Rethinking Cybersecurity strategies for the BFSI Sector

The BFSI sector thrives on trust and ensuring the same is not easy. Banks invest heavily to enforce security for the financial assets of their customers, be it using reinforced steel vaults to leveraging advanced intrusion prevention systems. To ensure the security and privacy of assets banks should have foolproof methods to authenticate identities. Any failure to do so could result in heists from criminals. This is where security testing in banking/financial services becomes critical to not only sustain but become competitive as well. In an ecosystem where criminals have access to similar computing power and resources as institutions belonging to the BFSI sector, creating a new security model has become a challenge. The BFSI sector does not have to worry about daylight robberies in today’s day and age but must counter increasing threats from cybercriminals who have no qualms in using advanced technology tools.

According to Cybersecurity Ventures, cybercrime is going to exact its toll to the tune of $6 trillion annually by 2021. With the onset of the pandemic, the BFSI sector had to perforce revamp its operations and processes by going digital. This has left the sector extremely vulnerable to new-age cybercriminals who stop at nothing to hoodwink the established security systems. Since cybercrime guarantees humongous returns with the upside of relatively fewer chances of detection and less accompanying risks, cybercriminals are using various types of vectors to gain access to sensitive customer information. These include malware, trojans, ransomware, ATM malware, and mobile banking malware, among others.

Moreover, cybercriminals under the cloak of anonymity work determinedly to knock down the defenses of the BFSI sector using invasive software tools and new-age hacking technologies. Thanks to the relatively non-optimum cybersecurity systems deployed at most banks and financial institutions, cybercriminals can get past them and steal data and information worth millions. If left unchecked and the sector continues with legacy cybersecurity strategies, the new-age cyber outlaws can bring the entire sector to its knees.

Rejigging your cybersecurity strategies

Given that the BFSI sector is the backbone of the economy and any threat can endanger the sovereignty of the state, there is a need to set up a highly resilient and agile counter-threat mechanism. If cybercriminals can leverage technologies and tools to strike at will, the BFSI sector too should employ a strong risk mitigation system with mandatory BFSI testing to identify and remove all types of threats. The approach should be to implement a sectoral security transformation initiative by leveraging state-of-the-art cybersecurity architecture. The same should have the capability to counter the never-ending threats and attacks from hackers and cyber outlaws. The BFSI sector must make use of sophisticated and layered cybersecurity procedures and tools to neutralize any type of threat.

The cybersecurity strategy should use mechanisms and tools such as proxy servers, firewalls, Security Incident and Event Management (SIEM), Privileged Identity Management (PIM), token-based two-factor authentication, Web Application Filtering (WAF), File Integrity Management (FIM), and Advanced Persistent Threats (APT), among others. Besides, banks and financial institutions should have dedicated professionals with the understanding and experience of countering cyber threats. Also, any software used by the sector to offer services to the users should be subjected to stringent banking domain testing. This would help to identify any loophole or vulnerability in the application, which threat actors can exploit to run their nefarious agenda. Alongside appointing cybersecurity professionals, the BFSI sector should carry out a massive upskilling/reskilling of its employees in cybersecurity practices. The staff should be trained on the security implications of cyber attacks and made aware of the dos and don’ts.

Banks and financial institutions should rethink utilizing the three pillars of security – what you know (passwords), what you are (biometrics), and what you have (OTPs, secure IDs, and RSA tokens.) Since the two-step authentication process is no longer effective in countering the emerging threats, the sector should rejig the three pillars without compromising the user experience in any way. The focus towards security testing in banking/financial institutions should involve implementing a few procedures. These include using number grids on credit/debit cards so that the PIN changes for every transaction without inconveniencing the user, and voice-based authentication.

Apart from upskilling/reskilling the staff, a customer education drive should be launched in earnest. This is of utmost importance as the customer base is varied with baby boomers used to branch banking and tech-savvy natives using shortcuts to further smoothen their user experience can leave accounts unguarded. This apart, vendor partners should be educated on cybersecurity and audited to ensure their compliance. Even though these are the tried and tested technologies, the need is to employ advanced technologies to match or beat the innovativeness of threat actors.

Use of new technologies

Digitalization of the banking and insurance sector offers enough scope to implement new technologies as part of BFSI testing, which may turn out to be a cog-in-the-wheel to prevent cyber fraud. The new-age technologies are as follows:

Artificial Intelligence

To beat the hackers in their own game, banks, financial, and insurance services should leverage AI-based technologies such as Deep Learning (DL) and Machine Learning (ML). These technologies provide analysis driven insights based on historical and present transactions, behavior, and background. The analysis can be extrapolated to offer projections in a matter of seconds. These technologies can scrutinize transactions that do not fit into the usual pattern for a particular user with the objective to detect any possibility of fraud. Technologies such as ML and DL can be implemented to check critical transactions and identify outliers.

Blockchain

Distributed ledger technologies like blockchain hold immense potential in preventing cybercrime. Blockchain is a distributed ledger comprising a series of transactions. Since each computer in the network holds a copy of the ledger, hackers cannot compromise any single node of failure. Blockchains are immutable (a record cannot be altered once written) with every transaction containing metadata, which cannot be changed in anonymity.

Conclusion

Preventing cybercrime is a combined and comprehensive process where every stakeholder should be involved. The banks and financial institutions ought to implement the toughest security measures as part of QA for banks while ensuring both employees and customers are made aware of the cybersecurity risks and the safe banking behavior to follow.