News

Why Zero Trust and securing the supply chain is key to post-pandemic recovery

Published

1 year ago

January 23, 2022

admin

Zero Trust & Securing The Supply Chain Is Key To Post-pandemic Recovery

Jim Hietala, Vice President, Business Development and Security at The Open Group

Banking and finance have grown to provide a vast range of services to people, touching every part of our lives from splitting dinner bills with friends to buying your first home. At heart, though, the value they provide might be boiled down to a very simple statement: they offer security and interoperability.

Which is to say that, when we use money, whether that is to pay for the bus or establish a pension, we need to be certain that it will reach the right destination, regardless of which systems it passes through, without being intercepted along the way. Interoperability ensures that desired actions happen; security ensures that undesired actions do not happen. Between them, these two key capabilities give us vital freedom in how we financially interact with people and businesses.

Roads and walls

That simple statement, however, is not simple to implement. The industry has long relied on open standards in order to achieve interoperability: from basic identification needs performed through standards like the International Bank Account Number system, to complex interactions like those managed through the Open Banking Standard which is currently transforming the British banking experience, fairly managed rules which everyone understands are essential to modern finance.

These standards, of course, are not static, and need to keep evolving in order to meet new needs. The same can be said of security – banks might still be associated with huge metal safes and vault doors in the popular imagination, but we all know that that’s not what keeps our money safe today. The question of security is now a digital one. From multi-factor authentication, to Transport Layer Security encryption, to automatically blocking access from unfamiliar devices and locations, the industry has been an early adopter of a wide range of technologies which manage or control access.

The need to develop and improve security approaches is still present, though. As is always the case with cybersecurity, risks need to be continually reassessed as the operating context changes – and, indeed, innovations in how people interact with banks always need to be made with security implications in mind. At the same time, new methods and strategies for cyberattacks are always developing, and there are good reasons to believe that now is the time for a fundamental shift in how we think about the topic.

The new weak link

Banking and finance, it is needless to say, are among the highest-value targets for attackers, and that means that if one route to compromising the industry becomes too difficult, they will look elsewhere for their opportunity. This is precisely what we’ve witnessed happening in some of the highest-profile breaches of recent times as organisations in other industries have dealt with the realities of supply-chain attacks.

In late 2020, for example, the security consultancy FireEye discovered that it had, alongside many other organizations, fallen victim to a sophisticated intrusion which took an obscure and convoluted path to its target. The victims were users of software offered by the company SolarWinds, which was successfully infected with a trojan. As the SolarWinds tool was an approved piece of software, FireEye and others happily brought that malicious code inside the gates (so to speak) of their own networks. This gave the attackers a route to manipulate FireEye’s own software and ultimately give them access to sensitive and otherwise highly secure environments.

What’s important to understand about this attack is that no amount of network-focused security would have prevented it: rather than trying to pass as an authorised user, the attackers worked a situation where the actual point of infiltration was carried out by genuinely authorised users.

It’s a scary situation, and a tactic that becomes more viable for attackers as our digital infrastructure becomes more complex. As businesses in the sector offer their customers richer online experiences – often in ways which, as with Open Banking, seek to enhance interoperability – they also become more dependent on a whole stack of platforms and tools. Rather than build a new back-end system from scratch, for instance, a bank might bring in a fintech platform from a vendor, who will themselves use development and operational tools from other vendors, who themselves will have further dependencies on other vendors.

This supply chain, in other words, is starting to look like a vast new attack surface which requires a new approach to secure.

The end of trust

If securing networks is no longer enough, we need to look to models which secure the data and assets which those networks are there to carry. This is what the Zero Trust model offers: rather than assuming that any device on a network must have passed a security checkpoint and is therefore trustworthy, Zero Trust assumes that every action is potentially malicious, and performs security on an ongoing, case-by-case basis.

While the principles of Zero Trust are not new, the need to put them into action has never been greater. Few industries have gone untouched by the societal changes which the pandemic triggered, never mind the economic impact, and successfully bouncing back from those economic consequences will require innovating towards a position which reflects the expectations of modern consumers. For banking and finance, that means digital tools which work from anywhere, securely and intuitively.

Which brings us back, of course, to the other half of the value which this industry offers: just as new systems for interoperability need to be designed with regards to maintaining security, new security models cannot jeopardise interoperability if they are going to successfully preserve the freedom with which people expect to deal with their finances.

