This document discusses information security perspectives from the banking industry. It begins with definitions of information security and banking. It then outlines best practices for IT security and auditing in banks as defined by the Federal Financial Institutions Examinations Council (FFIEC). The document describes common banking activities and the risks associated with them, emphasizing the importance of IT security. It also discusses trends in banking fraud and the changing profile of fraudsters in Uganda.

1. IS SECURITY
PERSPECTIVES FROM THE
BANKING INDUSTRY
AGUMA MPAIRWE
CISA,CIA,FCCA,B.A(HONS).

2. DEFINITIONS
 INFORMATION SECURITY - ‘THE PROCESS BY
WHICH AN ORGANISATION PROTECTS AND
SECURES ITS SYSTEMS, MEDIA AND
FACILITIES THAT PROCESS AND MAINTAIN
INFORMATION VITAL TO ITS OPERATIONS’ –
FFIEC
 BANKING – ‘THE BUSINESS ACTIVITY OF
ACCEPTING AND SAFEGUARDING THE
MONEY OWNED BY OTHER INDIVIDUALS AND
ENTITIES THEN LENDING OUT THIS MONEY IN
ORDER TO EARN A PROFIT’ - INVESTORWORDS

3. IT SECURITY AND AUDIT BEST
PRACTICES - BANKS
 FEDERAL FINANCIAL INSTITUTIONS
EXAMINATIONS COUNCIL (FFIEC).
 FFIEC IT EXAMINATION BOOKLETS
 FFIEC – US BASED ORGANISATION THAT
BRINGS TOGETHER ALL REGULATORS OF
THE US FINANCIAL SYSTEM

4. BANKING ACTIVITIES - GENERAL
 RECEIPT OF DEPOSITS (CASH,CHEQUE OR
ELECTRONIC)
 SAFEGUARDING OF DEPOSITS
 LENDING OF DEPOSITS TO OTHER PARTIES
 INVESTMENT AND TREASURY ACTIVITIES – PLACEMENT
OF FUNDS, FOREX TRADING, DERIVATIVES TRADING
 AVAILING FUNDS TO THOSE THAT WISH TO WITHDRAW
THEM
 GENERAL MANAGEMENT, ACCOUNTING AND
ADMINISTRATION
 ALL THE ABOVE WILL INVOLVE THE USE OF SOME
FORM OF IT SYSTEM OR OTHER
 ALL THE PROCESSES ABOVE PRESENT RISKS THAT
CAN BE EXPLOITED FOR PURPOSES OF FRAUD
 IT SECURITY IS PARAMOUNT

5. BANKING ACTIVITIES
 BANKS IN THE ‘TRUST’ BUSINESS
 LEGAL, PROFESSIONAL AND ETHICAL
OBLIGATION TO KEEP CUSTOMER INFORMATION
AND AFFAIRS CONFIDENTIAL –
 ‘A FINANCIAL INSTITUTION’S EARNINGS, AND
CAPITAL CAN BE ADVERSELY AFFECTED IF
INFORMATION BECOMES KNOWN TO
UNAUTHORISED PARTIES, IS ALTERED, OR IS NOT
AVAILABLE WHEN IT IS NEEDED’ – FFIEC
 ADVERSE PUBLICITY CAN LEAD TO
REPUTATIONAL RISK AND IN THE WORST CASE A
RUN ON A BANK.
 THE ‘C.I.A’ - CONFIDENTIALITY, INTEGRITY AND
AVAILABILITY OF INFORMATION PARAMOUNT

6. IT SECURITY OBJECTIVES
 CONFIDENTIALITY
 INTEGRITY
 AVAILABILITY
 ACCOUNTABILITY
 ASSURANCE
 NOTE - ACCOUNTABILITY AND INTEGRITY
REPRESENT ‘NON - REPUDIATION’ - FFIEC

7. CHANGING BANK FRAUD AND
FRAUSTER PROFILE -
UGANDA
 IN THE EARLY 2000’s AND BEFORE
 KEY FRAUDS WERE
 CHEQUE FRAUD, FORGED, ALTERED,
COUNTERFEIT.
 DEPOSIT SLIP FRAUD
 TYPICAL FRAUDSTER – MALE, 35 YEAR
OLD, LIMITED EDUCATION.

