News
Observability and security must converge as the financial services sector goes cloud-first
Published
11 months agoon
By
admin
A new Dynatrace report highlights key vulnerability management challenges for banks and insurers.
With AWS Summit taking place July 12 in New York City, Dynatrace will release new data from its global chief information security officer (CISO) survey, revealing the state of vulnerability management in the financial services sector.
“The 2022 CISO Research Report: Financial Services” is based on the responses of 325 IT professionals within banks, insurers, and financial services providers. It reveals the majority of organizations have adopted multicloud environments, cloud-native architectures, and open source code libraries to support efforts to deliver new digital solutions to customers.
The data indicates, however, that organizations’ adoption of these approaches has created significant challenge for financial services organizations in managing and reducing enterprise risk as they innovate. In total, 75% of CISOs within financial services organizations say vulnerability management has become more difficult as the need to accelerate digital transformation has increased.
Layered security strategies are not enough
The rise of modern cloud environments has created a challenge for IT, development, and security teams within the financial services sector. While microservices, Kubernetes, and serverless computing deliver significant benefits for digital banking innovation, these architectures also make application security more complex. To overcome this, 58% of financial services organizations have a layered cybersecurity posture, supported by five or more different types of security solutions. However, even with this robust, layered approach to cybersecurity, the Dynatrace data reveals more than 75% of CISOs in the financial services sector believe their current security posture is not strong enough to keep vulnerabilities from entering production.
“The financial services industry is experiencing significant change, driven by evolving customer demands and intense competition from digital-first providers,” says Amit Shah, Director of Product Marketing, Application Security at Dynatrace. “However, this growing pressure to innovate faster is creating more risk of vulnerabilities escaping into production. It’s now clear that layered security is not enough, as teams simply can’t access all of the context they need to prevent every vulnerability from escaping. As a result, it’s increasingly difficult for them to manage the security of their applications, which could leave sensitive financial data and critical transactions at risk.”
In addition to the challenges created by cloud-native environments, 49% of CISOs said the speed of software delivery makes it easier for vulnerabilities to re-enter production. According to the research, just 6% of financial services organizations have real-time visibility into runtime vulnerabilities.
The impact of open source code on runtime application security
Many financial services organizations are already using other methods, such as open source code, to speed up or assist transformation efforts. These approaches, however, can also create security issues, with vulnerabilities regularly emerging in third-party software libraries.
According to the Dynatrace data, just 31% of security teams can access a fully accurate, continuously updated report of every application and code library running in production in real time. Additionally, 29% of CISOs said they do not always know which third-party code libraries they have in production at any given time. The recent discoveries of the Log4Shell and Spring4Shell vulnerabilities have highlighted the impact of susceptible third-party code. The Dynatrace study finds 96% of financial services organizations faced risk exposure from Log4Shell, with over a third saying their risk was “high” or “severe.”
In many cases, security solutions that detect vulnerabilities lack the runtime context needed to enable financial services teams to differentiate a minor flaw from a severe risk. As a result, many of the alerts they receive are low risk, and the sheer volume makes it difficult for security teams to distinguish the serious issues from the relatively harmless ones. Data indicates teams receive, on average, more than 2,200 alerts to potential vulnerabilities monthly, making it nearly impossible to see the forest for the trees. The frustration for CISOs is clear, with 75% of respondents confirming that most of their security alerts and vulnerabilities are false positives that don’t require action because they are not true exposures.
Promoting DevSecOps culture and IT automation
In this era of fast-paced digital transformation, financial services organizations must treat security as a shared issue across the business — which calls for a convergence with observability. Instituting a development, security, and operations-merged (DevSecOps) culture is an important step in achieving this. According to the Dynatrace data, only 37% of financial services organizations have a mature DevSecOps culture, where the majority of teams have integrated security practices across the software development lifecycle (SDLC). Implementing a DevSecOps practice is key to converging observability. It provides development, operations, and security teams with the context needed to understand how their applications are connected and where the vulnerabilities are. Dynatrace data finds 82% of CISOs in the financial services sector agree security must be a shared responsibility across the software delivery lifecycle, from development to production.
