Computer Security in Financial Organisations

121 Pages·1991·7.072 MB·English

by  J. Essinger (Auth.)

Computer Security in
Financial Organizations
James Essinger
Elsevier Advanced Technology
Mayf ield House, 256 Banbury Road, Oxford ΟΧ2 7DH, UK
Copyright ©1990
Elsevier Science Publishers Ltd.
Mayfield House, 256 Banbury Road, Oxford OX2 7DH, England
All rights reserved. No part of this publication may be reproduced, stored in a
retrieval system, or transmitted in any form or by any means, electronic,
mechanical, photocopying, recording or otherwise, without prior permission of
the publishers.
No responsibility is assumed by the Publisher for any injury and/or damage to
persons or property as a matter of products liability, negligence or otherwise, of
from any use or operation of any methods, products, instructions or ideas con-
tained in the material herein.
British Library Cataloguing in Publication Data
Essinger, James
Computer security in financial organizations.
1. Computer systems. Security measures
I. Title
005.8
ISBN 0-946395-64-0
II
ABOUT THE AUTHOR
JAMES ESSINGER is one of Britain's leading financial technology jour-
nalists. He holds an M.A. in English Language and Literature from Lin-
coln College, Oxford and has worked in journalism since 1983. His
particular interest in financial technology stemmed from the global stock
market crash of 1987, when he had the idea of writing a consultancy report
investigating the role which computers may have played in the Crash. This
report, Computers in Financial Trading, was published by Elsevier Science
Publishers in 1988. James now writes on financial technology for a wide
range of publications in the US and UK. He is editor of the Elsevier bul-
letin Electronic Banking & Finance and technology editor of Equity Interna-
tional.
Ill
INTRODUCTION
Much has been written about computer security. Few days go by without
articles appearing in the media about computer security — or rather,
breaches in it. On just about every day of the year papers on the subject are
presented at learned conferences. Numerous organizations have found it
excellent business to sell hardware or software design to provide protec-
tion against deliberate breaches in computer security.
Other organizations sells consultancy advice about computer security.
Others even advise users on how they might obtain such consultancy ad-
vice. There is no doubt about it; computer security is big business.
Furthermore, computer security is particularly important to the financial
industry. As an industry that deals directly with money, the risks to finan-
cial organizations of loss from breaches in computer security are much
higher than in most other sectors. Money, the commodity in which the
financial industry deals, is seen as desirable by almost everybody. There
are, and probably always will be, people who are perfectly happy to ac-
quire money by illicit means. Far from seeing the increasing use of com-
puters by financial organizations as an obstacle to such illicit acquisition
of money, such people may well see increased deployment of computers
as presenting increased opportunities for this type of activity.
This report differs from most — if not all — previous publications about
computer security in two specific respects. First, it is written expressly for
financial organizations. Secondly, it aims to give strategic rather than tech-
nical information. The bulk of the report focuses on how financial or-
ganizations and suppliers of computer security are currently addressing,
in strategic terms, the problem of computer security.
Technical issues receive attention when appropriate, but this report is
primarily aimed at people who already have an understanding of the basic
technical computer security requirements of their organization. For
readers who do not have this information, I strongly recommend the El-
sevier publication 'The Computer Security Manager'. Other publications
that should prove of interest are listed in the bibliography.
This report aims to cover the territory that those publications do not cover.
Between September 1989 and March 1990 I travelled in the United
Kingdom and the United States, interviewing information technology
managers at financial institutions; suppliers of computer security
hardware and software; management consultants specializing in com-
puter security and other knowledgeable individuals, in order to build up
a picture of how the financial industry felt about computer security, what
it was doing about it now and what is was likely to be doing during the
1990s.
IV
Although, for obvious reasons, financial organizations were not prepared
to say very much about their own security requirements, most users were
more than happy to talk about their requirements in a more general sense.
I have deliberately chosen the term 'financial organizations' here in order
to include almost any business entity that has as its main profit stream any-
thing to do with the manipulation of money; whether providing a bank-
ing service; investing money on its own behalf or on behalf of clients;
trading any kind of financial instruments; providing network services to
financial institutions, or any other appropriate activity. It is reasonable to
adopt a wide definition of the term "financial organization' because, dis-
parate though the activities listed above undoubtedly are, their computer
requirements — and hence their computer security requirements — are
strikingly similar.
Since the objective here is to introduce the reader to increasingly detailed
insights, the contents of this report have been designed to move, in the
presentation of the material, from the general to the particular.
Chapter One, 'The Computer Security Problem' focuses generally on
financial institutions' computer secuirty needs, particularly from a
strategic point of view.
Chapter Two, 'The Computer Criminal at Work', gives information about
a wide range of computer crimes that have been detected within the finan-
cial industry, and provides some insights into the mind of the computer
criminal.
Chapter Three, 'Computer Security and the Law' looks at the legal aspects
of computer security for financial organizations, with particular reference
to current statutes in the United Kingdom and the United States, and to
the role of enforcement agencies in these two countries.
