On our recent Emerging Manager Trends in Operational Due Diligence webinar, we looked at how today’s emerging managers face a number of challenges from fierce competition to the rapidly evolving investor IT due diligence process, especially in terms of scrutiny on technology processes and security safeguards.
The reality is that investors have a greater understanding of technology, are asking more probing due diligence questions and care about the responses they receive. In recent years the depth of DDQ questions around information technology and security has expanded as investors become increasingly savvy about IT and headlines around IT risks have grown.
Here at Eze Castle Integration we regularly assist our clients in completing the IT portions of investor due diligence questionnaires. The wording of questions varies but here is a handy list of 51 common IT due diligence questions we see.
- Provide an organization chart for the Company, its affiliates and key personnel.
- Provide the physical address and general contact information for each of the Company’s office locations.
- Provide the name and contact information of the Company employee(s) assigned to the client’s account(s).
- Provide a list of compliance personnel, their roles and qualifications, the date of his/her appointment and position within the Company’s organizational structure.
There has been discussion for years about whether public or private cloud platforms were more suitable to financial and investment management firms. And that debate continues, but with the addition of a new player – the hybrid cloud.
While the public cloud receives praise for its flexibility and potential cost savings and the private cloud for its robust security and reliable performance, the hybrid iteration essentially marries these features to create a compelling package for firms who don’t fit naturally into the previous two categories.
As its applicability continues to surge, it is worth understanding the concepts and benefits behind the hybrid cloud. Let’s take a look at what makes hybrid environments appealing to some organizations:
Agility & Flexibility: A hybrid cloud model allows a company to combine public cloud assets with those in a private cloud to increase agility and availability. For example, combine Microsoft Exchange and file services via the public cloud with robust security layers and 24x7x365 managed support via the private cloud, and suddenly you’re benefiting from the best of both worlds (hint: we’re talking about the Eze Hybrid Cloud).
During a recent webinar on operational due diligence, we explored the changing ODD environment for emerging managers, and our guest speaker, Frank Napolitani of EisnerAmper, helped shed light on some critical missteps that could cause ODD teams to veto an investment.
>> Click here to listen to our full conversation with Frank and hear more about operational due diligence trends
At the highest level, investor due diligence experts see the following as the most egregious red flags:
Dishonesty: Demonstrated in the form of failing to disclose or withholding information. This shows a lack of integrity.
Belligerence: When managers exhibit an ‘I’m never wrong’ attitude and are unwilling to listen to objective advice.
Incompetence: When a firm or manager’s skillset doesn’t align with the expertise required for a particular function.
More specifically, there are a number of red flags that can give investors pause and lead to either increased due diligence or an outright rejection. From a recent Deutsche Bank survey, keep reading for a few reasons:
Categorized under: Operational Due Diligence Cloud Computing Security Outsourcing Launching A Hedge Fund Private Equity Disaster Recovery Hedge Fund Operations Infrastructure Business Continuity Planning Trends We're Seeing
October is Cybersecurity Awareness Month, and since we've written A LOT about security over the last few years, we thought it would be helpful to share some of our favorite articles. Here are some of Eze’s latest and greatest cybersecurity articles - happy reading!
20 Cybersecurity Dos and Don'ts Your Employees Should Follow
What’s the Difference Between Next-Generation Firewalls and Traditional Firewalls?
Six Myths about Hedge Fund Cybersecurity
Is “Smart” Technology Invading Your Privacy?
Top 10 IT Security Audit Gaps and How to Avoid Them
An Achievable Calendar for Cyber Security Plan Implementation
Will Outsourcing Shield You from Cyber Threats?
Here Are Investment Managers' Biggest Cyber Security Fears
We all make mistakes, but when it comes to technology and investment operations, mistakes aren’t an option. So let’s look at seven common cloud mistakes we see financial and investment management firms make and talk about how to avoid them.
Mistake #1: Not Sizing Bandwidth to Business Needs
Determining the right amount of bandwidth comes down to the types of services being delivered and user expectations. Nothing ruins a cloud or really any computing experience like sluggish application and Internet performance.
