Jordan Savvides To retain digital talent, organizations need to create a “Security

Jordan Savvides To retain digital talent, organizations need to create a “Security – First Mindset.”

Jordan Interview 3

What new threats/challenges do you foresee with newer technologies and applications coming into the picture to enhance customer convenience and experience?

The plethora of new fintech applications designed to improve customer convenience and experience driven by the disruption caused by the digital banking transformation era will undoubtedly increase the cyber threat landscape and present the cyber criminals with new cyber-attack vectors as the cyber-attack surface is growing exponentially. This phenomenon is a direct consequence of the pressure the financial organisations are under to keep up with the accelerated fintech momentum and remain in business in this new highly competitive online digital market that has been taken by storm by the omni-channel banking revolution. Unfortunately security always comes last when the business is struggling to meet the customers’ high expectations for new products, new services and new delivery channels.

What according to you are the latest trends that will disrupt the banking security domain?

We will see more APT (Advanced Persistent Threats) against the Banking Sector using customised Banking Trojans & Malware by exploiting social engineering phishing techniques to infect the Banks’ internal corporate network. These type of cyber-attacks are on-going, highly sophisticated, complex targeted stealth attacks that move under the radar using lateral movement techniques, which makes it practically impossible for traditional signature based cyber-security controls to detect and prevent.

Leveraging new banking channels of communication are important to better serve customers, but keeping pace with emerging technologies and their associated threats are also key challenges. Mobile devices and applications are primary examples of the balance between greater efficiency and new kinds of cyber risks. Some financial institutions struggle in this area, while others find ways to combine usability and security. Cyber threat intelligence reveals that phishing, botnets and mobile malware are rated among the most likely threats faced, and also among the ones with the biggest impact. ATM heists are also on the increase as we see cyber criminals employing jackpotting attacks.

What are the key challenges of how sensitive data is protected now? Do you think data-centric security is the way forward?

Sensitive data must first be discovered/identified, assigned information owners and classified according to the Enterprise Information Classification Guide of each organisation. Then based on the Enterprise Information Security Policies & Procedures in each case, the required information security controls must be implemented like strong access controls based on the principles of role-based access control, least-privilege and need to know. Data encryption, DLP (Data Leakage Prevention), IAM (Identity Access Management), Database Firewalls, data masking & scrambling, data tagging & watermarking etc are also critical data security controls in order to protect the confidentiality, integrity and availability of sensitive data.

Data-Centric security should be part of our cyber security strategy, but not the core. Network Security will always come first, because without the existence of the TCP/IP network in the first place, hacking would not be possible. In other words, the cyber criminals must penetrate and compromise our network first before they can get to our data. Saying that of course a solid data security strategy is of paramount importance as well.

PSD2 will open up new opportunities and revolutionize payments, what would this mean for online security?

By providing their APIs to TPPs, banks open up a significantly greater attack surface to potential cyber adversaries. However, banks that follow a sound architectural approach can mitigate these issues, by integrating security requirements with the fundamental business drivers and business cases. This helps to ensure that their security processes are adaptive and responsive to threats while also being tightly coupled to business impacts. API security should be an integral part of API implementation and achieving this requires a specific view of the API architecture. Strong multi-level customer authentication is imperative to reduce the inherent cyber security risk, by implementing the authentication principles of “something you know” (password/passphrase/pin), “something you have” (token, smart card, soft OTP) and “something you are” (biometrics).

From a cyber-security perspective, the complexity of keeping customer data secure will increase significantly. One of the drivers here is that clients will be communicating to many more instances than just their traditional bank, multiplying the attack vectors for cyber criminals. Opening up APIs introduces a whole host of new vulnerabilities which can be exploited by hackers; therefore, it is vitally important that security providers are watching the developments of the PSD2 standards closely until implementation in January 2018. In practice, this means that the bank’s back-end systems will be accessed from the TTP’s non-controlled environment via the internet whenever the customer clicks a button onscreen. Such internet-driven interactions make customer data a much softer target for cybercrime. According to the Verizon 2017 Data Breach Investigation Report, about 73% of all data breaches were financially motivated.

According to you, what do you think the future holds for IOT Security in Banking?

Over the next five to ten years, the banking industry is going to see major changes from IoT technologies, which will also present banks with new security challenges to manage. The need to ensure that the whole connected banking experience is safe and secure will be increasingly vital in order to gain customer trust and ease clients’ concerns around personal and business banking data being hacked. Sensitive data, from a customer’s financial history to their location history, is always potentially a target while it is stored on or moving around the network. No matter where the data is held, whether it be on a device or moving along the network from the bank to the customer’s connected car, for example, it needs to be properly protected.

