BFSI : Safety Compromised

Over the last decade or so, the Indian banking and financial sector has seen
several transformations. The operating environment of banks has changed
significantly in terms of liberalization of regulations, increasing competition
from both domestic and foreign players and need to revamp the business, which
came with the legacies of the protected era. Simultaneously, implementation of
information technology began in right earnest in the sector. Starting from back
office automation, which was aimed largely at processing of voluminous data and
automation of cheque clearing operations; the adoption of IT moved to the front
desk in the form of total branch automation. Further, while competition gets
tougher, there is now a constant pressure on IT departments to achieve more
within tighter budgets. However, while the adoption of technology has brought
several benefits to the financial institutions, various threats in terms of
malicious software, unscrupulous insider and external fraudsters, natural and
man-made disasters are real. Lets take a look at some of the top information
security challenges faced by the banking and financial segment.

• Business threat related to i-Banking: To remain competitive in the
  industry, where all banks are putting efforts to ensure easy access and
  transaction process for their end customers, the associated security threats
  and challenges mount higher. Transmitting data across the Internet link,
  through secured and unsecured channel is always a challenge. With increased
  convenience of online banking, the threat of unscrupulous elements getting
  into the networks and perpetrating frauds looms large. In this context, the
  security governance, security policy and its implementation and the
  well-tested and reliable business continuity measures assume importance. As
  any system cannot be perfect, its audit and expeditious action on the findings
  become crucial to continuous enhancement of security systems in the face of
  ever-growing sophistication of potential attackers. The bank has to ensure and
  safeguard not only its information database but also customers critical
  investments from malicious intender on the Internet. The requirement of
  encryption solution, digital certificate, secured connectivity for mobile
  users and customers, secured hosting environment have become extremely
  critical for all BFSI organizations.

• Managing and correlating threats across the enterprise network to
  contain risks: Event correlation is the key to properly identify the true
  threats an organization is facing. Threat correlation ensures that risk
  management teams are always focused on the top most priority, simultaneously
  reducing potential risk and corporate liabilities. A good correlation solution
  has the power and scalability to collect, normalize, consolidate and correlate
  events from the largest organizations, enriching data with extensible threat
  taxonomies, knowledge-base links and both user-defined and automated responses
  to threats. Recent security regulations for the BFSI segment have escalated
  the demand for threat correlation.
• Near real-time mitigation of phishing: A recent report by
  Cyveillance stated that number of phishing attacks grew by 50% in the first
  two months of 2007 from 800 to 1200. Further, another report by University of
  Indiana School of Informatics showed that an average of 8 to 14% of
  respondents to a phishing email go ahead and click on it. To safeguard
  themselves from potential risk, financial institutions need to get this number
  down.
  

  An Eye on the Phish

  Some recommended strategies to mitigate phishing risks Deploy transactional authentication software Transaction authentication software applies numerous other factors that include the computer hardware, IP address, geo-location, time of day, user history, display settings, browser plug-ins to examine and approve each transaction. If the software finds any discrepancies then it escalates to management or begins to ask questions. Deploy software which quickly shuts down phishing sites Enterprises should use service providers that screens the Internet 24 hours a day looking for phishing sites that may target you. In some cases they can prevent an attack from taking place while in others they can quickly respond and block the website. Educate the consumers A concerted education campaign is needed by the financial institutions. It must describe the threats and appropriate counter measures over and over to the consumer such that they absorb and adopt. Deploy stronger authentication selectively Stronger authentication should only be used for higher risk individuals in higher risk situations. This will help to mitigate the risk of common keyboard logger attacks but wont stop in the middle attacks. Consider usage of things like confirming cell phone calls, digital signatures and SMS messages to help mitigate your enterprise risk. One time passwords are also useful but are more expensive to manage.

• User provisioning and identity management: User provisioning and
  identity management systems allow financial institutions to know who is
  accessing what and provide a suitable user experience by restricting or
  controlling access accordingly. In light of the increased cases of hacking and
  unauthorized access, enterprises are adopting automated policy enforcement
  that helps maintain optimum security levels while managing large number of
  users. Integrating digital IDs with provisioning systems can further help to
  lower total cost of ownership and maintain consistent security policy across
  users, applications and environments.
• Managing privacy and confidentiality of user data: Customer related
  and transaction data forms the backbone of banking services; more so in the
  current scenario where banking is becoming virtual and transactions are
  becoming electronic. To fight the increasing competition, it is becoming
  critical for banks to maintain the privacy and confidentiality of user data.
  Data Leakage prevention solutions and encryption solutions for mobile assets
  are being increasing adopted by BFSI organizations to keep this date
  confidential and inaccessible from improper hands
• Regulatory compliance: Globally, there are a staggering 16,000
  regulations that businesses need to comply with, including significant
  legislation such as IT Act, SEBI Clause 49, Sarbanes-Oxley, HIPAA and
  BASELII. According to an IDC Survey, the worldwide information management for
  compliance market will cross the $20 bn mark in 2009 growing at a compound
  annual growth rate of 22% through the 2005-2009 forecast period.

With the help of Security Service providers, financial enterprises can adopt
inexpensive and unified approach to compliance management which also reduces the
cost, time, effort and complexity involved in adhering to multiple regulations.

• Increased risk from internal network: Most of the networks of BFSI
  organizations in India are increasing their geographical spread in order to
  meet business directives. This is exposing them to loss of administrative
  controls over internal users. Financial organizations are countering these
  threats by working with various zero-day prevention technologies like
  signature less behavior based protection solution and network access solutions
  for granting access to the network, only for valid, authenticated and known
  users.
• Need for end point security: Due to the faster spread of the BFSI
  branches in an effort to reach maximum market penetration, banks are now
  facing new challenges in ensuring maximum security from the various end
  points. Business demands nowadays, interaction from a dynamic environment
  beyond the banks internal network, which imposes various threats. End point
  security solutions help banks to ensure compliance to implementation of
  certain pre-defined security controls on all the end point accesses. Further,
  preventing data loss, desktop firewall, desktop HIDS, Network Access Controls
  (NAC), patch management solution, anti virus solutions help banks in ensuring
  the compliance have a secured and wider network.

Managed Security Services has emerged as an important discipline to address
the above challenges, through integration of people, process and technology.
Each of these three components should be managed considering the capabilities
and limitations of others. When the components are considered as a whole, they
should provide for adequate overall risk mitigation.

Prosenjeet Banerjee

The author is associate vice president, global security services, HCL
Technologies

maildqindia@cybermedia.co.in