8. CHANGING BANK FRAUD AND
FRAUSTER PROFILE -
UGANDA
 MID- 2005 TO DATE
 ELECTRONIC FRAUD
 ATM FRAUD
 IN HOUSE BANK FRAUD – BY BANK EMPLOYEES
EITHER ALONE OR IN COLLUSION WITH
OUTSIDERS
 TYPICAL FRAUDSTER – MALE OR FEMALE,
BANK EMPLOYEE, TRUSTED INSIDER,
EDUCATED, UNIVERSITY GRADUATE, IT
LITERATE (NOT NECESSARILY EXPERT!),

9. ONLINE FRAUD -
IMPLICATIONS
 71% MORE CAUTIOUS WHEN SHOPPING
ONLINE
 67% MORE ATTENTIVE WHEN PROVIDING
FINANCIAL AND PERSONAL INFORMATION TO
WEBSITES
 28% ABANDON A PURCHANSE IF RE-
DIRECTED TO ANOTHER SITE TO PROVIDE
PAYMENT INFORMATION
 15% STOPPED SHOPPING ALTOGETHER AS A
RESULT OF ONLINE FRAUD CONCERNS –
 USA SURVEY

10. INFORMATION WEBSITES
 POTENTIAL LIABILITY AND CONSUMER VIOLATIONS
FOR INACCURATE OR INCOMPLETE INFORMATION
ABOUT PRODUCTS, SERVICES, AND PRICING
PRESENTED ON THE WEBSITE;
 POTENTIAL ACCESS TO CONFIDENTIAL FINANCIAL
INSTITUTION OR CUSTOMER INFORMATION IF THE
WEBSITE IS NOT PROPERLY ISOLATED FROM THE
FINANCIAL INSTITUTION'S INTERNAL NETWORK;
 POTENTIAL LIABILITY FOR SPREADING VIRUSES AND
OTHER MALICIOUS CODE TO COMPUTERS
COMMUNICATING WITH THE INSTITUTION'S WEBSITE;
AND
 NEGATIVE PUBLIC PERCEPTION IF THE INSTITUTION'S
ON-LINE SERVICES ARE DISRUPTED OR IF ITS WEBSITE
IS DEFACED OR OTHERWISE PRESENTS
INAPPROPRIATE OR OFFENSIVE MATERIAL. -FFIEC

11. TRANSACTIONAL WEBSITES
 SECURITY CONTROLS FOR SAFEGUARDING
CUSTOMER INFORMATION;
 AUTHENTICATION PROCESSES -VERIFY THE
IDENTITY OF NEW CUSTOMERS AND AUTHENTICATE
EXISTING CUSTOMERS WHO ACCESS E-BANKING
SERVICES;
 LIABILITY FOR UNAUTHORIZED TRANSACTIONS;
 LOSSES FROM FRAUD IF THE INSTITUTION FAILS TO
VERIFY THE IDENTITY OF INDIVIDUALS OR
BUSINESSES APPLYING FOR NEW ACCOUNTS OR
CREDIT ON-LINE - FFIEC

12. .
RETAIL SERVICES WHOLESALE SERVICES
ACCOUNT MANAGEMENT ACCOUNT MANAGEMENT
BILL PAYMENT AND
PRESENTMENT
CASH MANAGEMENT
NEW ACCOUNT OPENING SMALL BUSINESS LOAN
APPLICATIONS, APPROVALS, OR
ADVANCES
CONSUMER WIRE
TRANSFERS
INVESTMENT/BROKERAGE
SERVICES
COMMERCIAL WIRE TRANSFERS
LOAN APPLICATION AND
APPROVAL
BUSINESS-TO-BUSINESS PAYMENTS
ACCOUNT AGGREGATION
EMPLOYEE BENEFITS/PENSION
ADMINISTRATION

13. TRANSACTIONAL WEBSITES
 POSSIBLE VIOLATIONS OF LAWS OR
REGULATIONS PERTAINING TO CONSUMER
PRIVACY, ANTI-MONEY LAUNDERING, ANTI-
TERRORISM, OR THE CONTENT, TIMING, OR
DELIVERY OF REQUIRED CONSUMER
DISCLOSURES; AND
 NEGATIVE PUBLIC PERCEPTION, CUSTOMER
DISSATISFACTION, AND POTENTIAL LIABILITY
RESULTING FROM FAILURE TO PROCESS THIRD-
PARTY PAYMENTS AS DIRECTED OR WITHIN
SPECIFIED TIME FRAMES, LACK OF AVAILABILITY
OF ON-LINE SERVICES, OR UNAUTHORIZED
ACCESS TO CONFIDENTIAL CUSTOMER
INFORMATION DURING TRANSMISSION OR
STORAGE. - FFIEC

14. SOURCE :FFIEC

15. ATM/CARD- FRAUD
 WHO PICKS UP THE COST IF YOUR CARD
IS MISUSED, YOU OR YOUR BANK?
 SOUTH AFRICA - TOTAL VALUE OF ONLINE
TRANSACTIONS – USD $285 MILLION
 SOUTH AFRICA - 2009 TOTAL LOSSES TO
BANKING INDUSTRY DUE TO LOST AND
STOLEN CARDS – USD 13MILLION –
PERSONAL FINANCE

