!)

A personal favorite of mine, we asked our Boston employees what they were thankful for this year. Watch our video to find out!

On behalf of everyone at Eze Castle Integration, we wish you a safe and happy New Year! See you in 2012!

So, we took a look into our technology crystal ball and pulled together a list of some exciting trends to look for in 2012. Enjoy!

The “BYOD” Trend

The BYOD (“Bring Your Own Device”) movement started to gain traction in some organizations in 2011 and seems to be catching on. This trend, in which employees bring their personal smartphones or tablets into the workplace for business use, is gaining popularity as companies begin to adopt Apple and Android products more widely. In 2012, expect more discussions about how to best manage business applications and data on employees' personal mobile devices.

Cloud Discussions Focused on Security

Cloud computing was a leading topic of discussion in the investment technology world in 2011. As more and more firms become interested in reducing costs and reaping the other benefits associated with the cloud, adoption will surely continue to increase throughout the industry.

Now that most fund managers are familiar with the cloud at a high level, 2012 will be the year of diving deeper into this type of infrastructure, focusing in large part on cloud security and data protection. The Security Guidance for Critical Areas of Focus in Cloud Computing Guide, which was recently released by the Cloud Security Alliance (CSA), serves as a roadmap for managers seeking to gain a better understanding of the security considerations associated with the cloud paradigm.

The Tablet Takeover

While Apple’s iPad certainly paved the way for the rapidly growing tablet market, a number of other industry players have developed rival devices with comparable capabilities and features. Samsung’s Galaxy Tab, Amazon’s Kindle Fire, Sony’s Tablet S and Motorola’s Xoom are just a few of the recent market entrants who have helped to spur the tablet movement. With skyrocketing adoption rates, look for this technology to grow in popularity throughout 2012.

Mobile Payment

Smartphones have saturated the enterprise market over the past few years. In 2012, look for Near Field Communication (NFC) technology to enable smartphone users to make payments by simply waving their phones near a credit card reader at checkout stations in stores or taxis. By the end of the year, it is expected that one out of every five smartphones will be equipped with this technology.

Voice Control

When Apple introduced Siri on its iPhone 4S device earlier this year, it was the first tool of its kind to accurately understand human voice controls and take corresponding actions, such as sending an email, responding to a text message or creating calendar alerts. Expect several Apple competitors to come out with similar voice control applications in 2012. An important factor driving this trend: many city and state governments are implementing laws against texting while driving. Voice-controlled devices may prove even more valuable for users who spend a lot of time behind the wheel.

2012 will certainly be an exciting year in the world of enterprise technology. We look forward to sharing more innovative industry trends with you next year!

Which of the above trends do you think will be the hottest in 2012?

Click below to view our 2011 holiday e-card!

With over 135 million members, LinkedIn has grown exponentially since its inception in 2003 and is the most respected “professional” social networking site in the industry. And regardless of what your reason is for using LinkedIn (recruiting, prospecting, job searching, etc.), it is essential that you put your best foot forward through your personal profile and activity.

The presentation below outlines a few tips to help you get the most out of LinkedIn, including:

• Building Your Personal Profile
• Customizing & Organizing Your Profile
• Making & Soliciting Recommendations
• Adding Applications
• Joining & Participating in Groups

In any type of disaster situation, it becomes a necessity to have a business continuity plan in place. You’ll need to ensure your employees know how to access their technology and how to communicate with each other if they are unable to get to the office during bad weather. There are a variety of potential scenarios that could ensue with the winter season approaching. You can learn more about these scenarios and how to respond to them here (when your hedge fund office is not accessible) and here (when your office is accessible).

Regardless of the specific scenario, there are certain business continuity best practices that your firm should follow in order to ensure your business processes are not interrupted when the first snowstorm hits.

The Importance of Communication

The reality is, you can have all the processes and procedures in place to prepare for a disaster, but if they are not properly communicated to your employees and external parties, then their effect with be minimal.

Start by determining who needs to be notified during a disaster, both internally and externally. In addition to employees and their families, you’ll want to consider the third-parties you work with regularly including investors, fund administrators, and other vendors. Once you know who to identify, the question is how to identify them. Consider using an automated messaging system that will send SMS (text) messages to all identified parties. Another good strategy is the use of wallet cards, which can be distributed to all internal parties and include information on alternate work locations and other business continuity instructions.