Beyond bandwidth, firms must also consider latency. While latency issues don’t impact all applications (i.e. email is relatively insensitive) for others it is a killer. Latency has little place in trading applications or voice over IP services. When moving to the cloud, have a realistic conversation with the hedge fund cloud provider about the amount of bandwidth your firm really needs.
Mistake #2: Not Planning for Applications
Not all cloud platforms are equal especially when it comes to supporting hedge fund specific applications such as Order Management Systems or Portfolio Accounting Systems. While a hedge fund may not launch day one with one of these applications, there is a good chance they will require one in the future. To help mitigate future growing pains a hedge fund should plan for the future when evaluating cloud providers. Being shortsighted can result in future disruptions and integration pains.
This article appeared in its entirety in HFMWeek Magazine in August 2017. Part 1 is featured below. Part 2 will appear on Eze Castle Integration’s blog in the coming weeks – stay tuned!
The security risks we face are ever changing, and it’s a full-time job trying to keep pace. Attacks can spread quickly (think: WannaCry) and disrupt systems, networks and operations to the point of disaster. And social engineering scams – e.g. sophisticated, well-timed phishing emails – are targeting users more frequently, meaning your guards need to be up, technology and otherwise.
Unfortunately, many firms often fall short when it comes to their cyber-security protections – and they don’t often realise it until it’s too late. These 10 common IT security gaps highlight areas where investment firms can take steps now to avoid risk in the future. These gaps are preventable, and when the next phishing email hits your inbox or ransomware attack strikes, you can rest easier knowing you’ve plugged these common security holes.
Risk management and governance
Who owns the risk at your business? Cyber strategy and programmes start at the top, so your leadership team/executive board should be involved in discussions around cyber-security preparedness. You should also appoint a Chief Information Security Officer (CISO) to oversee the firm’s security posture. Oftentimes, this individual holds a dual-role within the firm, also operating as the Chief Compliance Officer or Chief Technology Officer.
Risk management does not end with the CISO, however. There should be broad support and input across the firm with regard to cyber-security practices and governance policies.
In Part 1 of our hybrid cloud whitepaper excerpt, we reviewed the primary benefits to public, private & hybrid cloud infrastructures, and reviewed a number of considerations including service & support, availability and uptime, and proximity. In Part 2 below, we dive into additional factors to contemplate, specifically: security, application hosting and cost. Remember, to download the full whitepaper, Is Hybrid Cloud Right For Your Firm?, click here.
While your public cloud provider may provide world-class security for its services, your company is still on the hook for certifying all aspects of information security. For compliance-driven businesses, there are still countless vulnerabilities and exposures that public clouds often fail to address. Advancing security features such as multi-factor authentication, targeted attack protection and managed phishing simulations are gaining traction among private/hybrid cloud users who benefit from their providers’ extensive managed security services.
Multi-factor authentication requires at least two authenticating factors to log into a system or network (e.g. strong passwords, security tokens, fingerprint scanning) and can add an additional layer of security for users across email, applications, etc.
Since email often serves as a gateway for hackers to surreptitiously penetrate networks, it’s become essential for firms to employ targeted protection tools and advanced email precautions to ward off these threats. That’s one of the many advantages a private cloud provider can bring to a firm. For example, next-generation security technology can protect private cloud users from attacks delivered through email, social media and mobile applications, prevent advanced attacks, and minimize compliance risks.
Categorized under: Cloud Computing Security Operational Due Diligence Outsourcing Launching A Hedge Fund Private Equity Hedge Fund Operations Hedge Fund Regulation Infrastructure Communications Trends We're Seeing
Below is an excerpt from our whitepaper, Is Hybrid Cloud Right For Your Firm?. If video is more your style, scroll to the bottom and watch our 30-minute webcast on hybrid cloud considerations for financial and investment firms.