16. ATM/DEBIT/CREDIT CARD –
RISKS
 CARD INFORMATION HELD IN MAGNETIC STRIPE
INCLUDING PRIMARY ACCOUNT NUMBER, EXPIRY
DATE,
 CARD CAN BE CLONED, IF DETAILS ON MAGNETIC
STRIPE CAN BE COPIED USING SKIMMING
DEVICES
 CARD CAN BE STOLEN/LOST
 USED FOR ‘CARDHOLDER NOT PRESENT’
TRANSACTIONS – OVER PHONE OR ONLINE
 PIN CAN BE OBTAINED USING HIDDEN CAMERAS
IN ATM LOCATION OR CCTV CAMERAS IN VIEW OF
THE KEYPAD!

17. CARD SKIMMING
 INVOLVES THE USE OF DEVICES THAT READ CARD
DETAILS CONTAINED IN THE MAGNETIC STRIP OF
THE CARD
 CAB BE PLACED IN THE ATM CARD SLOT
 OR CAN BE HAND HELD (POCKET)
 RESTAURANTS HIGH RISK!
 BEGAN TO OBSERVE COMPLAINTS IN UGANDA
 DISCUSSION AT BANKERS ASSOSCIATION FRAUD
AND FORGERIES SUB-COMMITTEE
 CASES OF FRAUD REPORTED BY MEMBER BANKS
 CUSTOMERS USUALLY HAD TRAVELLED ABROAD AT
SOME POINT IN TIME
 SOUTH AFRICA – MENTIONED AS A DESINATION
VISITED IN SOME CASES

18. CARD SKIMMING
 ABSA 177 ARRESTS, 26 SKIMMING
DEVICES CAPTURED IN 2011 - PERSONAL
FINANCE
 COST TO THE US - $60 MILLION PER
YEAR! – CSO ONLINE

19. ATM RISK MITIGANTS
 CHIP AND PIN BASED CARDS.
 AWARENESS TRAINING FOR CUSTOMERS!!
 PHYSICAL SECURITY
 CAUTION AT ATM SITES – WATCH OUT FOR
CAMERA’S, SKIMMING DEVICES
 SHIELD ENTRY OF PIN AT ATM WITH
HAND/WALLET
 REGULAR CHECKING OF CARD BALANCES
 MERCHANT TRAINING

20. INTERNAL ACCOUNT
TRANSFERS
 INCRESINGLY COMMON FRAUD IN INDUSTRY
 INVOLVES UNAUTHORISED ‘CREATION’ OF
DEPOSITS
 DEBIT ‘OVERCROWDED’ ACCOUNT WITH
SEVERAL ITEMS DIFFICULT TO TRACE E.G
SUSPENSE ACCOUNT
 CREDIT IS MADE TO CUSTOMER ACCOUNT
 FUNDS ARE WITHDRAWN!

21. POSSIBLE SOLUTIONS
 COMBINATION OF ROLE BASED ACCESS AND
LEAST PRIVILEDGE RESTRICTIONS CAN BE
ENFORCED
 RESTRICT TELLER OR OPERATIONS STAFF
ABILITY TO POST TRANSACTIONS TO
ADMINISTRATIVE ACCOUNTS E.G FIXED ASSET
ACCCOUNTS
 RESTRIC FINANCE DEPARTMENT STAFF
ABILITY TO POST TRANSACTIONS DIRECTLY
TO CUSTOMER ACCOUNTS
 G.L AUDIT REVIEW –PERIODIC
 CLEAR TIMELINES FOR CLEARING OFF ITEMS
IN SUSPENSE, TRANSIT AND CLEARING
ACCOUNTS

22. IT PROJECT MANAGEMENT
RISKS
 INADEQUATE SECURITY FEATURES ENFORCED
DURING IMPLEMENTATION OF IT APPLICATION
SYSTEMS
 OBSERVED IN BANKING INDUSTRY IN THE PAST
 MUST PROVIDE FOR:
 GENERAL ACCESS CONTROLS
 IDENTIFICATION AND AUTHENTICATION CONTROLS
 AUDIT TRAIL
 COMMUNICATION CONTROLS – KELLY KIM 2008
 DATA MIGRATION CONTROLS – IMPORTANT
 TAKE ACCOUNT OF FACT THAT BANK SYSTEMS MAY
NEED TO BE ONLINE 24/7/365

23. PROJECT MANAGEMENT
 PROJECT MANAGEMENT –
 BASELINE CONTROLS IMPLEMENTED
 IS AUDIT INVOLVEMENT
 POST IMPLEMENTATION REVIEW
 REGULATORY CERTIFICATION PRE -
IMPLEMENTATION