That’s why the industry’s adoption of Zero Trust has to happen from a position of open standards. Just as shared understanding powers institutions’ abilities to accurately communicate their customers’ intentions to one another, it is needed to enable mutual understanding about what needs to be kept secure and how. In a challenging and rapidly evolving environment, that’s a priority for all of us.

Up Next

Europe’s first blockchain neobank, BENKER, opens for pre-registration

Don't Miss

NutreeLife triples production with finance from Siemens Financial Services

News

BioCatch Strengthens Collaboration with Microsoft Cloud for Financial Services

Published

1 day ago

June 8, 2023

admin

Collaboration Delivers End-to-End Intelligent Banking Cloud Platform with Online Fraud Detection Powered by Next-Generation Behavioural Biometrics

BioCatch, a global leader in fraud detection, today announced the global expansion of its behavioural biometric intelligence solutions in collaboration with Microsoft and is now available as an offering for Microsoft’s Cloud for Financial Services (FSI Cloud).

Microsoft Cloud for Financial Services provides capabilities to deliver differentiated experiences, empower employees, and combat financial crime while facilitating security, compliance, and interoperability.

Working with Microsoft since 2011, BioCatch provides effective and comprehensive anti-fraud support, and through Microsoft Cloud for Financial Services, BioCatch can extend further protections for banks transitioning to cloud-based operations for a protected, frictionless digital experience for consumers.

BioCatch and Microsoft reliably enable consumer protections against fraud through BioCatch’s behavioural biometrics software and Azure’s intelligent banking platform, underscoring the impact the solution alignment has had with financial institutions for over a decade.

“BioCatch and Microsoft have been great partners for us in our mission to protect M&T banking customers from harmful fraud attacks,” says Aaron Steinitz, Director of Enterprise Fraud Policy and Governance, M&T. “The visibility we get into the data by leveraging BioCatch’s technology via Microsoft Azure enables our fraud teams to swiftly address complex fraud attacks and reduce manual reviews, giving our customers better protection and an improved experience.”

“We are excited to continue working with Microsoft to provide behavioural biometric cloud-based fraud protection solutions for financial institutions looking to reduce risk for their cloud operations,” said Eyran Blumberg, BioCatch COO. “As banks and fintech businesses take their operations to the cloud, threat actors looking to exploit cloud vulnerabilities and scam the consumer become a larger problem. BioCatch is proud to provide the necessary and effective solutions for financial institutions to continue growing in the right direction, with the important understanding that their consumer accounts are kept safe.”

One of the key elements of BioCatch’s technology now being available for Microsoft Cloud for Financial Services is the ability for financial services organisations to purchase BioCatch’s solutions through Azure Marketplace. This accessibility enables them to seamlessly combine their transition to cloud-based financial operations with a proven behavioural biometrics solution that can analyse billions of sessions per month for its users. Through this, Azure provides enhanced risk management and protection for customers through a seamless user experience.

“We’re pleased that BioCatch is tapping into the power of Microsoft Cloud for Financial Services to help financial institutions unlock business value and deepen customer relationships,” said Bill Borden, Corporate Vice President, Worldwide Financial Services, at Microsoft. “We look forward to the enhanced opportunities this will bring to our joint customers, helping empower fraud and risk teams with behavioural biometric intelligence to act quickly while also giving consumers a safer and frictionless digital banking experience.”

BioCatch’s fraud prevention solution also keeps financial business operations in compliance with protection measures and digital safety requirements. With this, BioCatch’s behavioural biometrics solution enables financial institutions that use Azure to streamline fraud detection capabilities with global cloud scaling, keeping pace with the needs and demands of any cloud strategy financial institutions seek to deploy in Azure.

Business

One year until EMIR Refit: how can firms prepare?

Published

7 days ago

June 2, 2023

admin

Leo Labeis, CEO at REGnosys, discusses everything that financial institutions need to know about EMIR Refit and how they can prepare with Digital Regulatory Reporting (DRR)

There is now less than a year until the implementation date for the much-anticipated changes to the European Markets Infrastructure Regulation (EMIR). The amendments, which are set to go live on 29 April 2024, represent an important landmark in establishing a more globally harmonised approach to trade reporting.

