Protecting Sensitive Data

Protecting financial institutions and customers from critical cyberattacks

Digital banking has become commonplace across the world, with the number of people using these services projected to reach 3.6 billion by 2024. Ensuring the protection of systems and sensitive data can be a complex task for banks and other organizations to manage, as they are unable to directly implement security measures onto a customer’s personal device. Instead, they must rely on the general cybersecurity ecosystem, and the institutions establishing trusted computing within it.

The Digitization of Banking
The COVID-19 crisis has had a lasting effect on consumer banking behavior. With the temporary closure of around 8,500 branches in the UK alone, the pandemic compelled banks and their customers to use digital tools and processes instead of traditional banking services.

The rapid digital transformation of these services proved to be the most pertinent banking trend of 2022 and fueled a massive increase in the number of connected devices and suppliers linking to customer’s bank accounts.

With the growth of this digital supply chain comes an increased number of significant threats. These can prove ruinous to organizations if the key cybersecurity elements involved within the ecosystem are not held to well-established, internationally recognized standards of trust.

In June 2022, it was reported that one of the largest financial institutions in the United States, Flagstar Bank, suffered a major data breach which resulted in almost 1.5 million customers having their sensitive information leaked. This included their social security numbers, banking information and personal details, such as their names, addresses, and birthdays.

To avoid similar incidents, such as the 2013 attack against Target, financial institutions and organizations in other industries. They must be able to rely on the readily available standards and specifications designed to protect personal devices, and by extension, the banking applications found on them.

Threats to the Supply Chain
Often organizations are good at protecting “the front door,” with systems and protocols in place to protect their own servers against direct attacks. However, these become effectively useless if customer devices that link to financial services are not up to the same standards. Threats against personal devices are just as dangerous to financial institutions as they are to the user, as a successful exploit can quickly enable attackers to gain access to banking networks through the applications found on a device.

Attackers no longer hack devices simply as a hobby. Malicious organizations now exploit vulnerabilities as a service, and they will often target supply chains with malware and ransomware attacks with the aim of stealing valuable data. Devices can be breached through a compromised third-party vendor anywhere in a network, with malicious parties using the organization to circumvent security controls and create avenues to sensitive resources.

This is made possible by entities within the chain who simply do not take cybersecurity as seriously as others. To successfully mitigate any vulnerabilities, each phase of a product’s lifecycle – whether design, manufacturing, transport, utilization, or decommission – need assessing to uncover any significant risks.

Unfortunately, this is not easily achieved, with no single entity having complete control of a supply chain. Organizations must work together to ensure that security standards for the industry are correctly defined, implemented, and adhere to up-to-date security guidance measures.

Third-party risk assessments on a regular basis – especially when there are changes to a bank’s digital infrastructure – can ensure the cybersecurity measures of any vendor are aligned with those leveraged by financial institutions.

The Necessity for Up-to-date Specifications
Organizations like the Trusted Computing Group (TCG) are dedicated to developing standards and specifications that make cyber resilience accessible to the average user and provide assurance to organizations that their systems are protected, whether in finance or any other industry. The ongoing work developed by standards organizations helps create strong frameworks by which devices within a supply chain must demonstrate compliance to, which offers additional protection against cyber threats.

The Cyber Resilient Technology (CyRes) specification developed by the TCG, entitled Cyber Resilient Module and Building Block Requirements is an example of a crucial standard making a difference within the technology ecosystem. This specification was created to ensure the implementation of cyber resilient architecture in the first stages of a product’s design process, rather than it being considered an afterthought.

The goal is to sufficiently equip all devices with the necessary components to protect, detect, and attest – bolstering the security of the supply chain.

This, paired with a hardware Root of Trust (RoT) like the Trusted Computing Module (TPM), makes cyber resiliency accessible to the average user and provides assurance to financial organizations that their systems are protected.

Securing the Ecosystem
The financial sector remains a major target for malicious cyber-attacks, facing the second-largest number of known security breaches in 2022. Banks differ from many other large organizations in that they must heavily rely on the security of their customers’ devices.

They must trust that the overall security ecosystem is secure enough to prevent or mitigate any damage caused by cyber-attacks. Stringent security measures and software must be made readily available and common within devices to ensure banks and other organizations are adequately covered against threats. The standards and specifications from bodies such as TCG are necessary to protect against malicious activity, and establish trusted computing not only for individual devices, but for the supply chain as well.

This article originally appeared in the May / June 2023 issue of Security Today.

Featured

  • Maximizing Your Security Budget This Year

    The Importance of Proactive Security Measures: 4 Stories of Regret

    We all want to believe that crime won’t happen to us. So, some business owners hope for the best and put proactive security measures on the back burner, because other things like growth, attracting new customers, and meeting deadlines all seem more pressing. Read Now

  • Securing the Flow of Operations

    The transportation industry is a complex and dynamic environment where efficient management of physical keys, vehicles and shared devices is critical to ensuring smooth operations, reducing costs and maintaining security. Every day, more transportation facilities are using modern electronic key and asset management systems to better secure, audit and manage the important assets that keep operations running smoothly. Read Now

  • Today's Enterprise

    Protecting servers and data has evolved rapidly over the past 15-plus years. Early on, concerns centered around the environmental conditions of where servers were housed within a building and the effects of humidity, temperature and air quality on their performance. This led to a better understanding of the need for a controlled environment to maximize equipment lifespan and capacity. It was also a driving force behind consolidating servers in a common space, i.e., the data center. Read Now

  • Study Proves It: Security Awareness Training Reduces Phishing Attacks

    Attackers are increasingly targeting human-based vulnerabilities to infiltrate organizations. Humans have direct access to insider systems and data – any threat actor can easily phish users, steal their credentials and secure keys to the kingdom without having to fight advanced cybersecurity defenses. Studies show social engineering attacks and human errors are behind 68% of all breaches.  Read Now

Featured Cybersecurity

Webinars

New Products

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation. 3

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation. 3

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.” 3