Digital Banking Program

Cybersecurity Course Manual

Update 1.0

Copyright © 2021
Digital Banking - Data Analytics

Table of Contents
Introduction ..................................................................................................................... 3
Elements of Cybersecurity............................................................................................... 10
Principles of Cybersecurity .............................................................................................. 12
Types Of Cybersecurity Threats ....................................................................................... 15
Cybersecurity For Financial Services ................................................................................ 21

Page 2 of 26
Digital Banking - Data Analytics

MODULE 1
Introduction

Introduction
In today’s interconnected world, an understanding of the elements and principles of
cybersecurity is important to minimizing susceptibility to cyber-attacks. In this course, we
will develop an understanding of the core components of cybersecurity for organization
level and personal cyber security.

Key Terms
Cybersecurity: the art of protecting applications, networks, and data from
unauthorized access or criminal use.
Cyber-attack: an offensive attempt that targets computer information
systems, to steal, manipulate or destroy information.
Hacking: gaining of unauthorized access to data in a system or computer.
Vulnerability: a weakness in a computer system or network that can be
exploited by an attacker
Cyber-risk: any risk of damage to an organization resulting due to the
unauthorized use of its information technology systems.
Malware: any type of software designed to harm or exploit any computer
system or network.

Page 3 of 26
Digital Banking - Data Analytics

Elements
Scope
Application security
• Consists of all the practices that enhances the security of applications.
• The development phase of any application is critical to its security as most
vulnerabilities emanate from this phase.
• Accidental introduction of vulnerabilities can be avoided through secure coding
practices
• Organisations are also tasked with ongoing threat detection through various tools
to prevent cyberattacks that could deny users access to an application.

Information Security
• This is a set of practices that enables organizations to keep data secure
• The main goal of information security is to protect the confidentiality, integrity and
availability of information

Page 4 of 26
Digital Banking - Data Analytics

Network Security
• Network security is any activity undertaken by an organization to prevent and
protect against unauthorized access into corporate networks.
• Network security ensures that corporate networks are protected from breaches that
could also lead to application and data breaches.

Disaster Recovery Planning

• Organizations undertake this process to know how to respond to cybersecurity
attacks
• A disaster recovery plan is a recorded policy created by an organization with
detailed instructions on how to respond to unplanned cybersecurity incidents.

End user Education

• An organization is only as strong as the weakest link in its cybersecurity chain.
• Through security training, Organizations can create a culture of awareness by
equipping employees with the tools and skills required to protect themselves and
their organization’s assets from loss or harm.

Operational Security
- Operational security is a risk management process that ensures sensitive
organizational information is secured.
- Also known as OPSEC, it enables IT managers to view operational activities from
the perspective of a potential attacker which ensures they can quickly spot
vulnerabilities and potential system flaws.

Biggest moments in the Recent Cybersecurity history

Interestingly, threats to computers predate the modern internet with Bob Thomas and
subsequently Ray Tomlinson creating experimental programs that left a trace on
computers connected by the ARPANET. Since then, Cybercrime has evolved from merely
experimental programs to data theft programs that have immensely impacted several
organizations.

In the past ten years, we have seen some of the largest data breaches, most widespread
ransomware and financial hacks as cybercrime keeps gaining ground worldwide.

Page 5 of 26
Digital Banking - Data Analytics

Recent Cyber Security Trends and Innovations

Even as malware attacks keep growing in number and even reaching an all-time high at
10.52 billion in 2021, the cybersecurity space as seen tremendous development.

Transport Layer Security (TLS)

Transport Layer Security encrypts data transferred between users
and systems, or systems and other systems.
Through encryption, TLS prevents hackers having access to such
data.
This data could be anything sensitive or personal which can include
credit card numbers, passwords, customer or addresses.