24. TREASURY
 HIGH RISK AREA
 BANK IS INVESTING OR TRADING
 MONEY MARKET PRODUCTS
 FOREIGN CURRENCY (FX)
 DERIVATIVES
 TRANSACTION SIZES MAY BE VERY LARGE
 POTENTIAL FOR PROFIT/LOSSES MAY BE
VERY LARGE DEPENDING ON MARKET
CONDITIONS

25. TREASURY RISK
 APPROVAL TO COMMIT THE BANK GIVEN TO
TRADERS BEFORE TRANSACTION THROUGH THE
USE OF VARIOUS LIMITS
 MONITORING OF COMPLIANCE WITH LIMITS IS
CRITICAL TO RISK MANAGEMENT IN TRASURY
 SEGREGATION OF DUTIES IS ALSO CRITICAL (
FRONT OFFICE, MIDDLE OFFICE, BACK OFFICE)
 TRADERS MUST NO HAVE ACCESS TO RATE
REVALUATION SYSTEMS – COULD HIDE LOSSES
 TRADERS SHOULD NOT HAVE ACCESS TO
CONFIRMATION AND SETTLEMENT SYSTEMS –
COULD HIDE TRADES AND LOSSES
 IT SECURITY DESIGN IMPORTANT TO DEAL WITH
THESE ISSUES

26. TREASURY –KEY BANK
LOSSES/FRAUDS
 2002 TRADER JOHN RUSNACK - £485 MILLION
LOSS TO ALLIED IRISH BANK – TAMPERED WITH
REUTERS RATES FEED
 2008 TRADER JEROME KERVIEL – $ 7 BILLION
LOSS – HAD PREVIOUSLY WORKED IN BACK
OFFICE, HID TRANSACTIONS (TRADES),
FALSIFIED E-MAIL, - FVTER
 1995 – trader NICK LEESON – HID £865M LOSSES,
BROUGHT DOWN BARINGS BANK…..INTEGRATED IT
SYSTEMS COULD HAVE PREVENTED BANK
COLLAPSE - COMPUTERWEEKLY

27. COSO –CONTROL MODEL
MONITORING
INFORMATION AND COMMUNICATION
CONTROL PROCEDURES
RISK ASSESSMENT
CONTROL ENVIRONMENT

28. IT GOVERNANCE
 ‘FINANCIAL INSTITUTIONS SHOULD
IMPLEMENT AN ONGOING SECURITY
PROCESS AND INSTITUTE APPROPRIATE
GOVERNANCE FOR THE SECURITY
FUNCTION, ASSIGNING CLEAR AND
APPROPRIATE ROLES AND
RESPONSIBILITIES TO THE BOARD OF
DIRECTORS, MANAGEMENT AND
EMPLOYEES’ - FFIEC

29. IS SECURITY STRATEGY
 FINANCIAL INSTITUTIONS SHOULD DEVELOP A
STRATEGY THAT DEFINES CONTROL OBJECTIVES
AND ESTABLISHES AN IMPLEMENTATION PLAN.
THE SECURITY STRATEGY SHOULD INCLUDE
 APPROPRIATE CONSIDERATION OF PREVENTION,
DETECTION, AND RESPONSE MECHANISMS,
 IMPLEMENTATION OF THE LEAST PERMISSIONS
AND LEAST PRIVILEGES CONCEPTS,
 LAYERED CONTROLS THAT ESTABLISH MULTIPLE
CONTROL POINTS BETWEEN THREATS AND
ORGANIZATION ASSETS, AND
 POLICIES THAT GUIDE OFFICERS AND
EMPLOYEES IN IMPLEMENTING THE SECURITY
PROGRAM. -FFIEC

30. IT RISK ASSESSMENT
 GATHERS DATA REGARDING THE INFORMATION AND
TECHNOLOGY ASSETS OF THE ORGANIZATION,
THREATS TO THOSE ASSETS, VULNERABILITIES,
EXISTING SECURITY CONTROLS AND PROCESSES,
AND THE CURRENT SECURITY STANDARDS AND
REQUIREMENTS;
 ANALYZES THE PROBABILITY AND IMPACT
ASSOCIATED WITH THE KNOWN THREATS AND
VULNERABILITIES TO THEIR ASSETS; AND
 PRIORITIZES THE RISKS PRESENT DUE TO THREATS
AND VULNERABILITIES TO DETERMINE THE
APPROPRIATE LEVEL OF TRAINING, CONTROLS, AND
ASSURANCE NECESSARY FOR EFFECTIVE
MITIGATION. - FFIEC

