Understanding Cybersecurity Management in FinTech: Challenges, Strategies, and Trends (Future of Business and Finance)

193 Pages·2021·4.907 MB·English

by  Gurdip Kaur, Ziba Habibi Lashkari, Arash Habibi Lashkari

Future of Business and Finance
Gurdip Kaur
Ziba Habibi Lashkari
Arash Habibi Lashkari
Understanding
Cybersecurity
Management
in FinTech
Challenges, Strategies, and Trends
Future of Business and Finance
TheFutureofBusinessandFinancebookseriesfeaturesprofessionalworksaimedat
defining,describingandchartingthefuturetrendsinthesefields.Thefocusismainly
onstrategicdirections,technologicaladvances,challengesandsolutionswhichmay
affect the way we do business tomorrow, including the future of sustainability and
governance practices. Mainly written by practitioners, consultants and academic
thinkers, the books are intended to spark and inform further discussions and
developments.
Moreinformationaboutthisseriesathttp://www.springer.com/series/16360
(cid:129) (cid:129)
Gurdip Kaur Ziba Habibi Lashkari
Arash Habibi Lashkari
Understanding
Cybersecurity
Management in FinTech
Challenges, Strategies, and Trends
GurdipKaur ZibaHabibiLashkari
CanadianInstituteforCybersecurity UniversidadPolitécnicaDeMadrid
(CIC),FacultyofComputerScience EscuelaTécnicaSuperiordeIngenieros
UniversityofNewBrunswick Informáticos
Fredericton,NB,Canada Madrid,Spain
ArashHabibiLashkari
CanadianInstituteforCybersecurity
(CIC),FacultyofComputerScience
UniversityofNewBrunswick
Fredericton,NB,Canada
ISSN2662-2467 ISSN2662-2475 (electronic)
FutureofBusinessandFinance
ISBN978-3-030-79914-4 ISBN978-3-030-79915-1 (eBook)
https://doi.org/10.1007/978-3-030-79915-1
#TheEditor(s)(ifapplicable)andTheAuthor(s),underexclusivelicensetoSpringerNatureSwitzerland
AG2021
Thisworkissubjecttocopyright.AllrightsaresolelyandexclusivelylicensedbythePublisher,whether
thewholeorpartofthematerialisconcerned,specificallytherightsoftranslation,reprinting,reuseof
illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and
transmission or information storage and retrieval, electronic adaptation, computer software, or by
similarordissimilarmethodologynowknownorhereafterdeveloped.
Theuseofgeneraldescriptivenames,registerednames,trademarks,servicemarks,etc.inthispublication
doesnotimply,evenintheabsenceofaspecificstatement,thatsuchnamesareexemptfromtherelevant
protectivelawsandregulationsandthereforefreeforgeneraluse.
The publisher, the authors, and the editorsare safeto assume that the adviceand informationin this
bookarebelievedtobetrueandaccurateatthedateofpublication.Neitherthepublishernortheauthorsor
theeditorsgiveawarranty,expressedorimplied,withrespecttothematerialcontainedhereinorforany
errorsoromissionsthatmayhavebeenmade.Thepublisherremainsneutralwithregardtojurisdictional
claimsinpublishedmapsandinstitutionalaffiliations.
ThisSpringerimprintispublishedbytheregisteredcompanySpringerNatureSwitzerlandAG.
Theregisteredcompanyaddressis:Gewerbestrasse11,6330Cham,Switzerland
Preface
Ifyouhaveeverpaidforanythingonline,chancesareyouhavedealtwithsomeform
of FinTech, or financial technology: the space where technological innovation and
thefinancialservicesindustryintersect.Asabroadterm,“FinTech”encompassesa
wide array of technological strategies, many of which have either improved the
functionalityofexistingfinancialproductsandservicesorenabledthedevelopment
of novel technological solutions for the financial sector. In an era of rapid techno-
logical change, it has become imminently necessary for banks and other financial
institutions to categorically rethink and revitalize their fundamental operational
structures,particularlyincludingthosewhichfallunderthecategorizationoffintech.
OneofthemostcommonconcernsregardingrapidadoptionofFinTechisrooted
in the fear that such services may increase the risk of privacy and data security
breaches for organizational entities as well as individual consumers. Undoubtedly,
anyexternalexploitationofthoseriskscouldhavethepotentialtobedevastatingto
the industry. With the rapid growth of digital platforms, the fintech industry has
become more vulnerable to digital network security breaches. Simultaneously, the
recent mass inundation of consumers living and working under lockdown
conditions, and the corresponding decreased reliance on traditional physical finan-
cial institutions during the COVID-19 pandemic, has increased the consumer
demandforaccesstosafer,moresecure,andmorereliabledigitalfinancialservices.