Multi-Factor Authentication (MFA)

• Multi factor Authentication ensures that users have to present two or more pieces
of credentials when accessing an account or system.
• Credentials can be in three categories:
o something you know (e.g. password, Personal Identification Number)
o something you have (e.g., Phone, token, credit card)

Page 6 of 26
Digital Banking - Data Analytics

o something you are (e.g., biometric data such as your fingerprint)

• With multi-factor authentication, users have to prove at least two of these
credentials.

Extended Detection and Response (XDR)

• XDR automatically collects data from multiple touchpoints like email, service
endpoints, servers and correlates them to provide better context to threats.
• It provides better visibility through the collection and correlation threat information
across multiple touch points.
• With better to context into threats, events that would have evaded security teams
are brought into limelight.
• Examples of XDR tools include: Cynet, Palo Alto Networks, Sophos, McAfee.

Zero-Trust Network Access (ZTNA)

• ZTNA gives users secure connectivity to private applications without ever placing
them on the network or exposing apps to the internet.
• ZTNA provisions access to private application on a user’s behalf through a secure
tunnel. It provides an added layer of protection for corporate applications and
services by shielding otherwise publicly visible IP addresses.

Page 7 of 26
Digital Banking - Data Analytics

• Examples include: Cisco ZTNA, Appgate ZTNA, NetMotion ZTNA

Fifth generation cyberattacks

Just like the five generations of computers, Cybersecurity has evolved from mere
standalone attacks to large scale multi-vector attacks with several reputable organizations
taking big hits over the years.

Fifth-generation attacks refer to cyber-attacks characterized by a wide scope and the use
of advanced attack tools which has sparked an urgent need for more sophisticated
measures in coping with these attacks.

Characteristics of Fifth generation Attacks

• They are large-scale attacks.

• They target multiple points of entry at once (multi-vector attacks)
• Advanced “weapons-grade” hacking tools are used by attackers
• They are harder to defend against.
• They move very fast and can infect a large number of organizations and entities in
few hours.

2017 in particular was a global wake-up call as organizations witnessed uncommon levels
of cyber-attacks underlining how they need to be better prepared and equipped to identify
and respond to digital threats.

But then how did it get to this level?

Page 8 of 26
Digital Banking - Data Analytics

Importance of Cybersecurity

• Cybersecurity protects all categories of data from theft and damage

• Cybersecurity enables organization defend itself against data breach campaigns
• High reputation and monetary cost arising from data breach
• The absence of cybersecurity can ruin customer relationships and lead to legal suits

Rising Cyberattacks
Cyberattacks are on the rise as more devices are
getting connected to the internet as such
organizations need to pay detailed attention to Cyber
security to minimize exposure.

Cost of Cyberattacks Data Protection

Amounts lost by organizations and Financial loss, legal battles, reputational
individuals to cyberattacks keeps damage are some of the challenges
growing. Ransomware attacks are organizations like Yahoo have had Pageto9contend
of 26
forecasted to cost organizations about with due to large scale data breaches. No
$20 billion this year from $8 billion in surprise that organizations are now paying
Digital Banking - Data Analytics

MODULE 2
Elements of
Cybersecurity
Introduction
A dilemma is making a difficult choice between two competing alternatives. We learn
deeply when we try to resolve dilemmas. We will review the fundamental dilemmas that
Cybersecurity has to resolve. All Cybersecurity decisions involve getting the right balance
between dilemmas.

Definitions
Term Definition
Vulnerability A weakness that can be exploited by cybercriminals to gain
unauthorized access to a computer system
Data Custodian Those responsible for the safe custody, transport and storage of
data as well as implementing business rules.

Module Vision
Access Bank will have the best-balanced cybersecurity profile in the industry. We will have
the easiest access to data by legitimate users with the best protection against
cybercriminals.

Objectives
On completing this section, participants will understand the tradeoffs that have to be
made to balance the need for free open access to data and the threat of cybercriminals.
They will apply this balance to designing new products and the day-to-day requirements
of the workplace.

