Cybersecurity for Financial Services: Best Practices in 2023

With the critical nature of customer personal information, safeguarding it becomes paramount.

How widespread are cybersecurity crimes? According to Cybersecurity Ventures, the transnational cost of cybercrime is estimated to reach $10.5 trillion by 2025, with financial services being one of the most affected sectors.

The finance industry experiences the highest number of cyber-attacks, accounting for 35% of all attacks, according to IMB X-Force Threat Intelligence Index 2020. In 2020, phishing attacks accounted for 80% of reported cybersecurity incidents in the financial sector, reported PhishLabs.

In this article, I will present best cybersecurity practices that can help finance institutions ensure steady protection for financial services that bolster defenses, tackle emerging threats, and safeguard customer data, fostering trust and providing a sense of security.

1. Implement robust security controls through product security engineering

Product security engineering for finance products refers to the application of specialized security measures and practices in the development, deployment, and maintenance of software or digital solutions. Product security engineers take care of implementing, among others:

• Encryption
• Authentication and authorization mechanisms
• Compliance frameworks
• Vulnerability management processes
• Secure coding practices
• Data sanitization
• And many more

Their goal is to ensure the integrity, confidentiality, and resilience of financial products against potential cyber threats, fraud, and unauthorized access, thereby instilling trust and maintaining the stability of the financial ecosystem.

Increasing importance of product security engineering has led to creation of the Chief Product Security Officer ( the CPSO) role. The emergence of this role is a response to the digital transformation trends that have exposed businesses' products to cyber threats. Similar to how the CIO role led to the creation of the CISO function, the CPSO position is now dedicated to addressing the security of products and mitigating the risks associated with them.

The companies in finance sector should consider hiring CPSO a role that combines engineering training and a knowledge of product cybersecurity, threat modeling, secure coding and security risk management as well as research because the person would be responsible for:

• Overseeing cybersecurity of a company’s digital products
• Implementing a product security program designed to address cybersecurity across all stages of the product life cycle
• Raising awareness and educating product stakeholders about building secure products

Risk assessment

This involves the systematic evaluation and analysis of potential threats and vulnerabilities that may impact the security of a financial product or service as well as customer data, and financial assets.

Risk assessment allows businesses to prioritize mitigation and make it aligned with the development process to reduce the slowdowns caused by implementation of security controls. So, security is no longer a blocker for business.

The process typically focuses on conducting thorough assessments of the product's architecture, codebase, access controls, data storage, encryption mechanisms, and third-party integrations to ensure a comprehensive understanding of potential security risks and develop targeted risk mitigation plans.

A risk assessment should include the following steps:

• Identification of threats
• Assessment of the risks
• Control and/or mitigation of every risks
• Documentation of the findings
• Plan/implement strategy based on risk constructed priorities

Threat modeling for the product

A threat model is a systematic and organized depiction of the information that influences the security of an application, providing a security-focused perspective on the application and its surrounding environment. It can be employed across various domains such as software, systems, networks, distributed systems, Internet of Things (IoT) devices, and business processes.

It can accelerate release time of the new products, helps the institutions to remain secure and meet business targets, fosters regulatory compliance, among others.

It is valuable to narrow down the search space and focus on specific threats that require attention.

• Evaluate scope: Determine the scope of the project, whether it is a small sprint or an entire system.
• Identify potential risks: Use techniques such as brainstorming or structured approaches like STRIDE, Kill Chains, or Attack Trees to identify possible risks.
• Develop countermeasures or risk management strategies: Decide on the appropriate actions to address each threat, whether it involves implementing mitigations or utilizing risk management approaches such as acceptance, transfer, or elimination.
• Review and assess: Evaluate the adequacy of your efforts for the specific system at hand and determine if further improvements or adjustments are necessary.

Secure-by-design

Security by design is a fundamental method for constructing secure digital products. It entails incorporating security into the design and development of a product or system right from the start, rather than treating it as an add-on. This approach recognizes security as a primary concern throughout the software development lifecycle, spanning from initial planning to ultimate deployment. Some best practices of security by design in the finance sector comprise:

Regular security testing

Security testing plays a crucial role in identifying potential vulnerabilities and threats in digital products. It encompasses regular activities such as penetration testing, vulnerability scanning, and code reviews.

Secure coding

Secure coding practices are essential to ensure that the code is free from vulnerabilities and weaknesses. This involves using secure coding standards, frameworks, and libraries to reduce the risk of security breaches.