31. IT RISK ASSESSMENT
 BOTH TECHNICAL AND NON-TECHNICAL
INFORMATION SHOULD BE GATHERED.
 TECHNICAL INFORMATION –
 NETWORK MAPS DETAILING INTERNAL AND
EXTERNAL CONNECTIVITY;
 HARDWARE AND SOFTWARE INVENTORIES;
 DATABASES AND FILES THAT CONTAIN CRITICAL
AND/OR CONFIDENTIAL INFORMATION;
 PROCESSING ARRANGEMENTS AND INTERFACES
WITH EXTERNAL ENTITIES;
 HARDWARE AND SOFTWARE CONFIGURATIONS;
 POLICIES, STANDARDS, AND PROCEDURES FOR THE
OPERATION, MAINTENANCE, UPGRADING, AND
MONITORING OF TECHNICAL SYSTEMS.- FFIEC

32. IT RISK ASSESSMENT
 NON-TECHNICAL INFORMATION
 POLICIES, STANDARDS, AND PROCEDURES ADDRESSING
PHYSICAL SECURITY (INCLUDING FACILITIES AS WELL AS
INFORMATION ASSETS THAT INCLUDE LOAN
DOCUMENTATION, DEPOSIT RECORDS AND SIGNATURE
CARDS, AND KEY AND ACCESS CODE LISTS),
 PERSONNEL SECURITY (INCLUDING HIRING BACKGROUND
CHECKS AND BEHAVIOUR MONITORING),
 VENDOR CONTRACTS, PERSONNEL SECURITY TRAINING
AND EXPERTISE, AND
 INSURANCE COVERAGE.
 ADDITIONALLY, INFORMATION REGARDING CONTROL
EFFECTIVENESS SHOULD BE GATHERED. TYPICALLY, THAT
INFORMATION COMES FROM SECURITY MONITORING,
INCLUDING SELF-ASSESSMENTS, METRICS, AND
INDEPENDENT TESTS.
FFIEC

33. IT SYSTEMS ASSESSMENT
 ‘SOME SYSTEMS AND DATA STORES MAY
NOT BE READILY APPARENT. FOR
EXAMPLE, BACKUP TAPES, PORTABLE
COMPUTERS, PERSONAL DIGITAL
ASSISTANTS, MEDIA SUCH AS COMPACT
DISKS, MICRO DRIVES, AND DISKETTES,
AND MEDIA USED IN SOFTWARE
DEVELOPMENT AND TESTING SHOULD
BE CONSIDERED’. - FFIEC

34. IT THREATS AND
VULNERABILITIES
 THREATS -EVENTS THAT COULD CAUSE HARM TO
THE CONFIDENTIALITY, INTEGRITY, OR
AVAILABILITY OF INFORMATION OR INFORMATION
SYSTEMS.
 EXPLOITING A VULNERABILITY TO CAUSE HARM
THROUGH THE UNAUTHORIZED DISCLOSURE,
MISUSE, ALTERATION, OR DESTRUCTION OF
INFORMATION OR INFORMATION SYSTEMS.
 INTERNAL (MALICIOUS OR INCOMPETENT
EMPLOYEES, CONTRACTORS, SERVICE
PROVIDERS, AND FORMER INSIDERS)
 EXTERNAL (CRIMINALS, RECREATIONAL
HACKERS, COMPETITORS, AND TERRORISTS). -
FFIEC

35. IT THREATS AND
VULNERABILITIES
 VULNERABILITIES - WEAKNESSES IN A SYSTEM,
OR CONTROL GAPS THAT, IF EXPLOITED, COULD
RESULT IN THE UNAUTHORIZED DISCLOSURE,
MISUSE, ALTERATION, OR DESTRUCTION OF
INFORMATION OR INFORMATION SYSTEMS.
 VULNERABILITIES ARE GENERALLY GROUPED
INTO TWO TYPES: KNOWN AND EXPECTED. - FFIEC

36. VULNERABILITIES
 KNOWN VULNERABILITIES - DISCOVERED BY TESTING
OR OTHER REVIEWS OF THE ENVIRONMENT,
KNOWLEDGE OF POLICY WEAKNESSES, KNOWLEDGE
OF INADEQUATE IMPLEMENTATIONS, AND KNOWLEDGE
OF PERSONNEL ISSUES. .
 EXPECTED VULNERABILITIES - THOSE THAT CAN
REASONABLY BE ANTICIPATED TO ARISE IN THE
FUTURE. EXAMPLES
 UNPATCHED SOFTWARE,
 NEW AND UNIQUE ATTACK METHODOLOGIES THAT
BYPASS CURRENT CONTROLS,
 EMPLOYEE AND CONTRACTOR FAILURES TO PERFORM
SECURITY DUTIES SATISFACTORILY,
 PERSONNEL TURNOVER - FFIEC