Concepts

Page 10 of 26
Digital Banking - Data Analytics

Elements
Dilemma Resolution
Security vs Easy access to data Better unique identifiers
How do you improve security without making By making unique identifiers
it harder for legitimate users to access data? simpler to use but harder to copy.
Planning for new threats Faster detection and response
How do you plan for a new threat that has By improving detection and
never happened before? response speeds.
Everything has a vulnerability Continuous Redesign
How do you resolve all elements and By improving design before
processes of electronic data processing attacks happen.
having some vulnerability?
Every new solution hides a new threat Better testing
How do you manage the imperfections of By improving testing.
new solutions?
All vulnerabilities will eventually be Increased vigilance
exploited By thinking like a cybercriminal.
How do you respond to criminals looking for
vulnerabilities?
People Trust when they should not Zero trust policies
How do you control people’s natural desire to By having zero trust policies.
trust?
Innovation creates new types of misuse Built-in protection
How do you prevent innovations creating new By a deeper analysis of
vulnerabilities? innovation.
People want to know more than they Better Education
need to know By teaching ethics and
How do you limit natural curiosity? consequences.
The data custodian is not the data Limit Custodian Access
owner By preventing custodians from
How do you resolve the person in charge of accessing data using encryption.
data not being the owner of that data?

Tips
When assessing a cybersecurity situation, look at the situation from different perspectives.
Wear the user’s hat, the company hat, the data owner’s hat, the cybercriminal’s hat and
the government hat. Use each perspective to assess how well the convenience has been
balanced with the vulnerability.

Transformation
When you routinely assess the balance and can make good judgment calls on which
direction an adjustment should go, you have transformed your cybersecurity skills.

Exercise
Individual
Imagine a new invention that would improve security AND improve data access.

Page 11 of 26
Digital Banking - Data Analytics

MODULE 3
Principles of
Cybersecurity
Introduction
Cybersecurity principles provide strategic guidance on how organisations can protect their
systems and data from cyber threats. This module will help raise your awareness of key
cyber security principles to ensure you’re informed of the various ways you can contribute
in ensuring your organization is safe from cyberattacks.

Definitions
Privilege: The access rights which a user of a computer has to perform security-
relevant functions on a computer system.
Compliance: the act of complying to organisational policies.

Module Vision
To ensure the appreciation of key cybersecurity principles and how they can be applied in
the work environment.

Concepts
At work, our daily tasks will heavily involve either development, maintenance or usage of
digital systems. As we have learnt through this course, these digital systems are increasingly
being targeted by hackers hence the need to apply core security principles to our everyday
interaction with these systems.
Compliance and least privilege access are at the heart of these principles as negligence has
been reported to be the greatest cause of data leaks in organizations with 66% of data
breaches mostly down to employee negligence and non-compliance to security policies.

Elements
Compliance
• It isn’t just enough for an organisation to develop solid cybersecurity policies.
• All employees should be required to undergo training programs and pay critical
attention and comply to these to policies in their daily work.

Page 12 of 26
Digital Banking - Data Analytics

Simplicity
• Organisations are increasingly developing new digital systems in order to expand
their reach and ensure profitable growth.
• Ensuring simplicity in the development of these systems reduces attack surface and
the risk of misconfiguration that could lead to security breaches.
• Attack surface area can be minimized by reducing the entry points available to
untrusted users, and eliminating services legacy services that have running
substitutes.

Consistency
• Security policies have to be applied across the board. These includes all hardware
and software utilized in the organization. It’s important a single vulnerability in a
device could expose the entire organization and this can be mitigated through
consistent application of security policies.
• We should never assume that products will come with enough security installed
therefore all devices irrespective of default capabilities should follow organisational
security policies.

Separation of duties
• This means that more than one person is required to complete a process to prevent
fraud.
• When no one individual has sole control over a process, it limits the ability of
individuals to negatively impact the Confidentiality, Integrity, or Availability of
information systems in an organisation.

Fail Securely
• System Failures are inevitable but they must fail securely to prevent damage.
• Failing securely means that attackers must not be able to gain access to a system
or data when there’s a system failure or downtime.