Incident response planning

It involves identifying potential security incidents and developing a plan to respond to them quickly and effectively. This includes developing a communication plan, identifying critical systems and data, and having a team ready to respond to any incidents.

2. Detect anomalies with monitoring

Detecting security anomalies in finance products is an essential aspect of maintaining the security of financial systems and data. Anomaly detection involves identifying deviations from normal patterns of behavior or activity that may indicate a security breach or threat.

There are several ways in which security anomalies can be detected in finance products. Firstly, monitoring user activity involves analyzing user behavior, such as login times, access patterns, and transactional activity, to identify any unusual or suspicious activity.

Secondly, machine learning techniques can be used to detect security anomalies in finance products by analyzing large volumes of data and identifying patterns that may indicate a security breach or threat.

Furthermore, network monitoring involves analyzing network traffic to identify any unusual or suspicious activity that may indicate a security breach or threat. Equally important, analyzing system logs can help detect security anomalies by identifying patterns of activity that may indicate a security breach or threat.

3. Introduce compliance & regulations

Compliance and regulations help to ensure that financial institutions adhere to a set of security standards and best practices to protect their systems and data from cyber threats. This leads to establishing a framework for data protection and privacy.

Regulations such as PSD2, NIS2, the upcoming DORA, General Data Protection Regulation (GDPR) and the Payment Card Industry Data Security Standard (PCI DSS) provide guidelines and requirements for financial institutions to follow to protect sensitive data.

Financial institutions are obligated by compliance and regulations to recognize potential security risks and vulnerabilities and implement measures to reduce their impact. The organizations are also subject to regular audits and inspections to ensure compliance with regulations and standards.

Have “Know Your Customer” process

KYC is a process through which financial institutions verify the identity of their customers and evaluate the potential risks associated with conducting business with them. This process aims to prevent fraud, money laundering, and other financial crimes.

When implementing a KYC process for finance companies, it is important to adhere to several best practices:

• Collect relevant customer information
• Verify customer identities
• Assess customer risk
• Monitor customer activity
• Maintain records

4. Verify your dependencies and suppliers to protect against supply chain attacks

You might create the best cybersecurity strategy for your organization but without your suppliers being secure and safe you are still exposed to threat and risks. It is therefore crucial for suppliers to prioritize the development of robust security measures while acknowledging the interconnected nature of their infrastructure and reliance on external systems.

These attacks occur when an attacker targets a third-party vendor or supplier within the supply chain to gain unauthorized access to the systems or data of the finance service provider. Attackers may exploit vulnerabilities in the vendor's software, hardware, or processes, or they compromise the vendor's systems to deliver malicious payloads to the finance organizations.

How to mitigate and protect a company's interests against attacks?

• Assess vendor security posture: This may include reviewing their security certifications, conducting audits, and requesting documentation regarding their security measures.
• Create compliance requirements: Many regulatory frameworks, such as the Payment Card Industry Data Security Standard (PCI DSS) and the General Data Protection Regulation (GDPR), emphasize the need for supply chain security and due diligence.
• Establish contractual agreements: These contracts should clearly define the security controls expected from suppliers, incident response procedures, and mechanisms for regular security audits and assessments.
• Collaborate with suppliers on security measures: A collaborative relationship with suppliers and the understanding of the shared responsibility of maintaining a secure supply chain are always desired.
• Foster industry collaboration: Engage in industry forums and information-sharing platforms to exchange knowledge and best practices with peers and industry experts. Collaborative efforts can help identify and address common supply chain vulnerabilities effectively.

5. Implement Zero Trust Architecture for your internal/corporate tools

Zero Trust Architecture (ZTA) is a cybersecurity model that assumes all users, devices, and applications are potential security risks and emphasizes the need for strict access controls and monitoring, and requires a level of verification for all users and devices attempting to access corporate tools and resources.

Implementing this approach is essential due to its direct relevance to contemporary cybersecurity threats and the operational characteristics of modern IT infrastructures. These infrastructures encompass cloud computing, remote work setups, SaaS tools, distributed systems, and the inherent complexity and heterogeneity of IT environments.

Here are some key steps to implementing ZTA for internal/corporate tools:

1. Identify and categorize resources: This includes data, applications, and devices.
2. Establish access policies: This includes access controls based on user identity, device type, and location and other context based access parameters.
3. Implement multi-factor authentication: MFA involves using two or more forms of authentication to verify the identity of the user or device.It should be implemented for all users and devices attempting to access corporate tools.
4. Monitor activity: All activity should be monitored and logged, including user and device activity, network traffic, and system logs.
5. Continuously assess and update: This includes regular vulnerability assessments, penetration testing, and security audits.