“If security becomes a shared responsibility,” Shah says, “and organizations converge observability and security, they can accelerate risk management and incident response by giving teams the context needed to make more effective decisions. To be truly effective, financial services organizations should look for solutions that have AI and automation capabilities at their core. These solutions empower teams across banks and insurers to quickly identify and prioritize vulnerabilities at runtime, block attacks in real time, and remediate software flaws before they can be used to exploit sensitive financial data and transactions.”
News
BioCatch Strengthens Collaboration with Microsoft Cloud for Financial Services
Published
1 day agoon
June 8, 2023By
admin
Collaboration Delivers End-to-End Intelligent Banking Cloud Platform with Online Fraud Detection Powered by Next-Generation Behavioural Biometrics
BioCatch, a global leader in fraud detection, today announced the global expansion of its behavioural biometric intelligence solutions in collaboration with Microsoft and is now available as an offering for Microsoft’s Cloud for Financial Services (FSI Cloud).
Microsoft Cloud for Financial Services provides capabilities to deliver differentiated experiences, empower employees, and combat financial crime while facilitating security, compliance, and interoperability.
Working with Microsoft since 2011, BioCatch provides effective and comprehensive anti-fraud support, and through Microsoft Cloud for Financial Services, BioCatch can extend further protections for banks transitioning to cloud-based operations for a protected, frictionless digital experience for consumers.
BioCatch and Microsoft reliably enable consumer protections against fraud through BioCatch’s behavioural biometrics software and Azure’s intelligent banking platform, underscoring the impact the solution alignment has had with financial institutions for over a decade.
“BioCatch and Microsoft have been great partners for us in our mission to protect M&T banking customers from harmful fraud attacks,” says Aaron Steinitz, Director of Enterprise Fraud Policy and Governance, M&T. “The visibility we get into the data by leveraging BioCatch’s technology via Microsoft Azure enables our fraud teams to swiftly address complex fraud attacks and reduce manual reviews, giving our customers better protection and an improved experience.”
“We are excited to continue working with Microsoft to provide behavioural biometric cloud-based fraud protection solutions for financial institutions looking to reduce risk for their cloud operations,” said Eyran Blumberg, BioCatch COO. “As banks and fintech businesses take their operations to the cloud, threat actors looking to exploit cloud vulnerabilities and scam the consumer become a larger problem. BioCatch is proud to provide the necessary and effective solutions for financial institutions to continue growing in the right direction, with the important understanding that their consumer accounts are kept safe.”
One of the key elements of BioCatch’s technology now being available for Microsoft Cloud for Financial Services is the ability for financial services organisations to purchase BioCatch’s solutions through Azure Marketplace. This accessibility enables them to seamlessly combine their transition to cloud-based financial operations with a proven behavioural biometrics solution that can analyse billions of sessions per month for its users. Through this, Azure provides enhanced risk management and protection for customers through a seamless user experience.
“We’re pleased that BioCatch is tapping into the power of Microsoft Cloud for Financial Services to help financial institutions unlock business value and deepen customer relationships,” said Bill Borden, Corporate Vice President, Worldwide Financial Services, at Microsoft. “We look forward to the enhanced opportunities this will bring to our joint customers, helping empower fraud and risk teams with behavioural biometric intelligence to act quickly while also giving consumers a safer and frictionless digital banking experience.”
BioCatch’s fraud prevention solution also keeps financial business operations in compliance with protection measures and digital safety requirements. With this, BioCatch’s behavioural biometrics solution enables financial institutions that use Azure to streamline fraud detection capabilities with global cloud scaling, keeping pace with the needs and demands of any cloud strategy financial institutions seek to deploy in Azure.
Business
One year until EMIR Refit: how can firms prepare?
Published
7 days agoon
June 2, 2023By
admin
Leo Labeis, CEO at REGnosys, discusses everything that financial institutions need to know about EMIR Refit and how they can prepare with Digital Regulatory Reporting (DRR)
There is now less than a year until the implementation date for the much-anticipated changes to the European Markets Infrastructure Regulation (EMIR). The amendments, which are set to go live on 29 April 2024, represent an important landmark in establishing a more globally harmonised approach to trade reporting.
Despite the fast-approaching deadline, concerns are growing around the industry’s preparedness, with a recent survey from Novatus Advisory finding that 40% of UK firms have no plans in place for the changes, for instance.
Much of the focus in 2022 was on implementation efforts for the rewrite of the Commodity Futures Trading Commission’s swaps reporting requirements (CFTC Rewrite), which went live on 5 December. Both the CFTC Rewrite and EMIR Refit are part of the same drive to standardise trade reporting globally. While EMIR Refit was originally anticipated to roll out first, implementation suffered from repeated delays to its technical specifications, in particular the new ISO 20022 format. The ISO 20022 mandate was eventually excluded from the first phase of the CFTC Rewrite, hence the earlier go-live date.
In parallel, the Digital Regulatory Reporting (DRR) programme has emerged as a key driving force in helping firms adapt to continually evolving reporting requirements. Having participated in the DRR build-up for their CFTC Rewrite preparations, how can firms leverage these efforts to comply with EMIR Refit in 2024?
The drive to standardise post-trade

