Protecting Sensitive Data

Protecting financial institutions and customers from critical cyberattacks

Digital banking has become commonplace across the world, with the number of people using these services projected to reach 3.6 billion by 2024. Ensuring the protection of systems and sensitive data can be a complex task for banks and other organizations to manage, as they are unable to directly implement security measures onto a customer’s personal device. Instead, they must rely on the general cybersecurity ecosystem, and the institutions establishing trusted computing within it.

The Digitization of Banking
The COVID-19 crisis has had a lasting effect on consumer banking behavior. With the temporary closure of around 8,500 branches in the UK alone, the pandemic compelled banks and their customers to use digital tools and processes instead of traditional banking services.

The rapid digital transformation of these services proved to be the most pertinent banking trend of 2022 and fueled a massive increase in the number of connected devices and suppliers linking to customer’s bank accounts.

With the growth of this digital supply chain comes an increased number of significant threats. These can prove ruinous to organizations if the key cybersecurity elements involved within the ecosystem are not held to well-established, internationally recognized standards of trust.

In June 2022, it was reported that one of the largest financial institutions in the United States, Flagstar Bank, suffered a major data breach which resulted in almost 1.5 million customers having their sensitive information leaked. This included their social security numbers, banking information and personal details, such as their names, addresses, and birthdays.

To avoid similar incidents, such as the 2013 attack against Target, financial institutions and organizations in other industries. They must be able to rely on the readily available standards and specifications designed to protect personal devices, and by extension, the banking applications found on them.

Threats to the Supply Chain
Often organizations are good at protecting “the front door,” with systems and protocols in place to protect their own servers against direct attacks. However, these become effectively useless if customer devices that link to financial services are not up to the same standards. Threats against personal devices are just as dangerous to financial institutions as they are to the user, as a successful exploit can quickly enable attackers to gain access to banking networks through the applications found on a device.

Attackers no longer hack devices simply as a hobby. Malicious organizations now exploit vulnerabilities as a service, and they will often target supply chains with malware and ransomware attacks with the aim of stealing valuable data. Devices can be breached through a compromised third-party vendor anywhere in a network, with malicious parties using the organization to circumvent security controls and create avenues to sensitive resources.

This is made possible by entities within the chain who simply do not take cybersecurity as seriously as others. To successfully mitigate any vulnerabilities, each phase of a product’s lifecycle – whether design, manufacturing, transport, utilization, or decommission – need assessing to uncover any significant risks.

Unfortunately, this is not easily achieved, with no single entity having complete control of a supply chain. Organizations must work together to ensure that security standards for the industry are correctly defined, implemented, and adhere to up-to-date security guidance measures.

Third-party risk assessments on a regular basis – especially when there are changes to a bank’s digital infrastructure – can ensure the cybersecurity measures of any vendor are aligned with those leveraged by financial institutions.

The Necessity for Up-to-date Specifications
Organizations like the Trusted Computing Group (TCG) are dedicated to developing standards and specifications that make cyber resilience accessible to the average user and provide assurance to organizations that their systems are protected, whether in finance or any other industry. The ongoing work developed by standards organizations helps create strong frameworks by which devices within a supply chain must demonstrate compliance to, which offers additional protection against cyber threats.

The Cyber Resilient Technology (CyRes) specification developed by the TCG, entitled Cyber Resilient Module and Building Block Requirements is an example of a crucial standard making a difference within the technology ecosystem. This specification was created to ensure the implementation of cyber resilient architecture in the first stages of a product’s design process, rather than it being considered an afterthought.

The goal is to sufficiently equip all devices with the necessary components to protect, detect, and attest – bolstering the security of the supply chain.

This, paired with a hardware Root of Trust (RoT) like the Trusted Computing Module (TPM), makes cyber resiliency accessible to the average user and provides assurance to financial organizations that their systems are protected.

Securing the Ecosystem
The financial sector remains a major target for malicious cyber-attacks, facing the second-largest number of known security breaches in 2022. Banks differ from many other large organizations in that they must heavily rely on the security of their customers’ devices.

They must trust that the overall security ecosystem is secure enough to prevent or mitigate any damage caused by cyber-attacks. Stringent security measures and software must be made readily available and common within devices to ensure banks and other organizations are adequately covered against threats. The standards and specifications from bodies such as TCG are necessary to protect against malicious activity, and establish trusted computing not only for individual devices, but for the supply chain as well.

This article originally appeared in the May / June 2023 issue of Security Today.

Featured

  • 12 Commercial Crime Sites to Do Your Research

    12 Commercial Crime Sites to Do Your Research

    Understanding crime statistics in your industry and area is crucial for making important decisions about your security budget. With so much information out there, how can you know which statistics to trust? Read Now

  • Boosting Safety and Efficiency

    Boosting Safety and Efficiency

    In alignment with the state of Mississippi’s mission of “Empowering Mississippi citizens to stay connected and engaged with their government,” Salient's CompleteView VMS is being installed throughout more than 150 state boards, commissions and agencies in order to ensure safety for thousands of constituents who access state services daily. Read Now

  • Live From GSX: Post-Show Review

    Live From GSX: Post-Show Review

    This year’s Live From GSX program was a rousing success! Again, we’d like to thank our partners, and IPVideo, for working with us and letting us broadcast their solutions to the industry. You can follow our Live From GSX 2023 page to keep up with post-show developments and announcements. And if you’re interested in working with us in 2024, please don’t hesitate to ask about our Live From programs for ISC West in March or next year’s GSX. Read Now

    • Industry Events
    • GSX
  • People Say the Funniest Things

    People Say the Funniest Things

    By all accounts, GSX version 2023 was completely successful. Apparently, there were plenty of mix-ups with the airlines and getting aircraft from the East Coast into Big D. I am all ears when I am in a gathering of people. You never know when a nugget of information might flip out. Read Now

    • Industry Events
    • GSX

Featured Cybersecurity

Webinars

New Products

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation. 3

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure. 3