6. Backups to protect against outages caused by ransomware or wipers

Backups are essentially copies of important data that are stored in a separate location from the primary system.

According to IBM Security X-Force Threat Intelligence Index 2023, ransomware was the second most common action on objective, following closely behind backdoor deployments and continuing to disrupt organizations’ operations. Ransomware’s share of incidents declined from 21% in 2021 to 17% in 2022.

In the event of a cyberattack or other disaster, the backups can be used to restore the system to a previous state, minimizing downtime and preventing data loss.

There are a few useful practices to keep in mind:

• Regularly schedule backups: That's daily, weekly, or monthly. This ensures that data is backed up on a consistent basis and that there are multiple restore points available if needed.
• Store backups offsite: This could be a physical location (such as a secure data center or backup tape storage facility) or a cloud-based service to protect against physical disasters that could impact both the primary system and its backups.
• Test backups regularly: It's important to test backups on a regular basis to ensure that they are working correctly and that the restored data is accurate.
• Use encryption: This is particularly important if backups are stored offsite, as they may be more vulnerable to attack during transit or while being stored.
• Have a disaster recovery plan: The plan should include defined Recovery Time Objective (RTO) and Recovery Point Objective (RPO) targets, clear responsibilities for different team members, among others.

7. Implement access controls

a. Use strong authentication mechanisms

These mechanisms are designed to protect sensitive financial information, prevent unauthorized access, and minimize the risk of fraud. Here are some common strong authentication mechanisms used in finance services:

• Multi-factor authentication (MFA): By requiring multiple factors, MFA adds an extra layer of security beyond just a password.
• Biometric authentication: This can include fingerprints, facial recognition, voice recognition, or iris scans. Biometrics provide a highly secure authentication method as they are difficult to forge or replicate.
• One-time Passwords (OTPs): These are temporary codes generated for a single login session or transaction. These passwords are typically sent to the user's mobile device through SMS or generated by an authentication app.
• Hardware tokens: These are physical devices that generate time-based or event-based OTPs. These tokens can be key fobs or smart cards that the user possesses and uses to authenticate themselves.
• Digital certificates: They use public-key cryptography to authenticate and verify the identity of users or devices. They are issued by trusted third-party certificate authorities (CAs) and contain information about the entity's identity and a digital signature.
• Smart cards: Plastic cards embedded with a microchip that can store and process data securely. They often require a PIN or biometric authentication to access the data stored on the card. Smart cards are commonly used in banking for secure login, digital signatures, and storing encrypted keys.
• Risk-based authentication: It analyzes various factors such as user behavior, location, device information, and transaction patterns to assess the risk level of a login attempt or transaction. If the system detects suspicious activity, it may prompt for additional authentication steps or even deny access.
  

  b. Enforce strict access management policies

The policies outline the rules, procedures, and protocols that govern how access to systems, applications, and data is granted and managed. Here are some key considerations for implementing strict access management policies in finance services:

• Principle of least privilege: Apply the principle of least privilege, which means granting users the minimum level of access required to perform their job functions.
• Role-based access control (RBAC): Implement RBAC to define access rights based on job roles or responsibilities. This ensures that users only have access to the resources and data necessary for their specific roles.
• User provisioning and de-provisioning: New employees should receive access only to the systems and data relevant to their job roles, and access should be revoked promptly when an employee leaves the organization or changes roles.
• Access request and approval process: This process should include appropriate levels of review and authorization to ensure that access requests align with job roles and business needs.
• Regular access reviews: These reviews help maintain the principle of least privilege and ensure that access rights are aligned with the current requirements.
• Incident response plan: This plan should outline the steps to be taken in the event of unauthorized access, compromised credentials, or suspicious activities to minimize the impact and mitigate further risks.

Protect sensitive data of your customers by implementing cybersecurity best practices

Cybersecurity is an ongoing process that requires constant vigilance and adaptation. It is crucial for finance institutions to invest in robust cybersecurity infrastructure, regularly update their systems, and collaborate with industry peers to share threat intelligence and best practices. Ultimately, these efforts will not only safeguard the industry but also contribute to building a resilient and trustworthy financial ecosystem for all stakeholders.