Excerpts from an interaction with Ruchin Kumar, VP – South Asia, Futurex  

What are payment HSMs and how do they help in securing the fintech industry and payment organizations?

A hardware security module (HSM) performs cryptographic functions like encrypting data and managing encryption keys. Payment HSMs are designed to carry out these functions within the IT environments of payment organizations like banks, card issuers, payment processors, or fintechs. Payment HSMs are usually required to meet strict international compliance requirements. They must be certified with both logical and physical security, making them tamper-responsive (and at least tamper-evident) against even physical intrusion. This helps guarantee the highest level of security in addition to cryptographic functionality.

What are the advantages of cloud payment HSMs over on-premise payment HSM? 

On-premises payment HSMs are great for organizations seeking hands-on control of their critical infrastructure. Cloud payment HSMs, on the other hand, offer the same level of cryptographic security without requiring physical hardware. This makes them fast to deploy. Organizations that deploy cloud HSMs can manage them through a single pane of glass, reducing management overhead while consolidating infrastructure into a central location.

Where does India stand vis a vis other countries in terms of adoption of cloud payment HSMs? What is driving its acceptance in the country? 

India shows fast rates of growth in its payment sector, with some of the largest HSM users being banks and government institutions. In the fintech industry, the cloud-native approach adopted by many organizations makes using payment HSMs in the cloud an ideal fit. Cloud payment HSMs tend to be simple to deploy and manage, yet just as powerful as physical HSMs. Taking Futurex’s VirtuCrypt as an example, the user simply signs up for a cloud payment HSM license, enters information about their applications or APIs to integrate the service, and can then choose which HSM functionality to deploy.

What sectors have taken the lead in embracing Cloud Payment HSM? What more can be done to promote cloud HSMs?

Cloud payment HSM adoption is the highest among organizations in the enterprise banking sector and the fintech sector. Payment service providers especially benefit from the agility and of cloud HSMs, as it gives them the functionality of a complete HSM infrastructure without the need for on-premises equipment.

What are the challenges in the adoption of cloud payment HSMs in the country? What more can be done to address those challenges?

Finding the right cloud HSM provider is key. A cloud HSM provider should maintain a local data center presence within India to boost compliance with data localization policies. They should also offer cloud HSMs that can perform any and every function of their on-premises counterparts.

India’s payment space is evolving. How do you see the cloud payment HSM evolving amidst these changes in the near future?

Current trends seem to indicate a growing preference for cloud payment HSM solutions. As India’s payment sector continues to grow, and as cloud cryptography providers like Futurex expand the cloud offerings on the market, the demand will probably increase over the next few years.

Cloud payment HSMs is relatively a new concept in India. Do you have any suggestions for decision makers looking to secure their systems and processes?

The most important things to consider when choosing a cloud payment HSM provider are scalability, comprehensiveness, and compliance. Ideally, you want a platform that combines all three. Scalability matters in terms of throughput and functionality. Scaling your transactions or signatures per second based on real-time usage is an efficient optimization strategy, while scaling your functionality and enabling new use cases helps you stay agile and anticipate future business requirements. As far as comprehensiveness goes, if you don’t want to worry about migrating your cloud provider as your business needs evolve, then you want to select a cloud platform that can fulfill virtually any cryptographic use case, from encryption to key management to infrastructure management. Being able to license whatever functionality is needed relates back to scalability. And for compliance, a cloud platform should be certified under the highest security requirements, such as the international PCI standard. This ensures that you can get your product to market fast without having to navigate compliance issues on your own.

What are some of the cyber security challenges you foresee with payments moving to the cloud? What measure are you taking to make cloud payment HSMs safe?

One of the biggest perceived challenges when organizations move payments to the cloud is that they will cede control to their cloud service provider and be locked in. In fact, this couldn’t be further from the truth. One of the key advantages to cloud payment HSMs is that the operational expense model (as opposed to the large, up-front capital expenditure required by on-premises HSMs) makes it financially easy to move to other cloud solutions, should the need arise. Moreover, cloud HSM solutions give organizations tremendous flexibility in deciding how they are deployed and managed.