The key is remembering to start the communication process before you actually need to – while your technology is still available. Create a calling tree in advance of a disaster so each person understands who is responsible for notifying whom.

Finally, in order to ensure these messages are properly communicated, consider holding employee information sessions and conducting tabletop exercises internally to walk through formal processes and ensure everyone is on the same page.

Remote Access Technologies

When a winter disaster strikes, it’s very possible that employees will be forced to work from home or an alternative work location if they are unable to get into the office or the building is closed to tenants. But ensuring your employees actually know how to work remotely will go a long way in validating the effectiveness of your BCP plan.

There are a few different options for remote access, notably Virtual Private Network (VPN), Citrix, and Outlook Web Access (OWA).

• VPN: IPSec or SSL VPN technologies work by connecting your home computer to that which resides in your office. You are able to “remote desktop” and run all of the applications which live on your work computer’s server.
  
• Citrix: With a Citrix server, you are able to log into a website via any computer and get access to the applications that live on the Citrix server in your office. When you click any application icon, it will appear as if it is running locally despite being housed on your office server.
  
• OWA: For those companies who use Microsoft Outlook for email, you can log into OWA to access your email account from an external computer.

Whichever technology or combination of technologies your firm decides to employ for remote access, the key is ensuring your employees know how to properly use them and test them prior to a disaster.

When talking about remote access, another consideration to keep in mind is licensing. SSL VPN and Citrix are both licensed by concurrent users, meaning the number of users accessing the technology at any given moment. As your firm adds new employees and users, remember to add licenses according. Unfortunately, you won’t realize you have fewer licenses than you need until a potential disaster hits.

Remote Test Plans

A remote test plan is an effective means of ensuring your employees can remain functional during a disaster and that your business will not be negatively affected. Following are steps your employees should take to ensure they can use remote access technology successfully during a winter disaster:

• Validate successful communication to internal and external dependencies
• Confirm full functionality of required applications
• Perform all business functions
• Confirm access to vital records
• Redirect phones to home/mobile phone

You can also read our article on what is involved in a DR test.

Ultimately, your business will remain operational and successful during any winter weather disaster that strikes if you ensure you have the proper processes and procedures in place, you communicate those procedures thoroughly to your employees and you encourage all personnel to test their remote access capabilities.

If you would like to learn more about the BCP process or to speak with an Eze Castle Certified Business Continuity Professional, please contact us.

Our training and corporate development program is one of the many reasons our employees think Eze Castle is a great place to work. But enough from me! You want to hear straight from our New York employees about why they love Eze Castle, right?

It’s your lucky day. Check out our newest video and see what these Eze Castle employees love about their Best Place company!

• Up-Front Decisions & Vendors Required
• Legal Issues
• Client Services
• Marketing & Sales
• Technology
• Operational Concerns
• Partnership Accounting & Performance Measurement
• Compliance
• Reporting
• Investor Due Diligence

With years of experience in supporting new fund launches, Eze Castle was honored to participate in this workshop to provide attendees some perspective on the most important technology considerations to keep in mind when starting the hedge fund launch process.

Steve Schoener, our vice president of client technology, delivered the following presentation to all conference attendees. Check it out!

Launching a Hedge Fund: Technology Considerations

View more presentations from Eze Castle Integration.

Interested in learning more about technology considerations for launching a hedge fund? Don't miss these great resources:

• Article & Presentation: The Keys to Successfully Launching a Hedge Fund
• Article: Hedge Fund Technology Budget: A Blueprint to Get You Started
• Webcast: Launching a Hedge Fund - Legal, Financing & Technology Considerations for 2011

Ledgex Systems is a software provider targeting the alternative asset management industry – primarily multi-fund managers and private equity firms. Since officially launching in 2010, Ledgex Systems has signed many new clients and invested greatly in expanding the functionality of its flagship product, Ledgex. Today they released Ledgex 4.0.

The Ledgex platform gives alternative asset managers the ability to systematically manage their portfolios, perform complex liquidity scenarios, and provide robust reporting, both internal and external to the firm.

Version 4.0 introduces Ledgex Reconciliation, a new module that provides an automated method for users to systematically import data from their administrators and compare it with existing portfolio data. Ledgex Reconciliation greatly simplifies the manual reconciliation process that various functional groups within a firm are tasked with performing on a daily, weekly, and monthly basis.

The new version also includes enhancements that private equity firms should appreciate including advancements in the ability to track in–depth account level details and provide a quick analysis and calculations of account assets and returns.