37. IT SECURITY POLICY
 KEY ACTIONS THAT CONTRIBUTE TO THE SUCCESS OF
A SECURITY POLICY ARE
 IMPLEMENTING THROUGH ORDINARY MEANS, SUCH AS
SYSTEM ADMINISTRATION PROCEDURES AND
ACCEPTABLE-USE POLICIES;
 ENFORCING POLICY THROUGH SECURITY TOOLS AND
SANCTIONS;
 DELINEATING THE AREAS OF RESPONSIBILITY FOR
USERS, ADMINISTRATORS, AND MANAGERS;
 COMMUNICATING IN A CLEAR, UNDERSTANDABLE
MANNER TO ALL CONCERNED;
 OBTAINING EMPLOYEE CERTIFICATION THAT THEY
HAVE READ AND UNDERSTOOD THE POLICY;
 PROVIDING FLEXIBILITY TO ADDRESS CHANGES IN THE
ENVIRONMENT; AND
 CONDUCTING ANNUALLY A REVIEW AND APPROVAL BY
THE BOARD OF DIRECTORS. - FFIEC

38. SECURITY DOMAINS
 A SECURITY DOMAIN IS A PART OF THE SYSTEM WITH ITS
OWN POLICIES AND CONTROL MECHANISMS.
 SECURITY DOMAINS FOR A NETWORK ARE TYPICALLY
CONSTRUCTED FROM ROUTING CONTROLS AND
DIRECTORIES.
 DOMAINS CONSTRUCTED FROM ROUTING CONTROLS MAY
BE BOUNDED BY NETWORK PERIMETERS WITH PERIMETER
CONTROLS.
 THE PERIMETERS SEPARATE WHAT IS NOT TRUSTED FROM
WHAT MAY BE TRUSTWORTHY. THE PERIMETERS SERVE
AS WELL-DEFINED TRANSITION POINTS BETWEEN TRUST
AREAS WHERE POLICY ENFORCEMENT AND MONITORING
TAKES PLACE.
 AN EXAMPLE OF SUCH A DOMAIN IS A DEMILITARIZED ZONE
(DMZ), BOUNDED BY A PERIMETER THAT CONTROLS
ACCESS FROM OUTSIDE AND INSIDE THE INSTITUTION.
 DOMAINS CONSTRUCTED FROM DIRECTORIES MAY LIMIT
ACCESS TO NETWORK RESOURCES AND APPLICATIONS
BASED ON ROLE OR FUNCTION. - FFIEC

39. DEFENSE IN DEPTH
 FINANCIAL INSTITUTIONS SHOULD DESIGN MULTIPLE LAYERS
OF SECURITY CONTROLS
 ESTABLISH SEVERAL LINES OF DEFENSE BETWEEN THE
ATTACKER AND THE ASSET BEING ATTACKED.
 AN INTERNET SECURITY - A PACKET FILTERING ROUTER WITH
STRICT ACCESS CONTROL RULES, IN FRONT OF
 AN APPLICATION LEVEL FIREWALL, IN FRONT OF
 WEB SERVERS, IN FRONT OF
 A TRANSACTIONAL SERVER, IN FRONT OF
 A DATABASE SERVER, WITH INTRUSION DETECTION SYSTEMS
LOCATED AT VARIOUS POINTS BETWEEN THE SERVERS AND
ON CERTAIN HOSTS.
 THE LAYERS SHOULD BE AT MULTIPLE CONTROL POINTS
THROUGHOUT THE COMMUNICATION AND TRANSACTIONAL
FLOW AND SHOULD INCLUDE BOTH SYSTEMS AND MANUAL
PROCESSES. TO SUCCESSFULLY ATTACK AN ASSET, EACH
LAYER MUST BE PENETRATED. WITH EACH PENETRATION,
THE PROBABILITY OF DETECTING THE ATTACKER INCREASES.
- FFIEC

40. NETWORK SECURITY
 FINANCIAL INSTITUTIONS SHOULD SECURE ACCESS TO
THEIR COMPUTER NETWORKS THROUGH MULTIPLE
LAYERS OF ACCESS CONTROLS TO PROTECT AGAINST
UNAUTHORIZED ACCESS. INSTITUTIONS SHOULD
 GROUP NETWORK SERVERS, APPLICATIONS, DATA,
AND USERS INTO SECURITY DOMAINS (E.G.,
UNTRUSTED EXTERNAL NETWORKS, EXTERNAL
SERVICE PROVIDERS, OR VARIOUS INTERNAL USER
SYSTEMS);
 ESTABLISH APPROPRIATE ACCESS REQUIREMENTS
WITHIN AND BETWEEN EACH SECURITY DOMAIN;
 IMPLEMENT APPROPRIATE TECHNOLOGICAL
CONTROLS TO MEET THOSE ACCESS REQUIREMENTS
CONSISTENTLY; AND
 MONITOR CROSS-DOMAIN ACCESS FOR SECURITY
POLICY VIOLATIONS AND ANOMALOUS ACTIVITY. -
FFIEC