Chapter Four, Tixperts' Viewpoints' presents a wide variety of expert
views on computer security for financial organizations from a variety of
users, suppliers, consultants and other individuals.
Chapter Five, 'Preventing Breaches in Computer Security7 gives practical
information about how a financial organization can maximize the level of
its computer security.
The report concludes with a glossary, bibliography and index.
No report of this nature can be written without the active help and sup-
port of people who freely give their time and effort to provide research in-
formation. In this context I am very grateful to: Henry Beker (Zergo), Alan
V
Brill (Kroll Associates), Don Doll (Kroll Associates), John Earley (Jaguar
Communications), Paul Dorey (Morgan Grenfell), Chris Ennis (Coopers &
Lybrand Deloitte), Rob Farbrother (Nexus), Ralph Ferrara (Security
Microsystems), Gordon Fielding (Barclays Bank), Richard Hackworth
(Midland Bank), Bridget-Anne Hampden (Manufacturers Hanover), Stan
Kurzban (IBM), Keith Jackson, Bob Jacobson (International Security Tech-
nology), Marco Kapp (Coopers & Lybrand Deloitte), Mike Maunder (Com-
puter Associates), Mike Murphy (Coopers & Lybrand Deloittee), Brian
Parsons (Peat Marwick), Detective-Superintendent Don Randall (City of
London Police Fraud Department), Joseph Rosen (Rosen Kupperman As-
sociates), Harold Stokes (APACS), Al Weatherwax (First Boston), Mike Wil-
liams (CAP RS), Ken Wong (BIS Applied Systems).
Finally, four special acknowledgements. First, to Mark Tantam, who heads
the computer fraud investigation unit at Touche Ross, who gave me free
access to his huge legal library and his remarkable mind. Secondly, to Paul
Evans, my publications manager at Elsevier, who has provided extensive
editorial and moral support at every stage of this project. Thirdly, to Paul
Dorey of Morgan Grenfell, whose shrewd comments on an earlier draft of
this report helped me to improve it. Fourth, to Malcolm Smith, for his
methodical work on the index. And, last but most certainly not least, my
thanks are due to Sandy Wood, for putting up with me while I was writ-
ing this report.
James Essinger
Canterbury, England, September 1990
VI
The Computer Security
Problem
1
Prioritizing Computer Security
To come at once to the heart of the matter, is not the fimdamental problem
about computer security that it is difficult to get excited about it?
Such an opening statement might seem odd in a report which has the ex-
press aim of providing readers with original and topical information re-
lated to computer security; information which, while not necessarily
exciting, has to be at least interesting and informative.
But computer security is not inherently exciting, any more than any form
of security is inherently exciting. What is exciting are breaches in computer
security; whatever the nature of these breaches, they must by definition
represent the exception rather than the rule. The desired objective is a state
where no breaches exist; where no funds are lost; whether this loss is
caused by theft or fraud involving money or information, or whether it is
caused by computer systems breaking down.
Computer security cannot be inherently exciting because the fundamen-
tal objective of any security system is to provide a certain level of protec-
tion while allowing normal business activity to continue. This is true of
all industrial or commercial sectors, but particularly true within the finan-
cial industry, where financial organizations are constantly making great
demands on their computer systems both in terms of workload and
uninterrupted activity.
And certainly it is the normal business activity which matters. The nor-
mal business activity pays staff salaries, generates profits for the organiza-
tion, pays the rent or lease of the organization's premises and even pays
1
The Computer Security Problem
for the computer security system. As a financial organization's normal
business activity matters infinitely more than its computer security re-
quirements, it is only to be expected that computer security has often in
the past occupied an under servedly low priority at too many financial or-
ganizations. The organizations have simply been too busy making money
to care much about computer security.
A theme that cropped up very regularly in the interviews which are
recounted in detail in chapter four of this report was a complaint levied
by computer security suppliers at financial organizations. Financial or-
ganizations, the suppliers said, are insufficiently concerned about com-
puter security; do not devote enough 'resources' (a polite euphemism for
'money7, perhaps) to computer security; and do not realize how central to
their business activity computer security deserves to be. 'They only start
to care about computer security when something goes wrong/ was a fre-
quently-recurring suppliers' remark, with the added comment - accom-
panied by a certain revengeful glint in the suppliers' eyes, 'And by then
it might be too late/
Are suppliers of computer security technology and consultancy entitled
to be aggrieved about this? Probably not. However pious a commitment
users might make when faced with a memorandum from the Chairman
demanding a stricter approach to computer security, it is characteristic of
human nature to focus attention onto the immediate, directly important
activity rather than onto a precautionary measure. A key theme of this
report is that unlike, say advanced decision support software or advanced
branch automation software, computer security technology is not in fact
an extension of a financial organization's current computer functions, but
essentially a form of insurance. This being the case, and because insurance
is, like computer security, relatively uninteresting until something hap-
pens that makes the possession of the insurance a useful asset, is it not
surprising that computer security is often pushed to the bottom of a list
of a financial organization's priorities, or even completely neglected?
