Overview of the state of information security in the financial market
Comment by Roman Perminov, Director of the Department of Information and Cybersecurity.
The importance of cybersecurity in the financial market has increased in recent years. As financial institutions move to online customer service, they must implement high-quality digital security to protect customers and business assets. Technology offers convenience, but it also attracts criminals who hope to take advantage of new opportunities.
The best defense tactic is prevention. Organizations prepared for the challenges ahead will protect the assets and reputation of their organizations as cyber attacks become more sophisticated.
Of course, this led to the need for stricter regulatory and compliance measures in the financial market. Customers want banks to protect their data and assets.
"Thus, banking cybersecurity must protect all networks, storages, applications and devices. Risk management for digital services is currently the most important aspect of banking," says Roman Perminov.
Since the beginning of 2020, the Agency, implementing its functions within the framework of the Information Security Industry Center, has carried out comprehensive work on the formation of a regulatory legal framework for its activities, including information security requirements for financial market participants: banks, insurance organizations, credit bureaus, securities market participants and microfinance organizations. Approaches to the assessment and processing of information security risks in the financial market have also been developed and normatively fixed.
The Industry Center collects, evaluates and analyzes information about information security threats, vulnerabilities in the infrastructure of financial organizations, as well as information security events and incidents in the financial market. The result of this work is warnings sent to financial market participants, allowing them to respond to threats in a timely manner and improve their information security management systems.
"In order to carry out the above task, the Agency has developed and put into operation an automated system for processing information about events and incidents of information security in the QAINAR financial market (hereinafter referred to as QAINAR AIPS) on its own," the representative of the financial regulator notes.
The Resolution of the Agency's Board approved the Rules of Operation of the QAINAR Association in the financial market.
To date, all second-tier banks of the Republic of Kazakhstan and a number of other organizations with appropriate capabilities have been connected to the QAINAR AIPS.
As of December 2023, about 21 million information security events, in other words, cyber attacks, have been recorded and worked out in the QAINAR system.
From 2021 to the present, an industry center using the QAINAR AIPS in order to prevent cyber attacks:
332 warnings about information security threats and 654 vulnerability warnings were sent to the participants of the information exchange;
229 cards of information security incidents in banks were processed.
On March 28, 2023, the Agency's Cybersecurity Department was transformed into the Agency's Information and Cybersecurity Department by Decree of the President of the Republic of Kazakhstan No. 157.
The strengthening of the Agency's cybersecurity direction has made it possible to expand the range of financial organizations being audited and increase the effectiveness of checks on compliance with information security requirements.
Under pressure from the growth of cyber threats, the Agency's regulatory standards are becoming stricter with regard to financial institutions. This year, extensive work has been carried out to strengthen the requirements for ensuring information security of banks and microfinance organizations. The changes in Requirements are aimed at increasing the level of information security of financial services by strengthening software requirements, including:
- ensuring the security of the development, revision and storage of software codes;
- the use of biometric identification of the client through the IDEC (KCIS biometrics) in the implementation of a number of critical operations;
- limitation of the application's operation when using remote control programs on a mobile device or in case of violation of security functions (Jailbreak, root access);
- recording of geolocation data during cash transactions in the application.
"Banks and microfinance organizations are forced to monitor compliance with the norms more carefully, which requires additional efforts and resources from them, at the same time, eases the burden on customers," the speaker stressed.
At the same time, financial organizations are increasingly using cloud solutions to optimize operations and reduce costs. Artificial intelligence and machine learning, which can detect suspicious activity in real time, are also being introduced to analyze data and identify anomalies. However, it also creates new risks, such as attacks on algorithms and machine learning models. This creates new challenges in the field of information security, requiring improvement of regulatory requirements and control of their implementation.
Digitalization of banking allows numerous third-party services to integrate with secure banking systems. Perhaps the weakest link in the cybersecurity system of financial organizations are organizations that receive some kind of access to the banking infrastructure as part of their services. This type of attack is called supply chain attacks. For example, the development of mobile and web applications for financial organizations allows you to gain a competitive advantage in the field of financial services. Networks integrating financial services and stores offer consumers an efficient and convenient service. However, connecting third-party participants to the banking infrastructure creates vulnerabilities. Cybercriminals can now attack suppliers within the supply chain that have weaker security.
Online banking has spread to customers' devices, which is becoming the main way for most consumers to access digital financial services in 2023. However, with the advent of millions of devices, the attack area increases significantly. Customers now need to make significant efforts to manage IoT devices and systems, including ensuring their security. Scammers can use lost or stolen phones, not updated firmware and minimal device security policies. Such classic attacks as phishing and social engineering, ransomware, and an attack on unencrypted assets do not lose their relevance.
The development of blockchain technology and the spread of cryptocurrencies create new challenges in the field of information security. Despite their reliability, cryptocurrencies also attract the attention of cybercriminals. Hacktivism does not lose its relevance, especially against the background of the aggravated geopolitical situation in the world. The main goal of the hacktivists is the large—scale destabilization of the country's financial system as a whole, despite the fact that they attack individual financial market companies. The attackers seek to sow panic among the population, to arouse citizens' distrust of financial institutions and government authorities. They can attack organizations associated with certain political regimes or financial and industrial groups in order to discredit their activities, destabilize the financial system of the state, disclose information, influence public opinion or draw attention to certain problems.
Information security in the financial market in 2023 remains an urgent and difficult problem. Financial institutions face ever-changing challenges and threats, and must constantly improve their security practices and strategies. With the increasing complexity of cyber threats and increasing regulation, collaboration, staff training and innovation in the field of information security are becoming key components of success in the field of financial information security.
"Effective risk management and precautionary measures are becoming critically important for financial institutions to protect their own assets and ensure the safety of customers," Roman Perminov summed up.
Division of External Communications
+7 (727) 237 1089, press@finreg.kz