With its security, privacy, and performance, the private cloud has been the go-to option for financial and investment firms that require enterprise-caliber IT infrastructure. In most cases, that private cloud is professionally managed by a service provider solely focused on monitoring, managing, and maintaining that infrastructure to meet business requirements and compliance directives. Thus, firms benefit from seasoned, industry-experienced professionals who live and breathe financial IT.
For many firms, so-called public cloud infrastructures offer compelling opportunities and advantages. For many smaller and younger firms in particular, the flexibility and ease of deployment are persuasive drivers. What’s more, the initial costs appear to be lower for certain feature sets (although an analysis of the total cost of ownership indicates that advantage is less clear-cut).
Hybrid Cloud: Bringing Them Together
Fortunately, investment firms needn’t take an “either/or” approach to their IT infrastructures. With a hybrid cloud approach that combines many of the most compelling features of public and private clouds, firms can leverage a uniquely flexible platform that meets a broad range of needs.
Which Cloud Has the Edge?
The decision regarding your IT infrastructure has significant implications on the ability of your investment firm to gain and maintain a competitive advantage. As you weigh your options – public, private or hybrid – it can be beneficial to consider the following aspects of cloud architectures and weigh their importance as unique to your individual firm.
We spend a lot of time making suggestions and recommendations about what financial and investment firms should do when it comes to their technology. And while it might sometimes seem obvious, we also think it wise to remind firms what not to do from time to time. In fact, the following technology pitfalls are prime examples of what not to do with respect to your firm’s IT.
Set IT and forget IT.
Technology isn’t evergreen, and it certainly isn’t infallible. With so many investment firms today reliant on managed service providers to support their IT operations, vendor management has become a critical area of importance. IT outsourcing provides great opportunity for firms to rely on experts to manage infrastructure updates, maintenance windows and network upgrades, but the onus remains on your firm to ensure your technology is up-to-snuff and meets not only your demands but those of investors and regulators as well. A “set IT and forget IT” strategy won’t work here; even via outsourcing, your IT management responsibilities fall on you.
Plan your infrastructure only for the short-term.
A crucial mistake often made by funds is not planning for the future. From the earliest pre-launch meeting, you should be thinking about what your firm will look like and what technology you will require down the road. Planning out two to three years in advance is recommended in order to reap the most benefits with regard to your infrastructure. Plus, if you don’t plan ahead, you may wind up incurring more costs and dealing with a much bigger headache if technology decisions need to be made unexpectedly (e.g. cloud and data migration).
Categorized under: Hedge Fund Operations Cloud Computing Security Operational Due Diligence Outsourcing Disaster Recovery Hedge Fund Regulation Infrastructure Business Continuity Planning Trends We're Seeing
In this interview, Eze Castle's Chief Strategy Officer, Mark Coriaty, discusses the emergence of the hybrid cloud and why some financial and investment firms are taking a closer look. NOTE: This article first appeared on Hedgeweek and Private Equity Wire.
Talk about the advancement and evolution of cloud services in recent years and how we’ve ended up where we are.
MC: If you step back and look at the landscape over the last four or five years, we have seen a lot of changes both on the technology front, as well as within the financial markets. Whether the result of fund raising challenges or increasing regulatory demands, the landscape for alternative fund managers has changed significantly.
We’ve therefore had to adapt to the market and this includes three different components: service, technology, and networking/security. With all the different regulatory bodies and demands from standards boards and governments, we needed to make sure we were providing a solution to our clients that a) met those requirements and b) was up to par with the security measures that we pride ourselves on at Eze Castle.
When you look at the Eze Private Cloud, it is a very controlled environment. It features a number of components related to private networking, client controls, data integrity controls, as well as enterprise-standard security measures. But as the public cloud has started to become more popular and mature in recent years, firms have started to pay closer attention to it.
Typically, this is because the cost structure is scalable. If you look at major providers like Amazon, Microsoft and Google, they have enough scale in their infrastructure such that it becomes less expensive for the customer to use the public cloud. However, when you analyse what they deliver versus the requirements of a lot of investment firms, oftentimes those requirements supersede what these large public cloud providers can offer.
Hence the hybrid cloud.