But of course the suppliers are right. The refusal, on the part of many finan-
cial organizations, to prioritize computer security will frequently persist
until something goes wrong, when all eyes will be on the computer
security system (or its absence) and when the manager who should have
recommended that some kind of system was installed may find himself
worrying about his continued receipt of his salary.
This report offers no solutions to the fundamental point that many factors
— including psychological ones — appear to work against financial or-
ganizations taking in-depth precautions against the security of their com-
puter system being breached. Unlike the suppliers and consultants
mentioned in this report, I have no strong personal vested interest in en-
couraging financial organizations to maximize their computer security
Computer Security in Financial Organizations
provisions. Certainly, it is difficult for an objective observer to view finan-
cial organizations' failure to do this as something that reflects badly on the
organization, but rather as something that reflects on human nature, and
on the need for pragmatism in business. Fortunately, it is possible to as-
sume with reasonable safety that anybody obtaining this report is likely
to be interested in computer security either from the user's standpoint, or
from the supplier's angle. In either case, it is also reasonable to assume
that the reader will already have concluded that computer security is a
matter which deserves his or her detailed attention.
Even where this is the case, however, the importance which users attach
to computer security differs considerably from user to user. The research
for this report suggested that, among financial organizations, a high level
of awareness of the benefits of computer security and the risks involved
in not prioritizing it has nonetheless led to a situation where many finan-
cial organizations only deploy computer security on the basis of shutting
the stable door after the horse has bolted.
One reason for this psychological inertia is detailed above. Another
reason, naturally enough, is that computer security costs money. Not only
that, but it is the unavoidable nature of this expense that it must come
straight out of a financial organization's bottom line'; that is, out of profits.
Understandably, suppliers have developed a range of arguments to con-
vince financial organizations to place a high priority on making provisions
for computer security. Broadly speaking, these arguments might be sum-
marized as the 'You can't afford not to do it' philosophy. Yes, suppliers
would agree; computer security costs money, but the outlay is small com-
pared with the potential loss if the computer security system (whatever
its nature) is not in place. In a computer security industry where different
levels of expenditure provide different levels of security (for example, a
telecommunications link that features both encryption and order-match-
ing is more secure than one that features only encryption, but this addi-
tional level of security adds considerably to the cost) it is also true, by
extension, that you get what you pay for. A large outlay on computer
security will, other things being equal, provide more security than a small
outlay. In this respect, computer security can be equated with any other
form of desirable but non-essential insurance.
Non-essential? Although the US Computer Security Act makes computer
security compulsory for US Government and quasi-Government institu-
tions, computer security provisions are not yet a statutory requirement for
financial organizations in either the UK or the US. However, a number of
US states have enacted legislation which makes it impossible for an in-
dustrial or commercial organization to bring a successful prosecution
against someone accused of computer-related crimes unless a recognized
computer security framework was in operation at the time of the alleged
3
Tlte Computer Security Problem
the existence of a computer security system, but it is at least possible that
future legislation may place a statutory burden on financial organizations
to implement workable computer security.
The legal aspects of computer security are discussed in detail in the next
chapter.
Computer Security Technology
All parties interviewed for this report agreed that the one single tech-
nological development of greatest significance to the computer security
business during recent years was the development of the microchip. By
permitting the construction of powerful computers that are extremely
small, the microchip has enabled large computer security systems to be-
come much smaller, less expensive, and therefore far more widely avail-
able, and also allowed the creation of new types of hardware (such as the
smart card) which were impossible or impracticable before.
It is reasonable to suppose that computer security technology has, as we
move into the 1990s, already reached such a peak that computer security
may no longer essentially be a technology-related problem. Many people
interviewed for this report did in fact say that technology was already able
to meet all of the computer security requirements that might be placed
upon it. It was certainly interesting to note that, of all the people inter-
viewed, not one complained that there were any computer security func-
tions which available technology could not meet.
The adequacy — by and large—of currently available technology to meet
financial organizations' computer security requirements is the principal
rationale behind the decision to make this report a strategic investigation
of computer security, rather than a technical treatise. Nonetheless, it
would be misleading to give the impression that the computer security
technology business has already reached its apotheosis and is now mere-
ly marking time. This is not at all the case, and it is a fact that some of the
most inventive and ingenious of the world's technological minds are cur-
rently earning an excellent living in the field of computer security tech-
nology However, with few exceptions, current research and development
in the field of computer security technology lies in refining existing tech-
nologies, rather than in developing entirely new ones. This aspect of the
computer security technology industry will be clear if, for example, we
contrast it with the sector of the financial technology industry that sup-
plies financial trading organizations with decision support systems. In
this latter area, the technology is still evolving, with artificial intelligence
(AI) becoming an increasingly important factor. AI may also prove to have