The new generation of increasingly connected consumers and businesses will drive IoT innovation in banking. M2M connectivity will see banks start to develop progressively more rewarding and more convenient customer experiences and business services, including more convenient forms of always-on access and new payment technologies. However, with each successive improvement in customer and business banking services due to IoT technology there will also be a concurrent increase in concerns around identity theft and customer verification. Banks’ data security and data management technologies and strategies will be more important than ever.

We will see widespread implementation of security checking methods like tokenization in smart and wearable technologies in the IoT era, which is certainly going to bring an extra level of security to digital payment processes. Which means that sensitive personal and financial data will be better protected from accidental or deliberate unauthorized access. As well as traditional forms of security and user authentication, banks will also start to use and rely on biometric data – from numerous sources including fingerprints, finger vein and iris scans, voice-recognition and facial-recognition software.

Whether data is ‘resting’ on a device or on a bank’s IT system or whether it is moving around nodes in an IoT ecosystem, it always must be fully secured and encrypted. Additionally, banks will have to have solid and secure key management strategies and strong authentication processes in place to ensure security isn’t a barrier to IoT innovation.

Are regional banks adequate enough to face global threats?

No I am afraid they are not, because they are lacking behind in cyber-security investment and cyber-security talent. Regional Banks must invest in state of the art cyber-security control systems, by adopting the principles of Multi-Layer-Security and Defence-In-Depth including the Endpoint. By doing so, they will achieve true segregation and segmentation of their network security architectures and of their cyber security controls themselves both at the physical and the logical level. Their cyber security strategy must be complimented by the latest ATP (Advanced Threat Prevention), AI (Artificial Intelligence), ML (Machine Learning) and Neural Networks cyber security control systems and the imperative 24x7x365 SIEM (Security Information Event Management) Security Monitoring Services, preferably outsourced to the MSSP’s (Managed Security Services Providers) and their global SOC’s (Security Operation Centres) in order to capitalise on their advanced threat intelligence capabilities and big data security analytics that can predict and detect the unknown cyber-attacks.

In order to achieve all the above, regional banks should proceed with significant investments both in technology and human resources.

Blockchain/IOT/AI/Big Data/Cloud, which of these can change the security landscape? And Why?

All of these elements will change the security landscape.

Enterprises using blockchain applications should expect constant changes in the security landscape. New bugs, security risks, and best practices will continue to emerge over time. The cost of failure is too high to limit defensive efforts to only known vulnerabilities. By storing data across its network, blockchain eliminates the risks that come with data being held centrally. The decentralized blockchain may use ad-hoc message passing and distributed networking. Its network lacks centralized points of vulnerability that computer crackers can exploit; likewise, it has no central point of failure. The cryptographic consensus protocol ensures immutability and irreversibility of all transactions posted on the ledger. However, if a blockchain is used to store confidential contract information or payment data, then replicating the file could potentially offer hackers more places to get their hands on it. Therefore the cyber-attack surface is increased. While the blockchain technology promises to drive efficiency or reduce costs, it has certain inherent risks. It is imperative that firms understand these risks and the appropriate safeguards in order to reap the benefits of this technology. Additionally, it’s important to understand the evolution of regulatory guidance and its implications. These blockchain risks can be broadly classified under three categories. Standard risks where blockchain technologies expose institutions to risks that are similar to those associated with current business processes but introduce nuances for which entities need to account. Value transfer risks where blockchain enables peer-to-peer transfer of value without the need for a central intermediary. The value transferred could be assets, identity, or information. This new business model exposes the interacting parties to new risks that were previously managed by central intermediaries. Smart contract risks where smart contracts can potentially encode complex business, financial, and legal arrangements on the blockchain, and could result in the risk associated with the one-to-one mapping of these arrangements from the physical to the digital framework.