Understanding Cybersecurity Management in FinTech is the first book in the
Understanding Cybersecurity Series (UCS), and explores a range of cybersecurity
issues which impact banks and other financial institutions in the provision of their
specific financial services. As such complex financial systems face cybersecurity
challenges that include both technological and operational elements, this book
proposes a FinTech Information Security Governance framework to guide
corporations,boardmembers,directors,andmanagementpersonnelintheeffortto
secure critical data from unforeseen cyber-attacks. This book provides insight into
the cybersecurity implications which stem from the unique FinTech ecosystem or
environment. This includes the issues of navigating cyber threats, detecting
v
vi Preface
vulnerabilities, mitigating risks, and creating proactive governance frameworks,
policies,andinfrastructures,withthegoalofenablingthedesignofacomprehensive
cybersecurityframeworkforFinTechusedbybanksandotherfinancialinstitutions
toprovideservices.
Fredericton,NB,Canada GurdipKaur
Madrid,Spain ZibaHabibiLashkari
Fredericton,NB,Canada ArashHabibiLashkari
May2021
Contents
1 IntroductiontoFinTechandImportanceObjects. . . . . . . . . . . . . . 1
1.1 IntroductiontoFinancialTechnology. . . . . . . . . . . . . . . . . . . . 2
1.2 ImportanceofFinTech. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.3 BigDataandFinancialTechnology. . . . . . . . . . . . . . . . . . . . . 6
1.4 ImpactofFinTechonGlobalEconomy. . . . . . . . . . . . . . . . . . 8
1.5 FinTechandBanking. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
1.6 FinTechandOnlineBanking. . . . . . . . . . . . . . . . . . . . . . . . . . 10
1.7 FinTechEvolution. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
1.8 FinTechEcosystem. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
1.9 FinTechApplications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
1.10 ChapterSummary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
2 IntroductiontoCybersecurity. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
2.1 WhatIsCybersecurity?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
2.2 Motivation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
2.3 TheCIAAAPrinciple. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
2.4 CybersecurityThreats. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
2.5 CybersecurityAttacks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
2.6 CybersecurityAnalysis. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
2.7 WhyCybersecurityMatters. . . . . . . . . . . . . . . . . . . . . . . . . . . 24
2.8 DataScienceandImportantDataBreachers. . . . . . . . . . . . . . . 25
2.8.1 ImportantDataBreaches. . . . . . . . . . . . . . . . . . . . . . . 26
2.9 TheNSATriadforSecurityAssessment. . . . . . . . . . . . . . . . . . 28
2.10 Data-CentricSecurityManagement. . . . . . . . . . . . . . . . . . . . . 31
2.10.1 Data-CentricSecurityCycle. . . . . . . . . . . . . . . . . . . . 31
2.10.2 CharacteristicsofData-CentricSecurityManagement. . 32
2.10.3 ProblemswithData-CentricSecurityManagement. . . . 32
2.11 ChapterSummary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
3 InformationSecurityGovernanceinFinTech. . . . . . . . . . . . . . . . . 35
3.1 WhatIsInformationSecurityGovernance?. . . . . . . . . . . . . . . . 35
vviiii
viii Contents
3.2 SecurityGovernanceSolution. . . . . . . . . . . . . . . . . . . . . . . . . 37
3.2.1 SecurityGovernanceProfiling. . . . . . . . . . . . . . . . . . . 38
3.2.2 SecurityPoliciesandStandards. . . . . . . . . . . . . . . . . . 38
3.2.3 SecurityStrategicPlanning. . . . . . . . . . . . . . . . . . . . . 39
3.2.4 SecurityRolesandResponsibilities. . . . . . . . . . . . . . . 40
3.2.5 SecurityGovernanceofAssets. . . . . . . . . . . . . . . . . . 41
3.2.6 GovernanceStructureAppropriatetothe
Organization. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
3.2.7 ThirdPartiesandSuppliers. . . . . . . . . . . . . . . . . . . . . 43
3.2.8 InformationSecurityGovernanceAssessmentTools. . . 44
3.3 AvailableInformationSecurityGovernanceModels. . . . . . . . . 45
3.3.1 BasicInformationSecurityGovernanceModel. . . . . . . 45
3.3.2 ExtendedInformationSecurityGovernanceModel. . . . 46
3.3.3 ComprehensiveInformationSecurityGovernance
Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
3.4 WhatIsEffectiveandEfficientInformationSecurity
Governance?. .. . . . .. . . . . .. . . . . .. . . . . .. . . . . .. . . . . .. 49
3.5 IntegratedGovernanceMechanisms. . . . . . . . . . . . . . . . . . . . . 51