In case you aren’t well versed in all Ledgex has to offer, here is a recap of the other platform components:

• Ledgex Workbench, a streamlined portfolio planning module which consolidates portfolio management activity into a central workspace. Ledgex Workbench allows users to perform complex scenario-based trade planning, customized ‘what if’ analysis, and complex liquidity modeling for all future portfolio activity.
  
• Ledgex Manager, a comprehensive portfolio management system for fund of funds, private equity firms, endowments, family offices and fund administrators. Ledgex Manager solves the need for advanced portfolio management and administration and provides the ability to manage the investment pipeline, perform due diligence, track fund estimates and manage the final valuation processes.
  
• Ledgex Monitor, a fully customizable investment monitoring system. Ledgex Monitor provides the tools necessary to monitor and track firm-defined fund attributes for detailed analysis, fund attribution, and transparency reporting.
  
• Ledgex Investor Relationship Management (IRM) for managing quantitative and qualitative data for a firm’s investors and hedge fund or private equity interests.
  
• Ledgex Alerts enables individuals or groups at a firm to monitor internal and external activity, content, business data, and relevant industry information.

Want to learn more? Contact Ken Kilduff at 617-439-7340 or kkilduff@ledgex.com. Be sure to tell him your good friends at Eze Castle Integration sent ya!

• Cloud Computing – You probably knew this would top our list. Adoption of cloud technology continues to grow, especially as concerns around cloud security ease thanks to technology advances and education. Eze Castle Integration has invested millions in our Eze Private Cloud and today has nearly 160 clients utilising our cloud services.

• Virtualisation – This technology is becoming commonplace in both on-premise and hosted IT environments and we expect that trend to continue through 2012.
  
• Social Media – Business communications have evolved from purely email-based to now include social media platforms from Facebook and LinkedIn to Twitter, Google+ and YouTube. As such, hedge funds are challenged to create social media policies (or not) that guide users' actions in these communities. Participation in social media forums will surely continue to increase in 2012 so firms should consider how a social enterprise will impact their firm (either positively or negatively).
  
• Smart Phones and Mobile Applications – Apple has changed the game with its mobile devices, and today iPhones and iPads are becoming the norm, rather than the exception, for hedge fund professionals. The growing array of mobile devices and applications challenges IT to protect company data while fulfilling user demands for device autonomy.

Beyond technology discussions, part of Vinod's trip included attending the London Hedge Funds Care Open Your Heart Benefit. Vinod is a member of the New York City Committee of Hearts for HFC. Here is a picture of our team before they headed out for the benefit.

Useful Resources

• Exploring Cloud Services for Hedge Funds Resource Page
  
• Trends in Hedge Fund Technology Outsourcing
  
• A Guide to Technology Outsourcing for Hedge Funds

·

Here at Eze Castle Integration, we talk regularly about cloud security and best practices, so I believe it is important to increase awareness of this great resource. The topics covered in this 177-page report revolve around three key areas. Here is a snapshot of the three key sections as defined by the CSA:

1. Cloud Architecture: The Cloud Computing Architectural Framework provides a conceptual framework for the rest of the Cloud Security Alliance’s guidance. The content of this section focuses on a description of cloud computing that is specifically tailored to the unique perspective of IT network and security professionals. Checkout the OpenCrowd Taxonomy below.

2. Governing in the Cloud: The fundamental issues of governance and enterprise risk management in cloud computing concern the identification and implementation of the appropriate organizational structures, processes, and controls to maintain effective information security governance, risk management, and compliance.

Organizations should also assure reasonable information security across the information supply chain, encompassing providers and customers of cloud computing services and their supporting third-party vendors, in any cloud deployment model.

To assist in this effort, this section of the guide covers governance and risk management, cloud computing legal issues, compliance and audit management, data security, and interoperability.

3. Operating in the Cloud: One purpose of this section is to assist cloud service users to share a common understanding of traditional security (physical security) with cloud service. Traditional security can be defined as the measures taken to ensure the safety and material existence of data and personnel against theft, espionage, sabotage, or harm. In the context of cloud information security, this is about information, products, and people.

Topics covered in this section include business continuity and disaster recovery in the cloud, data center operations, incident response, application security, encryption and key management, access management, virtualization, and security as a service.

You can download a copy of the complete report HERE.

Cloud Computing Taxonomy

Image credit: OpenCrowd