41. OPERATING SYSTEM
SECURITY
 FINANCIAL INSTITUTIONS SHOULD SECURE ACCESS TO
THE OPERATING SYSTEMS OF ALL SYSTEM
COMPONENTS BY
 SECURING ACCESS TO SYSTEM UTILITIES,
 RESTRICTING AND MONITORING PRIVILEGED ACCESS,
 LOGGING AND MONITORING USER OR PROGRAM ACCESS
TO SENSITIVE RESOURCES AND ALERTING ON SECURITY
EVENTS,
 UPDATING THE OPERATING SYSTEMS WITH SECURITY
PATCHES, AND
 SECURING THE DEVICES THAT CAN ACCESS THE
OPERATING SYSTEM THROUGH PHYSICAL AND LOGICAL
MEANS. -FFIEC

42. APPLICATION SECURITY
 FINANCIAL INSTITUTIONS SHOULD CONTROL
ACCESS TO APPLICATIONS BY
 USING AUTHENTICATION AND AUTHORIZATION
CONTROLS APPROPRIATELY ROBUST FOR THE
RISK OF THE APPLICATION,
 MONITORING ACCESS RIGHTS TO ENSURE THEY
ARE THE MINIMUM REQUIRED FOR THE USER'S
CURRENT BUSINESS NEEDS,
 USING TIME-OF-DAY LIMITATIONS ON ACCESS AS
APPROPRIATE,
 LOGGING ACCESS AND SECURITY EVENTS, AND
 USING SOFTWARE THAT ENABLES RAPID
ANALYSIS OF USER ACTIVITIES. - FFIEC

43. REMOTE ACCESS -CONTROLS
 FINANCIAL INSTITUTIONS SHOULD SECURE REMOTE
ACCESS TO AND FROM THEIR SYSTEMS BY
 DISABLING REMOTE COMMUNICATIONS IF NO BUSINESS
NEED EXISTS,
 TIGHTLY CONTROLLING ACCESS THROUGH MANAGEMENT
APPROVALS AND SUBSEQUENT AUDITS,
 IMPLEMENTING ROBUST CONTROLS OVER
CONFIGURATIONS AT BOTH ENDS OF THE REMOTE
CONNECTION TO PREVENT POTENTIAL MALICIOUS USE,
 LOGGING AND MONITORING ALL REMOTE ACCESS
COMMUNICATIONS,
 SECURING REMOTE ACCESS DEVICES, AND
 USING STRONG AUTHENTICATION AND ENCRYPTION TO
SECURE COMMUNICATIONS - FFIEC

44. PHYSICAL ACCESS -
CONTROLS
 FINANCIAL INSTITUTIONS SHOULD DEFINE
PHYSICAL SECURITY ZONES AND IMPLEMENT
APPROPRIATE PREVENTATIVE AND DETECTIVE
CONTROLS IN EACH ZONE TO PROTECT AGAINST
THE RISKS OF
 PHYSICAL PENETRATION BY MALICIOUS OR
UNAUTHORIZED PEOPLE,
 DAMAGE FROM ENVIRONMENTAL
CONTAMINANTS, AND
 ELECTRONIC PENETRATION THROUGH ACTIVE
OR PASSIVE ELECTRONIC EMISSIONS. - FFIEC

45. ENCRYPTION CONTROLS
 FINANCIAL INSTITUTIONS SHOULD EMPLOY
ENCRYPTION TO MITIGATE THE RISK OF
DISCLOSURE OR ALTERATION OF SENSITIVE
INFORMATION IN STORAGE AND TRANSIT.
 ENCRYPTION IMPLEMENTATIONS SHOULD
INCLUDE ENCRYPTION STRENGTH SUFFICIENT
TO PROTECT THE INFORMATION FROM
DISCLOSURE UNTIL SUCH TIME AS DISCLOSURE
POSES NO MATERIAL RISK,
 EFFECTIVE KEY MANAGEMENT PRACTICES,
 ROBUST RELIABILITY, AND
 APPROPRIATE PROTECTION OF THE ENCRYPTED
COMMUNICATION'S ENDPOINTS - FFIEC