Despite the fast-approaching deadline, concerns are growing around the industry’s preparedness, with a recent survey from Novatus Advisory finding that 40% of UK firms have no plans in place for the changes, for instance.

Much of the focus in 2022 was on implementation efforts for the rewrite of the Commodity Futures Trading Commission’s swaps reporting requirements (CFTC Rewrite), which went live on 5 December. Both the CFTC Rewrite and EMIR Refit are part of the same drive to standardise trade reporting globally. While EMIR Refit was originally anticipated to roll out first, implementation suffered from repeated delays to its technical specifications, in particular the new ISO 20022 format. The ISO 20022 mandate was eventually excluded from the first phase of the CFTC Rewrite, hence the earlier go-live date.

In parallel, the Digital Regulatory Reporting (DRR) programme has emerged as a key driving force in helping firms adapt to continually evolving reporting requirements. Having participated in the DRR build-up for their CFTC Rewrite preparations, how can firms leverage these efforts to comply with EMIR Refit in 2024?

The drive to standardise post-trade

Leo Labeis

To understand the new EMIR requirements, it is important to first look at the two main pillars in the global push to greater reporting harmonisation.

The first is the Committee on Payments & Market Infrastructures and International Organization of Securities Commission’s (CPMI-IOSCO) Critical Data Elements (CDE), which were first published in 2018 to work alongside other common standards including the Unique Product Identifier (UPI) and Unique Trade Identifier (UTI). These provide harmonised definitions of data elements for authorities to use when monitoring over the counter (OTC) derivative transactions, allowing for improved transparency on the contents of the transaction and greater scope for the interchange of data across jurisdictions.

The second is the mandating of ISO 20022 as the internationally recognised format for reporting transaction data. Historically, trade repositories required firms to submit data in a specific format that they determined, before applying their own data transformation for consumption by the regulators. The adoption of ISO 20022 under the new EMIR requirements changes that process by shifting the responsibility from trade repositories to the reporting firm, with the aim of enhancing data quality and consistency by reducing the need for data processing.

Preparing for the new requirements with DRR

DRR is an industry-wide initiative to enable firms to interpret and implement reporting rules consistently and cost-effectively. Under the current process, reporting firms create their own reporting solution, inevitably resulting in inconsistencies and duplication of costs. DRR changes this by allowing market participants to work together to develop a standardised interpretation of the regulation and store it in a digital, openly accessible format.

Importantly, firms which are using the rewritten CFTC rules which have been encoded in DRR will not have to build EMIR Refit from scratch. ISDA estimates that 70% of the requirements are identical across both regulations, meaning firms can leverage their work in each area and adopt a truly global strategy. DRR has already developed a library of CDE rules for the CFTC Rewrite, which can be directly re-applied to EMIR Refit. Even when those rules are applied differently between regimes, the jurisdiction-specific requirements can be encoded as variations on top of the existing CDE rule rather than in silo.

Notably the UPI, having been excluded from the first phase of the CFTC Rewrite roll-out, is mandated for the second phase due in January 2024. DRR will integrate this requirement, as well as others such as ISO 20022, and develop a common solution that can be applied across the CFTC Rewrite and EMIR Refit.

As firms begin their own build, the industry should work together in reviewing, testing and implementing the DRR model. Maintaining the commitment of all DRR participants will strengthen the community-driven approach to building this reporting ‘best practice’ and serve as a template for future collaborative efforts.

Planning for the long-term

Although the recent CFTC Rewrite and next year’s EMIR Refit are centre of focus for many firms, several more G20 regulatory reporting reforms are expected over the next few years. These include rewrites to the Australian Securities and Investments Commission (ASIC), Monetary Authority of Singapore (MAS) and Hong Kong Monetary Authority (HKMA) derivatives reporting regimes, amongst others.

Firms should therefore plan for the entire global regulatory reform agenda rather than prepare for each reform separately. Every dollar invested in reporting and data management will go further precisely because it is going to be spread across jurisdictions, easing budget constraints.

Looking ahead, financial institutions should establish a broad and long-term plan is to learn from their CFTC Rewrite preparation and how DRR can be positioned in their implementation. For example, firms should ask themselves which approach to testing and implementing DRR works best: via their own internal systems or through a third-party? Firms should review what worked well in their CFTC Rewrite implementation and apply successful methods to EMIR Refit. Doing so will enable firms to have a strong foundation for future updates in the years to come.