A featured contribution from Leadership Perspectives: a curated forum reserved for leaders nominated by our subscribers and vetted by the Construction Tech Review Advisory Board.
VÚB banka
Adhering to Cyber Security Fundamentals is Key to Digital Transformation
1. What are some of the major challenges and trends that have been impacting the Cyber Security space lately?
Since the start of the COVID-19 pandemic, the adaption of a remote work setup has been the biggest challenge that the bank had to cope with. The bank has decided to adopt a hybrid work model where it enabled employees to work partially from offices and partially from home depending on the pandemic situation. The adoption of a hybrid work model required the implementation of new cloud solutions in business processes. While cloud computing did offer a competitive advantage, it was important not to rush into cloud adoption without understanding the risks involved as well.
Moving data to the cloud also presented potential compliance issues that needed to be addressed. Questions like - Who owns the data? Who is permitted to access the stored data? In which countries will the data be stored? etc had to be answered before deciding whether to move data to the cloud or not. An important element of our risk management framework was to classify the information assets so that the risks related to them could be properly managed.
Even though our clients have become more digitally literate and aware of cyber security practices, phishing is still a major threat in the financial industry. Fraudulent emails, texts, and calls from scammers pretending to be a bank or some other well know organization are still on the rise. Despite the advanced technology and process maturity, there is still space for human error and social engineering looking for exploiting it. This is especially relevant when it comes to the banking industry where successful attacks can have a financial impact on clients. Security and antifraud solutions can mitigate this issue to a certain level but there is the human factor to consider as well. Educating clients is not a particularly popular method but in general, we can say that security awareness is continuously improving.
2. What keeps you up at night when it comes to some of the major predicaments in the Cyber Security space?
Conflict in Ukraine presents perhaps the most acute cyber risk western corporations are facing. The conflict could cause an increase in cybersecurity attacks on our bank since Slovakia is a part of NATO and Russian hackers could retaliate for supporting Ukraine in this conflict.
Since a bank's supply chain network is getting larger and more diversified, we are aware of the dangers of supply chain attacks that have the potential to disrupt vital business operations, threaten critical data and damage the relationship between the bank and clients. Because of this, the bank is continuously improving its plans to detect, respond and recover from a supply chain breach.
It's also unpleasant to witness new phenomena like Fraud-as-a-Service being used more frequently by malicious actors. We usually think of fraudsters as shady criminals operating out of warehouses or basements but With Fraud-as-a-Service, we’re witnessing fraudsters offering professional services and sophisticated organizations. Since these transactions take place on the dark web it's difficult to trace and disrupt them.
3. Can you tell us about the latest project that you have been working on and what are some of the technological and process elements that you leveraged to make the project successful?
The bank implemented the use of facial biometric data for the digital onboarding process of new customers. Cybersecurity controls for identity proofing like document authentication and liveness detection were implemented in the digital onboarding process to prevent spoofing attacks.
A notable project was also the implementation of a Mobile point-of-sale (mPOS) solution which enabled small (or micro) merchants to accept payment via a Commercial Off-The-Shelf (COTS) device like a smartphone. Since, unlike closed payment processing systems, mPOS relies on the security of the commercial off-the-shelf device and the downloadable app, special due care was applied to secure the payment process. Countermeasures like creating a separation between the PIN and the card’s credentials, securing and maintaining key management that protects the cardholder’s data and other countermeasures specified in PCI SPoC and PCI CPoC were implemented.
4. What are some of the technological trends which excite you for the future of the Cyber Security space?
Some of the technological trends which we're looking forward to are:
- Zero Trust, arguably one of the most widely discussed trends in cyber security, challenges the barriers of IT systems by ensuring that implicit trust is verified, limited and continuously monitored. The implementation of the “Never trust, always verify” principle.
- AI in cybersecurity can enable cybersecurity systems to analyze threat patterns and learn the behaviours of cybercriminals, thereby helping to prevent similar attacks in the future.
- Modern authentication helps us to move away from conventional username and password methods and instead rely on token-based claims. Within the cloud, those tokens help us to govern access to individual resources whether they are internal or third-party applications linked to the user’s identity. The most compelling part of this architecture is that these tokens can include additional information such as current location or used device, thus enabling conditional access to company resources.
5. What are some of the suggestions you have for emerging companies to streamline their business?
For evolving companies, we would recommend sticking to cyber security fundamentals. It is crucial to know your assets, especially the data you want to protect. This might sound like an obvious piece of advice, but it is not always an easy task. As more organizations adopt cloud technologies, developing cloud security skills is more relevant than ever. With the concept of cloudification and remote working, it seems like the security network perimeter disappears and security measures should be adapted accordingly. The focus should move more towards the protection of user identity. Adopting multifactor authentication to minimize risks of account hijacking and CASB to monitor traffic between cloud platforms and company network is a good starting point to achieve this goal.