Leo Labeis
To understand the new EMIR requirements, it is important to first look at the two main pillars in the global push to greater reporting harmonisation.
The first is the Committee on Payments & Market Infrastructures and International Organization of Securities Commission’s (CPMI-IOSCO) Critical Data Elements (CDE), which were first published in 2018 to work alongside other common standards including the Unique Product Identifier (UPI) and Unique Trade Identifier (UTI). These provide harmonised definitions of data elements for authorities to use when monitoring over the counter (OTC) derivative transactions, allowing for improved transparency on the contents of the transaction and greater scope for the interchange of data across jurisdictions.
The second is the mandating of ISO 20022 as the internationally recognised format for reporting transaction data. Historically, trade repositories required firms to submit data in a specific format that they determined, before applying their own data transformation for consumption by the regulators. The adoption of ISO 20022 under the new EMIR requirements changes that process by shifting the responsibility from trade repositories to the reporting firm, with the aim of enhancing data quality and consistency by reducing the need for data processing.
Preparing for the new requirements with DRR
DRR is an industry-wide initiative to enable firms to interpret and implement reporting rules consistently and cost-effectively. Under the current process, reporting firms create their own reporting solution, inevitably resulting in inconsistencies and duplication of costs. DRR changes this by allowing market participants to work together to develop a standardised interpretation of the regulation and store it in a digital, openly accessible format.
Importantly, firms which are using the rewritten CFTC rules which have been encoded in DRR will not have to build EMIR Refit from scratch. ISDA estimates that 70% of the requirements are identical across both regulations, meaning firms can leverage their work in each area and adopt a truly global strategy. DRR has already developed a library of CDE rules for the CFTC Rewrite, which can be directly re-applied to EMIR Refit. Even when those rules are applied differently between regimes, the jurisdiction-specific requirements can be encoded as variations on top of the existing CDE rule rather than in silo.
Notably the UPI, having been excluded from the first phase of the CFTC Rewrite roll-out, is mandated for the second phase due in January 2024. DRR will integrate this requirement, as well as others such as ISO 20022, and develop a common solution that can be applied across the CFTC Rewrite and EMIR Refit.
As firms begin their own build, the industry should work together in reviewing, testing and implementing the DRR model. Maintaining the commitment of all DRR participants will strengthen the community-driven approach to building this reporting ‘best practice’ and serve as a template for future collaborative efforts.
Planning for the long-term
Although the recent CFTC Rewrite and next year’s EMIR Refit are centre of focus for many firms, several more G20 regulatory reporting reforms are expected over the next few years. These include rewrites to the Australian Securities and Investments Commission (ASIC), Monetary Authority of Singapore (MAS) and Hong Kong Monetary Authority (HKMA) derivatives reporting regimes, amongst others.
Firms should therefore plan for the entire global regulatory reform agenda rather than prepare for each reform separately. Every dollar invested in reporting and data management will go further precisely because it is going to be spread across jurisdictions, easing budget constraints.
Looking ahead, financial institutions should establish a broad and long-term plan is to learn from their CFTC Rewrite preparation and how DRR can be positioned in their implementation. For example, firms should ask themselves which approach to testing and implementing DRR works best: via their own internal systems or through a third-party? Firms should review what worked well in their CFTC Rewrite implementation and apply successful methods to EMIR Refit. Doing so will enable firms to have a strong foundation for future updates in the years to come.
Magazine
Trending