3.5.1 TheRoleofGovernance. . . . . . . . . . . . . . . . . . . . . . . 51
3.5.2 CorporateGovernance. . . . . . . . . . . . . . . . . . . . . . . . 51
3.5.3 PrinciplesofGoodGovernance. . . . . . . . . . . . . . . . . . 52
3.5.4 PrinciplesofUndertakingGovernanceReview. . . . . . . 53
3.6 ComprehensiveSecurityGovernance. . . . . . . . . . . . . . . . . . . . 53
3.6.1 StrategicIntegration. . . . . . . . . . . . . . . . . . . . . . . . . . 53
3.6.2 CyberRiskMitigationApproach. . . . . . . . . . . . . . . . . 54
3.6.3 AdaptabilityandAgility. . . . . . . . . . . . . . . . . . . . . . . 55
3.6.4 ReportingFrameworkforGoodGovernance. . . . . . . . 56
3.7 EffectivelyImplementingaSustainableStrategy. . . . . . . . . . . . 57
3.8 IntegratedGovernanceFramework. . . . . . . . . . . . . . . . . . . . . . 58
3.9 TheIntegratedFrameworkAssessment. . . . . . . . . . . . . . . . . . . 58
3.9.1 GovernanceStructure. . . . . . . . . . . . . . . . . . . . . . . . . 59
3.9.2 ManagementStructure. . . . . . . . . . . . . . . . . . . . . . . . 60
3.9.3 Operations/Infrastructure. . . .. . . . . . . . .. . . . . . . .. . 60
3.9.4 Compensation/FundsFlow. . . . . . . . . . . . . . . . . . . . . 60
3.10 AGeneralInformationSecurityGovernanceModel
forFinTech. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
3.11 ChapterSummary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
4 CybersecurityThreatsinFinTech. . . . . . . . . . . . . . . . . . . . . . . . . . 65
4.1 UnderstandingCybersecurityThreats. . . . . . . . . . . . . . . . . . . . 67
4.2 UnderstandingtheAdversary. . . . . . . . . . . . . . . . . . . . . . . . . . 68
4.3 ThreatCategoriesforFinTech. . . . . . . . . . . . . . . . . . . . . . . . . 69
4.4 ThreatActors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
4.5 ThreatIntelligence. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Contents ix
4.6 StructuralApproachtoFinTechThreatModeling. . . . . . . . . . . 77
4.6.1 FocusingonAssets. .. . . .. . . .. . . .. . . .. . . .. . . .. 78
4.6.2 FocusingonAttackers. . . . . . . . . . . . . . . . . . . . . . . . 78
4.6.3 FocusingonSoftware. . . . . . . . . . . . . . . . . . . . . . . . . 78
4.7 ThreatModeling. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
4.8 TheBestThreatModelingMethodologyforFinTech. . . . . . . . 82
4.8.1 STRIDE. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
4.8.2 Trike. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
4.8.3 VAST. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
4.8.4 PASTA. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
4.9 ChapterSummary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
5 CybersecurityVulnerabilitiesinFinTech. . . . . . . . . . . . . . . . . . . . 89
5.1 GeneralCybersecurityVulnerabilitiesinFinTech. . . . . . . . . . . 89
5.2 SpecificCybersecurityVulnerabilitiesinFinTech. . . . . . . . . . . 92
5.2.1 TechnologyVulnerabilities. . . . . . . . . . . . . . . . . . . . . 93
5.2.2 HumanVulnerabilities. . . . . . . . . . . . . . . . . . . . . . . . 94
5.2.3 TransactionVulnerabilities. . . . . . . . . . . . . . . . . . . . . 96
5.3 AssessingtheFinTechCybersecurityVulnerabilities. . . . . . . . . 97
5.4 GeneralPoliciestoMitigateFinTechCybersecurity
Vulnerabilities. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
5.5 ChapterSummary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
6 CybersecurityRiskinFinTech. . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
6.1 WhatIsRisk?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
6.2 WhatIstheCybersecurityRisk?. . . . . . . . . . . . . . . . . . . . . . . 104
6.3 CybersecurityRiskLifecycle. . . . . . . . . . . . . . . . . . . . . . . . . . 107
6.4 RiskAssessment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
6.5 RiskAnalysis. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
6.5.1 Procedure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
6.5.2 Strategies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
6.5.3 Models. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
6.6 RiskMitigation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
6.7 RiskMonitoringandReview. . . . . . . . . . . . . . . . . . . . . . . . . . 116
6.8 ChallengesinFinTechRiskManagement. . . . . . . . . . . . . . . . . 117
6.9 DealingwithUncertaintyinFinTech. . . . . . . . . . . . . . . . . . . . 119
6.10 KindsofUncertainty. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
6.11 ReducingUncertainty. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
6.12 HandlingUncertaintyforFinTechCybersecurityRisk. . . . . . . . 120
6.13 ChapterSummary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122