Two CFOs walk into a bar…

img_The-scary-thing-is-hes-our-CFO-(rde9535h)_2010-2134

IDENTITY | POLICY

Who can blame them? Now they’re being asked to deal with data security.

When we started to develop Silo, we had a gut feeling that centrally securing and policy-enabling the browser would have profound implications, though we weren’t sure where it would resonate first. But over the past few months, we’ve uncovered numerous business situations that depend on browser-based apps to handle sensitive data and delegate access and trust to a wide variety of users. When we talked to finance leaders, they immediately took notice because this describes their situation to a tee. Here’s how:

Our recent survey of CFOs uncovered three main shifts that are impacting finance teams: a greater dependence on cloud based applications, the explosion of users and devices that require access, and the CFO’s shared responsibility for data security.

The first two are unsurprising and reflect the need for finance to be nimble, cost efficient, and support flexible working models. Firstly, web apps offer anywhere access for users who are ever more mobile or need to work remotely. Secondly, companies are increasingly farming out work to business process outsourcers (BPOs), accounting teams, and financial consultants. A recent study by KPMG shows that 40% of businesses are looking to increase their finance and accounting outsourcing this year. The primary drivers being cost reduction, scalability of operations, and process standardization.

Good news all around it would seem. Both sides of the outsourcing relationship benefit from the fact that web apps deliver a simple and standard way to access data and collaborate with clients using the browser. IT infrastructure alignment between customer and vendor is a moot issue, and the two sides can live together happily ever after. Right?

Unfortunately, the fairy tale doesn’t end so well. CFOs are forced to balance the benefits using a BPO against the inherent technical and human risks associated with delegating sensitive accounts to third parties, especially since the online accounts of businesses are increasingly the target of criminal exploits. And while it’s tempting to toss the problem over to the CSO or IT, shift number three keeps the ball in the CFO’s court. Safeguarding company information has become a shared responsibility between finance and more traditional functions.

Peeking behind the curtain of a financial BPO reveals the same cascading levels of trust and risk that companies face within. Most BPO environments have pools of agents that cycle across clients. Agents need to share credentials to different online accounts which requires them to be stored somewhere for group access. Agents mix client and personal data within the same browser, and in firms where pools are decentralized or workers are mobile, their access device might be completely unmanaged. Finally, as agents come and go, access to client accounts needs to be systematically granted and revoked. A process that is cumbersome at best, and disastrous if left unattended.

So far, companies have accepted the risk associated with BPOs, and BPOs have accepted the liability of handling client information. It’s a lose-lose situation, but to date there hasn’t been a way to delegate web account access while ensuring integrity of the web session and protection of credentials. And that’s why we think Silo is a game changer. It offers a sterile environment for business activity - isolated from other websites or infected computers - to address the reality of web services being accessed from anywhere. It also enables delegated account access to internal or external users without disclosing passwords. This constrains accounts to Silo and makes light work of granting and revoking access in pooled environments.

So far the feedback has been tremendous. Silo enables both sides of an outsourcing relationship to enforce control where it was previously impossible. CFOs and BPO firms aren’t stuck between a rock and a hard place, and that’s why we’re committed to getting finance teams onboard. We’ve just created a program that allows any organization to access an online bank through Silo for free, for as many internal or external users as required. Time to stop crying into your beer. Sign up for Silo here.

Ramesh Rajagopal - Ramesh is Co-Founder and President of Authentic8. Before, he was VP Corporate Development at Postini, heading up strategic planning and business development until its acquisition by Google in 2007.

Topics: Identity, Policy