JPMorgan Chase's chief information officer, Dana Deasy, is making public cloud computing a significant part of the bank's IT strategy, a leap most U.S. banks have been too squeamish to take.
By the second half of 2017, the bank plans to run proprietary applications on the public cloud. At the same time, it's building a new, modern internal cloud, code-named Gaia.
The bank is so bullish on the use of internal and public cloud computing that in August it hired Harish Grama from IBM to be its CIO of cloud services.
"We think we're the very first, at least in financial services, to do this," Deasy said in a recent interview. "The reason is simple: we're serious. Getting our CIO for the cloud in right now is the perfect timing — we're answering such questions as what use cases will be best for the public cloud, what would be best for our private cloud, how do we optimize the skillset of our developers for the public cloud, what's the right pace to do that?"
Few large U.S. banks have publicly acknowledged such a firm commitment to using public cloud computing for anything other than common office applications like Salesforce. Largely due to regulatory, risk and security concerns, most have tiptoed around the public cloud, saying only that they do application testing in the public cloud and that they have a few cloud pilots.
Cloud computing dramatically changes the IT organization and the way technology people work, Deasy noted. That's why JPMorgan recruited Grama.
"We wanted a seasoned professional who's been there, done that, and knows what it takes to optimally leverage public and private cloud from the pure technical architecture and what works and what doesn't work," Deasy said. "And we wanted somebody who knew how to think through changing your workforce."
Like most large U.S. banks, JPMorgan Chase has had some version of a private cloud for years, with virtualized servers, storage and networks that can be shared in a flexible way throughout the organization.
The bank is upgrading its private cloud to "platform as a service" — in other words, the cloud service will manage the infrastructure (servers, storage, and networks), so that developers don't have to worry about that stuff. (They do have to make their applications "cloud aware," so that they can monitor themselves and obtain more resources as needed.)
This should improve elasticity — that is, the ability to quickly scale up and down as needs change. In JPMorgan's existing private cloud, "the infrastructure teams work with our developers to identify peak volume through the year," said Larry Feinsmith, the bank's head of global technology strategy, innovation and partnerships. The developers ask for a certain amount of computing and storage resources to meet peak demand.
So although virtualized servers save the bank money, it still has to maintain enough servers to handle peak volumes for every application. In the latest generation of private and public cloud computing technology — some of which use OpenStack protocols to control pools of compute, storage, and networking resources managed through a dashboard or API — "you no longer have to deploy for peak," Feinsmith said. "You have to deploy for steady state and then it will scale up or down when you have peaks." Internal resources are shared across the entire organization, regardless of application. Public cloud resources, of course, are virtually inexhaustible. And instead of needing people to watch applications and provide more horsepower or storage when needed, the applications manage their own resources and obtain what they need automatically.
The new environment should save time for application developers, Deasy said.
"We're spending a lot of time and energy thinking about how to help our application developers be even more efficient," he said. "What does the next-generation application development environment look like? What are the tools? What are the ways they're going to develop?"
The bank has 43,000 employees in IT; almost 19,000 are developers.
"If we could get back just one hour a day of productivity per developer, you can see how many years of productivity we could gain back," Deasy said. "Which is why we have a big initiative around what we're calling next-generation software modernization."
Agile development — the process of developing software in quick iterations rather than bigger, longer-term projects — is also part of the picture.
Deasy, a former CIO at General Motors, Tyco and Siemens, wants to make software development run more like a manufacturing plant.
"The more you can automate and take friction out of the system from the time you start writing code to the time you're supporting it in production, our developers can spend more time innovating — which is what they prefer to be doing anyway," he said.
The use of public cloud computing services will help the bank direct its technology investments more wisely, Deasy maintains.
"We aren't looking to decrease the amount of money the firm is spending on technology. We're looking to change the mix between run-the-bank costs versus innovation investment," he said. "We've got to continue to be really aggressive in reducing the run-the bank costs and do it in a very thoughtful way to maintain the existing technology base in the most efficient way possible."
Dollars saved by using lower-cost cloud infrastructure and platforms will be reinvested in technology, he said.
The Fintech Factor
Another reason JPMorgan Chase is so dedicated to cloud computing right now is because it wants to work with fintech startups that can potentially improve customer experience in the bank's digital channels, Deasy said.
"Fintech companies are no longer building their own infrastructure and standing up their own data centers," he said. "They're building their companies directly on the public cloud. If we want to use these young companies in some sort of business process inside the firm, we're going to have to be able to demonstrate to ourselves and to regulators that these applications have the right quality and security."
The same is true for some of the bank's large technology vendors. "One of the reasons we are focused on the public cloud is that we recognize that some of our strategic technology vendors are going to migrate their products and services over time to the cloud. We want to be ready to leverage their future capabilities," said Deasy.
Cloud Concerns
For years, banks have worried about using the public cloud out of security concerns and fears of what their regulators will say. Ever since the 2013 Target data breach, in which hackers stole card information from 40 million customers by breaking into the computers of an air conditioning company Target used, regulators have strongly urged banks to carefully vet and monitor all third parties, with a specific focus on security.
In Deasy's view, public cloud providers (the likes of Amazon, Google, IBM, Microsoft and Oracle) are recognizing the importance of incorporating financial services requirements, including features such as encryption, monitoring, and the ability to know who's really accessing the data.
"We're spending a significant amount of time to ensure that any applications we choose to run on a public cloud will have the same level of security and controls as those run internally," Deasy said.
Deasy said he hasn't tried to set goals for how much work the bank will move to public clouds.
"It doesn't make sense to speculate what percentage of our workloads will be optimal for the public cloud until we actually put workloads out into the cloud," he said. With that said, our modeling says there's a real opportunity."
For now, the bank is continuing to build out its internal private cloud, engaging with public cloud providers, working to develop security controls and refactoring target applications — all efforts that will enable it to use the public cloud.
Regulators have yet to come out with an official stance about banks' use of public clouds. But Deasy's openness about all this suggests JPMorgan's regulators are growing more comfortable with the technology, which presumably would make the path easier for other banks.
"2017 will be a big year for us with respect to the cloud," Deasy said. And perhaps for the industry as well.
Editor at Large Penny Crosman welcomes feedback at