Taxing times for online marketplaces? Operators must act now to avoid losing sellers
By Niall Kiernan, Senior Director of Product Marketing, Vertex In today’s digital landscape, online marketplaces are an enabler for...


Five Ways to Save Money in Your 20s
Depending on your background, entering your 20s can be a bit of a precarious time. Among the things you’ll need...


Unlocking the Power of Data: Revolutionising Business Success in the Financial Services Sector
Suki Dhuphar, Head of EMEA, Tamr The financial services (FS) sector operates within an immensely data-abundant landscape. But it’s...


Hidden sources of FX risk: could your business be exposed?
Running a business can come with great rewards, but it’s not without risk – something businesses in the UK have...


Preventing fraud and detecting money laundering in real-time
Mathew Hobbis – Chief Architect FSI, Solace The number of payment channels has grown exponentially. The time it takes...


Money where your mouth is: on the need to modernize insurance tech stacks
Tim Hood, VP, EMEA and APAC, Hyland Once upon a time, starting an insurance company was a predominantly physical...


Making the Maths Work: Addressing Inflation Challenges through Measuring and Managing Risk
Matt Clementson, Head of Enterprise UK&I Persistent inflation is highly troublesome for every business – with or without a recession....


BioCatch Strengthens Collaboration with Microsoft Cloud for Financial Services
Collaboration Delivers End-to-End Intelligent Banking Cloud Platform with Online Fraud Detection Powered by Next-Generation Behavioural Biometrics BioCatch, a global leader...


HOW SMALL BUSINESSES CAN FIGHT BACK AGAINST POOR PAYMENT PRACTICES
SMEs across the UK are facing a challenging economic environment and late payments pose a severe challenge to maintaining cash...


Less than a year until EMIR Refit: how can firms prepare?
Leo Labeis, CEO at REGnosys, discusses everything that financial institutions need to know about EMIR Refit and how they can...


Enhancing cybersecurity in investment firms as new regulations come into force
Christian Scott, COO/CISO at Gotham Security, an Abacus Group Company The alternative investment industry is a prime target for...


How to think like an attacker & why it might be critical to your security strategy
Kam Karaji, Global Head of Information Security for Bibby Financial Services, argues at DTX Manchester that the most successful way...


Building a sustainable future – what’s on your agenda for 2023?
The most successful and progressive leaders are embracing ESG or Environmental, Social and Governance principles throughout their businesses, but how...


Digital Acceleration – the next buzzword in banking tech? Or a new era for the industry?
Ove Kreison, CTO at Tuum McKinsey’s latest report on banking found that traditional banks are spending a whopping 85% of their...


One year until EMIR Refit: how can firms prepare?
Leo Labeis, CEO at REGnosys, discusses everything that financial institutions need to know about EMIR Refit and how they can...


In the Name of the Family! Firms with CEOs under clan culture influence are much more likely to be internationally focused
In an increasingly globalised world, it is incredibly rare that a firm can expect to grow in the long-term unless...


Regulations, RegTech and CBDCs – Fintech’s Next Chapter
Teresa Cameron, Finance Director at Clear Junction Over the last decade, the UK has embraced the fintech revolution with...


Gearing up for growth amid economic pressure: 10 top tips for maintaining control of IT costs
By Dirk Martin, CEO and Founder of Serviceware Three years on from the pandemic and economic pressure is...


Find Your Tribe With Content Marketing
Ian is the CMO at Spotler Group Seth Godin, a writer, speaker, marketing expert, and influencer, describes audiences as tribes,...


The formula for success: delivering total experience in financial services
Monica Hovsepian, Global Industry Strategist, OpenText The tumult of the last few years has thrown many challenges at...

Taxing times for online marketplaces? Operators must act now to avoid losing sellers

Five Ways to Save Money in Your 20s

Unlocking the Power of Data: Revolutionising Business Success in the Financial Services Sector

Hidden sources of FX risk: could your business be exposed?

Preventing fraud and detecting money laundering in real-time

Money where your mouth is: on the need to modernize insurance tech stacks

PCI DSS v.4.0 Latest Updates That You Need to Know

RBI’s MASTER DIRECTION ON DIGITAL PAYMENTS SECURITY CONTROLS

EMV® 3-D SECURE: ENABLING STRONG CUSTOMER AUTHENTICATION

HOW TO SIMPLIFY IDENTIFICATION IN THE GLOBAL DIGITAL ECONOMY WITH THE LEI

EXEGER – CHANGING THE PERCEPTION OF POWER

FUTURE FX PROMO
Trending
-
News1 day ago
BioCatch Strengthens Collaboration with Microsoft Cloud for Financial Services
-
Business3 days ago
HOW SMALL BUSINESSES CAN FIGHT BACK AGAINST POOR PAYMENT PRACTICES
-
Finance1 day ago
Preventing fraud and detecting money laundering in real-time
-
Business3 days ago
Less than a year until EMIR Refit: how can firms prepare?