Protecting Sensitive Data

Protecting financial institutions and customers from critical cyberattacks

Digital banking has become commonplace across the world, with the number of people using these services projected to reach 3.6 billion by 2024. Ensuring the protection of systems and sensitive data can be a complex task for banks and other organizations to manage, as they are unable to directly implement security measures onto a customer’s personal device. Instead, they must rely on the general cybersecurity ecosystem, and the institutions establishing trusted computing within it.

The Digitization of Banking
The COVID-19 crisis has had a lasting effect on consumer banking behavior. With the temporary closure of around 8,500 branches in the UK alone, the pandemic compelled banks and their customers to use digital tools and processes instead of traditional banking services.

The rapid digital transformation of these services proved to be the most pertinent banking trend of 2022 and fueled a massive increase in the number of connected devices and suppliers linking to customer’s bank accounts.

With the growth of this digital supply chain comes an increased number of significant threats. These can prove ruinous to organizations if the key cybersecurity elements involved within the ecosystem are not held to well-established, internationally recognized standards of trust.

In June 2022, it was reported that one of the largest financial institutions in the United States, Flagstar Bank, suffered a major data breach which resulted in almost 1.5 million customers having their sensitive information leaked. This included their social security numbers, banking information and personal details, such as their names, addresses, and birthdays.

To avoid similar incidents, such as the 2013 attack against Target, financial institutions and organizations in other industries. They must be able to rely on the readily available standards and specifications designed to protect personal devices, and by extension, the banking applications found on them.

Threats to the Supply Chain
Often organizations are good at protecting “the front door,” with systems and protocols in place to protect their own servers against direct attacks. However, these become effectively useless if customer devices that link to financial services are not up to the same standards. Threats against personal devices are just as dangerous to financial institutions as they are to the user, as a successful exploit can quickly enable attackers to gain access to banking networks through the applications found on a device.

Attackers no longer hack devices simply as a hobby. Malicious organizations now exploit vulnerabilities as a service, and they will often target supply chains with malware and ransomware attacks with the aim of stealing valuable data. Devices can be breached through a compromised third-party vendor anywhere in a network, with malicious parties using the organization to circumvent security controls and create avenues to sensitive resources.

This is made possible by entities within the chain who simply do not take cybersecurity as seriously as others. To successfully mitigate any vulnerabilities, each phase of a product’s lifecycle – whether design, manufacturing, transport, utilization, or decommission – need assessing to uncover any significant risks.

Unfortunately, this is not easily achieved, with no single entity having complete control of a supply chain. Organizations must work together to ensure that security standards for the industry are correctly defined, implemented, and adhere to up-to-date security guidance measures.

Third-party risk assessments on a regular basis – especially when there are changes to a bank’s digital infrastructure – can ensure the cybersecurity measures of any vendor are aligned with those leveraged by financial institutions.

The Necessity for Up-to-date Specifications
Organizations like the Trusted Computing Group (TCG) are dedicated to developing standards and specifications that make cyber resilience accessible to the average user and provide assurance to organizations that their systems are protected, whether in finance or any other industry. The ongoing work developed by standards organizations helps create strong frameworks by which devices within a supply chain must demonstrate compliance to, which offers additional protection against cyber threats.

The Cyber Resilient Technology (CyRes) specification developed by the TCG, entitled Cyber Resilient Module and Building Block Requirements is an example of a crucial standard making a difference within the technology ecosystem. This specification was created to ensure the implementation of cyber resilient architecture in the first stages of a product’s design process, rather than it being considered an afterthought.

The goal is to sufficiently equip all devices with the necessary components to protect, detect, and attest – bolstering the security of the supply chain.

This, paired with a hardware Root of Trust (RoT) like the Trusted Computing Module (TPM), makes cyber resiliency accessible to the average user and provides assurance to financial organizations that their systems are protected.

Securing the Ecosystem
The financial sector remains a major target for malicious cyber-attacks, facing the second-largest number of known security breaches in 2022. Banks differ from many other large organizations in that they must heavily rely on the security of their customers’ devices.

They must trust that the overall security ecosystem is secure enough to prevent or mitigate any damage caused by cyber-attacks. Stringent security measures and software must be made readily available and common within devices to ensure banks and other organizations are adequately covered against threats. The standards and specifications from bodies such as TCG are necessary to protect against malicious activity, and establish trusted computing not only for individual devices, but for the supply chain as well.

This article originally appeared in the May / June 2023 issue of Security Today.

Featured

  • Pragmatism, Productivity, and the Push for Accountability in 2025-2026

    Every year, the security industry debates whether artificial intelligence is a disruption, an enabler, or a distraction. By 2025, that conversation matured, where AI became a working dimension in physical identity and access management (PIAM) programs. Observations from 2025 highlight this turning point in AI’s role in access control and define how security leaders are being distinguished based on how they apply it. Read Now

  • Report: Cyber Attackers Continue to Turn to AI-Based Tools to Avoid Detection

    Comcast Business recently released its 2025 Cybersecurity Threat Report, a comprehensive analysis of 34.6 billion cybersecurity events detected between June 1,2024 and May 31, 2025. Now in its third year, the report offers business leaders a unique perspective into the evolving threat landscape and provides actionable insights to help organizations strengthen their defenses and align cybersecurity with business risk. Read Now

  • Axis Communications Creates AI-powered Video Surveillance Orchestra

    What if cameras could not only see the world, but interpret it—and respond like orchestra musicians reading sheet music: instantly, precisely, and in perfect harmony? That’s what global network technology leader Axis Communications set to find out. Read Now

  • Just as Expected

    GSX produced a wonderful tradeshow earlier this week. Monday was surprisingly strong in the morning, and the afternoon wasn’t bad at all. That’s Monday’s results and asking attendees to travel on Sunday. Just a quick hint, no one wants to give up their weekend to travel and set up an exhibit booth. I’m just saying. Read Now

    • Industry Events
    • GSX
  • NOLA: The Crescent City

    Twenty years later we finds ourselves in New Orleans. Twenty years ago the aftermath of Hurricane Katrina forced exhibitors and attendees to look elsewhere for tradeshow floor space. Read Now

    • Industry Events
    • GSX

New Products

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening.

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols.

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.