The rise of the Internet of Things (IoT) is driving changes in all aspects of security causing organisations to reevaluate the necessary people and service skills, structures and approaches to their security needs. The landscape known as the “pervasive digital presence” is changing how we approach digital security through four main differentiators from traditional IT security: scale, diversity, function and flow. Security and risk managers should consider how these differentiators are driving change and adapt new strategies that help address the ever-shifting landscape. First, the security landscape is changing due to the scale of this digital presence. The pace of innovation has generated requirements for millions of devices, most network connected or wirelessly connected in some capacity. Unfortunately, most of these devices have little or no protection at the software and infrastructure level. Finally, security and risk decision-makers must look at data flow in IoT networks to understand how, when and where to secure data. Data in IoT networks tends to be constantly changing, even if it’s stored. When making key decisions to protect data via encryption, network segmentation, or even monitoring and detection, data flow remains a key differentiating characteristic that may require new approaches in digital security. IoT introduces new variables to the risk formula, variables that need to be incorporated into traditional means of assessing and calculating IT risks. As a whole, the cyber security community will need to acknowledge IoT’s pervasive presence and adopt new strategies that consider our digital world. The 2016 Dyn DDoS attack was record breaking in several ways, including the sheer volume of “noise” generated by using device, including IoT devices, to generate that noise, affecting not only enterprise users but consumers.

AI is an important tool, because the threat landscape is continuously changing, with new vulnerabilities found every day. Artificial intelligence has advanced rapidly in line with computer processing power and the proliferation of data. Artificial intelligence can learn to interpret, at a much faster rate than any human could possibly comprehend the same data. With artificial intelligence, cyber security detection and prevention can become smarter, more adaptable, and more successful. Artificial intelligence for security systems works as a teachable algorithm, such as a neural network. AI and its associated technologies such as automation, machine learning and pattern and behavior recognition have to transform and shape the current cyber security landscape as well as its future. Given the sophistication of modern cyber threats and the increasing number of attack vectors as Internet of Things device usage grows, security solutions will need to be adaptive, intelligent and increasingly automated. Artificial Intelligence technologies enable cyber security architectures to have all of these characteristics. From being able to adapt to new threats and detect anomalous behavior patterns to advanced network traffic monitoring and automated malware detection, artificial intelligence technologies are currently being put to use in order to enhance a vast collection of cyber security systems and functions. Artificial intelligence is now at the cutting edge of cyber security technologies and will likely be a common and well developed in the majority of systems in the not too distant future. Maintaining vigilance in this perilous cybersecurity landscape will require enterprises to start leveraging artificial intelligence (AI).

Big Data analytics is playing a significant role in looking at the threat landscape to determine where weaknesses are, and whether the right strategies and tools are in place. Big data analytics in security involves the ability to gather massive amounts of digital information to analyze, visualize and draw insights that can make it possible to predict and stop cyber-attacks. Big data analytics can solve pressing security issues faced by companies and government. The value of big data analytics in addressing cyber risk is rising exponentially. A strong defense against hackers and cyber criminals requires a quick containment of anomalous and malicious traffic in networks, which makes big data analytics in cyber defense very important. Big data analytics tools allow organizations to recognize patterns of activity that represent network threats. Traditional solutions, which continue to fall short in detecting and stopping threats, can be enhanced with big data analytics. New big data tools and data management techniques are emerging that can efficiently handle the volume and complexity of IP network data, and should be part of an enterprise cyber defense strategy that meets complex and large-scale analytic and data management demands. Cyber Security analytics with Big Data is applicable in many security use cases such as network monitoring, authentication and authorization of users, identity management, fraud detection, and systems of governance, risk and compliance. Big Data analytics blend real-time analytics on data in motion with historical analysis on data at rest. By deploying security-specific analytics, organisations can find new associations or uncover patterns and facts. This real-time insight can be invaluable for detecting new types of threats as well.

Like with most technologies, innovation precedes security, and this causes unease in the minds of those who feel pressured to make the move without having a deep understanding of the risks. With the massive shift to the cloud, cyber criminals will be looking for ways to compromise cloud apps for Personally Identifiable Information (PII) and other sensitive personal and financial data. Companies will have to take control of their data, ensuring it remains encrypted at every point from the database, to the network, to the applications using it. Managing this process will require secure encryption key management software that allows companies to encrypt data at appropriate levels of granularity. Organisations must implement controls like a suite of tools aimed at granular access controls, advanced monitoring, and audit tools, along with alerting features that help businesses put the right controls in place to prevent cloud administrators from accidental or malicious actions that can put data at risk. In addition, two-factor authentication and secondary authorization controls will allow companies to better protect admin credentials and prevent unauthorized use of advanced privileges. Advanced encryption and key management at the virtual machine level will help organizations keep data secure, even in the mobile cloud.