46. ENCRYPTION KEY
MANAGEMENT
 GENERATING KEYS FOR DIFFERENT CRYPTOGRAPHIC
SYSTEMS AND DIFFERENT APPLICATIONS;
 GENERATING AND OBTAINING PUBLIC KEYS;
 DISTRIBUTING KEYS TO INTENDED USERS, INCLUDING HOW
KEYS SHOULD BE ACTIVATED WHEN RECEIVED;
 STORING KEYS, INCLUDING HOW AUTHORIZED USERS OBTAIN
ACCESS TO KEYS;
 CHANGING OR UPDATING KEYS, INCLUDING RULES ON WHEN
KEYS SHOULD BE CHANGED AND HOW THIS WILL BE DONE;
 DEALING WITH COMPROMISED KEYS;
 REVOKING KEYS AND SPECIFYING HOW KEYS SHOULD BE
WITHDRAWN OR DEACTIVATED;
 RECOVERING KEYS THAT ARE LOST OR CORRUPTED AS PART
OF BUSINESS CONTINUITY MANAGEMENT;
 ARCHIVING KEYS;
 DESTROYING KEYS -FFIEC

47. MONITORING
 MONITORING NETWORK AND HOST ACTIVITY TO IDENTIFY
POLICY VIOLATIONS AND ANOMALOUS BEHAVIOR;
 MONITORING HOST AND NETWORK CONDITION TO
IDENTIFY UNAUTHORIZED CONFIGURATION AND OTHER
CONDITIONS WHICH INCREASE THE RISK OF INTRUSION
OR OTHER SECURITY EVENTS;
 ANALYZING THE RESULTS OF MONITORING TO
ACCURATELY AND QUICKLY IDENTIFY, CLASSIFY,
ESCALATE, REPORT, AND GUIDE RESPONSES TO
SECURITY EVENTS; AND
 RESPONDING TO INTRUSIONS AND OTHER SECURITY
EVENTS AND WEAKNESSES TO APPROPRIATELY MITIGATE
THE RISK TO THE INSTITUTION AND ITS CUSTOMERS, AND
TO RESTORE THE INSTITUTION'S SYSTEMS.
 MONITORING SHOULD, COMMENSURATE WITH THE RISK,
IDENTIFY CONTROL FAILURES BEFORE A SECURITY
INCIDENT OCCURS, DETECT AN INTRUSION IN SUFFICIENT
TIME TO ENABLE AN EFFECTIVE AND TIMELY RESPONSE,
 SUPPORT POST-EVENT FORENSICS ACTIVITIES. - FFIEC

48. FUTURE TRENDS/THREATS
 DEPEND ON TECHNOLOGY TRENDS
 TELECOMS AND BANKING CONVERGENCE
 RISKS IN MOBILE MONEY INDUSTRY
 CLOUD COMPUTING
 MOBILE COMPUTING AND WIRELESS
COMPUTING THREATS
 EASE OF ACCESS TO INTERNET AND TOOLS TO
COMMIT FRAUD
 FASTER SPEEDS FOR INTERNET ACCESS IN
EAST AFRICA
 GREATER OUTSOURCING?
 NEW IT SAVVY GENERATION?

49. SOLUTIONS
 IT AWARENESS
 USER AND CUSTOMER TRAINING
 STAFF SCREEENING
 ETHICAL EMPHASIS
 EMBEDDING STRONG CONTROL AND RISK
CULTURE IN BANKS
 SYSTEMS CERTIFICATION BY REGULATORS
BEFORE DEPLOYMENT
 STRENGHTEN IT CONTROL, SECURITY, AUDIT
PROFESSION AND TRAIN MORE PROFESSIONALS
 INCREASE CEO AND BOARD AWARENESS

50. OTHER BEST PRACTICES
 ISO 17799 : CODE OF PRACTIVE FOR
INFORMATION SECURITY MANAGEMENT
 BS 7799: SPECIFICATION FOR
INFORMATION SECURITY MANAGEMENT
SYSTEMS
 COBIT

51. .
 QUESTIONS?

52. REFERENCES
 http://ithandbook.ffiec.gov/it-booklets.aspx
 http://www.securitymanagement.com/article/atm-fraud-trends-europe-
006362
 http://www.bizreport.com/2009/03/consumers_in_the_us_are.html#
 http://www.csoonline.com/article/555863/atm-skimming-how-to-
recognize-card-fraud
 http://iss.gwu.edu/merlin-
cgi/p/downloadFile/d/21440/n/off/other/1/name/BaselineSecurityRequire
mentsandControls-Techn/
 http://fvter.wordpress.com/2008/01/30/kervielsociete-generale-
information-security-insider-threat/
 http://www.computerweekly.com/Articles/2009/10/27/238308/Podcast-
interview-Nick-Leeson-says-Integrated-IT-could-have-prevented-
Barings.htm