Protecting Sensitive Data

Protecting financial institutions and customers from critical cyberattacks

Digital banking has become commonplace across the world, with the number of people using these services projected to reach 3.6 billion by 2024. Ensuring the protection of systems and sensitive data can be a complex task for banks and other organizations to manage, as they are unable to directly implement security measures onto a customer’s personal device. Instead, they must rely on the general cybersecurity ecosystem, and the institutions establishing trusted computing within it.

The Digitization of Banking
The COVID-19 crisis has had a lasting effect on consumer banking behavior. With the temporary closure of around 8,500 branches in the UK alone, the pandemic compelled banks and their customers to use digital tools and processes instead of traditional banking services.

The rapid digital transformation of these services proved to be the most pertinent banking trend of 2022 and fueled a massive increase in the number of connected devices and suppliers linking to customer’s bank accounts.

With the growth of this digital supply chain comes an increased number of significant threats. These can prove ruinous to organizations if the key cybersecurity elements involved within the ecosystem are not held to well-established, internationally recognized standards of trust.

In June 2022, it was reported that one of the largest financial institutions in the United States, Flagstar Bank, suffered a major data breach which resulted in almost 1.5 million customers having their sensitive information leaked. This included their social security numbers, banking information and personal details, such as their names, addresses, and birthdays.

To avoid similar incidents, such as the 2013 attack against Target, financial institutions and organizations in other industries. They must be able to rely on the readily available standards and specifications designed to protect personal devices, and by extension, the banking applications found on them.

Threats to the Supply Chain
Often organizations are good at protecting “the front door,” with systems and protocols in place to protect their own servers against direct attacks. However, these become effectively useless if customer devices that link to financial services are not up to the same standards. Threats against personal devices are just as dangerous to financial institutions as they are to the user, as a successful exploit can quickly enable attackers to gain access to banking networks through the applications found on a device.

Attackers no longer hack devices simply as a hobby. Malicious organizations now exploit vulnerabilities as a service, and they will often target supply chains with malware and ransomware attacks with the aim of stealing valuable data. Devices can be breached through a compromised third-party vendor anywhere in a network, with malicious parties using the organization to circumvent security controls and create avenues to sensitive resources.

This is made possible by entities within the chain who simply do not take cybersecurity as seriously as others. To successfully mitigate any vulnerabilities, each phase of a product’s lifecycle – whether design, manufacturing, transport, utilization, or decommission – need assessing to uncover any significant risks.

Unfortunately, this is not easily achieved, with no single entity having complete control of a supply chain. Organizations must work together to ensure that security standards for the industry are correctly defined, implemented, and adhere to up-to-date security guidance measures.

Third-party risk assessments on a regular basis – especially when there are changes to a bank’s digital infrastructure – can ensure the cybersecurity measures of any vendor are aligned with those leveraged by financial institutions.

The Necessity for Up-to-date Specifications
Organizations like the Trusted Computing Group (TCG) are dedicated to developing standards and specifications that make cyber resilience accessible to the average user and provide assurance to organizations that their systems are protected, whether in finance or any other industry. The ongoing work developed by standards organizations helps create strong frameworks by which devices within a supply chain must demonstrate compliance to, which offers additional protection against cyber threats.

The Cyber Resilient Technology (CyRes) specification developed by the TCG, entitled Cyber Resilient Module and Building Block Requirements is an example of a crucial standard making a difference within the technology ecosystem. This specification was created to ensure the implementation of cyber resilient architecture in the first stages of a product’s design process, rather than it being considered an afterthought.

The goal is to sufficiently equip all devices with the necessary components to protect, detect, and attest – bolstering the security of the supply chain.

This, paired with a hardware Root of Trust (RoT) like the Trusted Computing Module (TPM), makes cyber resiliency accessible to the average user and provides assurance to financial organizations that their systems are protected.

Securing the Ecosystem
The financial sector remains a major target for malicious cyber-attacks, facing the second-largest number of known security breaches in 2022. Banks differ from many other large organizations in that they must heavily rely on the security of their customers’ devices.

They must trust that the overall security ecosystem is secure enough to prevent or mitigate any damage caused by cyber-attacks. Stringent security measures and software must be made readily available and common within devices to ensure banks and other organizations are adequately covered against threats. The standards and specifications from bodies such as TCG are necessary to protect against malicious activity, and establish trusted computing not only for individual devices, but for the supply chain as well.

This article originally appeared in the May / June 2023 issue of Security Today.

Featured

  • Maximizing Your Security Budget This Year

    7 Ways You Can Secure a High-Traffic Commercial Security Gate  

    Your commercial security gate is one of your most powerful tools to keep thieves off your property. Without a security gate, your commercial perimeter security plan is all for nothing. Read Now

  • Survey: Only 13 Percent of Research Institutions Are Prepared for AI

    A new survey commissioned by SHI International and Dell Technologies underscores the transformative potential of artificial intelligence (AI) while exposing significant gaps in preparedness at many research institutions. Read Now

  • Survey: 70 Percent of Organizations Have Established Dedicated SaaS Security Teams

    Seventy percent of organizations have prioritized investment in SaaS security, establishing dedicated SaaS security teams, despite economic uncertainty and workforce reductions. This was a key finding in the fourth Annual SaaS Security Survey Report: 2025 CISO Plans and Priorities released today by the Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment. Read Now

  • Mobile Applications Are Empowering Security Personnel

    From real-time surveillance and access control management to remote monitoring and communications, a new generation of mobile applications is empowering security personnel to protect people and places. Mobile applications for physical security systems are emerging as indispensable tools to enhance safety. They also offer many features that are reshaping how modern security professionals approach their work. Read Now

Featured Cybersecurity

Webinars

New Products

  • 4K Video Decoder

    3xLOGIC’s VH-DECODER-4K is perfect for use in organizations of all sizes in diverse vertical sectors such as retail, leisure and hospitality, education and commercial premises. 3

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure. 3