Cloud computing embody vast promise for advancing civilization. But cloud also have given rise to seemingly intractable security exposure, including nation-state rifts, not to mention profound quandaries about the erosion of individual privacy. The good news is that a new technological advance could unleash the full promise of cloud computing and put it on the verge of everyday use by. This advance is called “homomorphic encryption,” and it allows data to be queried and analyzed without decrypting it. Homomorphic encryption is the holy grail of encryption and the explosive growth of cloud computing makes this crucial. Amazon EC2, Google Cloud and Microsoft Azure have made cloud storage and processing services a major enabler of digital commerce. An enterprise that uses one of these services is effectively extending the boundary of their trusted enterprise compute environment, owned and managed by them, to an untrusted location owned and managed by a third party.

What are the main elements of a secure digital economy? Which countries do you think we should learn from?

The digital economy is a result of how the internet has transformed the way we do business. Regulations and security measures are often a step or two behind the constant evolution of technology. When progressing at too rapid a pace, certain regulations can get overlooked and unknown security risks can possibly be breached, putting valued customer data in danger.

Customer trust is the cornerstone of the digital economy. Without it, digital businesses cannot use and share the data that underpins their operations. To gain the trust of individuals, ecosystems, and regulators in the digital economy, businesses must possess strong security and ethics at each stage of the customer journey. And new products and services must be ethical- and secure by-design. Businesses that get this right will enjoy such high levels of trust that their customers will look to them as guides for the digital future. As data-centric products and services put data-handling concerns in the spotlight, cyber security experts agree that companies are exposed to exponentially more risk. Managing that risk and building trust starts with data ethics and security. To account for these intrinsic risks in other parts of a digital business’s operations, data ethics and, more comprehensively, digital ethics are critical. Next-generation security mechanisms are following the data, taking user behaviors into account, and extending well beyond the perimeter. Wherever data goes, security must go with it. To address this challenge, security solutions such as security-aware application design, integrated database security, dynamic access controls, and runtime application protection—are being integrated into new products. This data-centric philosophy is also revolutionizing identity and access management.

The bricks, the four pillar technologies that constitute digital economy are big data & analytics, the cloud, mobility and social media. Security is a pivotal topic for all organizations. The sheer amount of data collected and used in the course of business today, and the increasing number of high-profile security breaches reported globally, offer multiple areas of concern. By 2018, 70% of enterprise cybersecurity environments will use cognitive/AI technologies to assist humans in dealing with the vastly increasing scale and complexity of cyber threats.

I believe that the countries we should learn from are the USA and the UK, because they are at the forefront of secure digital economy.

Jordan Savvides, Head of Information Security at National Bank of Bahrain will be giving insights on Cyber-attacks and the defense mechanism at the 2^nd Annual FINSEC 2018- The Banking Security Summit

Jordan Savvides To retain digital talent, organizations need to create a “Security – First Mindset.”

Download Event Brochure

Payments & Cards Network

Paladion

Planet Biometrics

Banking Technology

NFC Times

Global Banking & Finance Review:

TelcoProfessionals

Mobile ID World

Payments & Cards Network

Card & Payments World

Fraud Watch

OER

Banking Technology

Security Solutions Watch.com

Cyber Defense Magazine

InAuth

Deloitte

KPMG

COMARCH

CA Technologies

ABOUT UAE FMA

Hackers Interview

IBS Intelligence

Innovatrics

Security Solutions Watch

Tahawul

VASCO

InAuth

Paladion

Darktrace

Microsoft

Bugs Bounty

Anomali

Mohamed Roushdy

Rasha Abu Al Saud

Prashant Nair

Noha Amin

Osama Hijji

Roshdi A Osman

Thabet Bakheet

Hariprasad Chede

Ameen Ali

Hussain Al Khalsan

Kevin Nevias

Yazad Khandhadia

Pankaj Kundra

Azeem Bashir

Brian Byagaba

Dennis Koh

Khaled Moharem

Dr. Martin Emms

Mohammed Aamir Ali

Sameer Bedi

Sunil Gupta

Markus J. Krauss

Luke Merry

Peter Martis

Bharat Panchal

Amit Mehta

Hussain AlKhalsan

Amit Roy

Jonathan Martin

Mohammed Al-Moneer

About Us

About Us

Ankush Johar

FICO

Malwarebytes

Innovatrics

AlgoSec

CyberArk

Entrust Datacard

Utimaco

FindBiometrics

TelcoProfessionals

Mobile ID World

Global Banking & Finance Review

Financial IT