No trust without evidence

• Evidence must be used to measure trustworthiness.
• Evidences such as passwords, OTP, facial recognition, certificates are used by
digital systems to ensure that attackers without valid credentials are not allowed
access.
• All evidences required by a process or system must be provided and validated.

Treat security as overarching design

• Security must be the baseline consideration in the design of an organisation's
digital system.
• A fragmented approach to cybersecurity leads to ineffective coverage of systems
thereby creating vulnerabilities.

Page 13 of 26
Digital Banking - Data Analytics

Least privilege basis

• An individual should have only the minimum access privileges necessary to perform
a task and nothing more
• No user should be given enough privileges to misuse the system on their own.

Secure by default
• Secure by default focuses on a holistic approach to security by ensuring that the
default configuration of a system is as secure as possible.
• This means that security measures are built are into either hardware/software
without the need of add-ons. Secure by default principles requires that products
should have certain security features at the minimum such as password prompts,
TLS encryption, failed authentication locks etc.

Tip

“You are a target”

Don’t ever think that you, your systems, or accounts are not valuable to attackers. There
are many ways these attackers can use your personal information to harm you, your
family or organization.

Exercise
Negligence in cybersecurity can exist in diverse forms. In what practical ways do you think
a Banker can depict negligence putting the Bank at risk of cyberattacks?

Page 14 of 26
Digital Banking - Data Analytics

MODULE 4
Types Of
Cybersecurity
Threats
Introduction
Cybersecurity is the management of computer threats, especially malicious attacks by
anyone trying to access a network to corrupt data, steal confidential information, damage,
or disrupt sensitive data.

Definitions
Unauthorized unintended entry into a system without the owner’s permission.
access:
Confidential Information that needs the owner’s permission before access.
information:
Malicious A breach of computer defences to cause harm or demand money.
attack:
Phishing: an attempt by an attacker to trick users into providing sensitive
information or installing malware.
Man-in-the- occurs when an unauthorized party intercepts communications
middle-attack between two systems or people to gain access to sensitive
(MITM): information or perform fraudulent actions.
DDoS: an attempt to make it impossible for a service to be delivered by
overwhelming the computer systems with traffic.
Malvertising: is the use of online advertising by cyber attackers to spread and
inject malicious code into your computer.
Ransomware: a type of malware that prevents users from accessing their
system unless a ransom is paid.

Module Vision
To ensure the work environment and customer & internal data is safe from breach from
different cyber threats. This will ensure Access Bank is viewed as safe by its customers &
stakeholders

Objectives
To ensure participants are able to identify malicious threats in the workplace &
environment and adopt preventive actions. This will enable a more secure work & personal
life interaction

Page 15 of 26
Digital Banking - Data Analytics

Concepts

Man in the Middle: A man-in-the-middle attack is an eavesdropping attack, where an

attacker intercepts an existing communication by inserting themselves in the "middle" of
the communication, and pretends to be a legitimate participant. By doing this the attacker
is able to intercept information and data from either party while also sending malicious
links or falsified information to both legitimate participants in a way that might not be
detected until it is too late.

Drive by download: A drive-by download attack refers to the unintentional download of

a malicious code to your electronic device (PC, TV, smartphone) that exposes you to a
cyberattack. You don't have to click on anything, press download, or open a malicious
email attachment to become infected. Drive by download compromises an app, operating
system, or web browser that contains security flaws due to unsuccessful updates, lack of
updates or sometimes even new updates.

Page 16 of 26
Digital Banking - Data Analytics

Malvertising: Malvertising is an attack in which the culprits insert a malicious code into a
recognized online advertising networks which then redirects users to malicious websites
created by the culprits. Malvertising works in one of the following ways: Insert code that
installs malware or adware on the user’s computer; Redirects the user to a malicious
website, rather than the target suggested by the ad’s content; Redirects the user to a
malicious website very similar to a real site, which is a operated by the attacker

Rogue Software/scareware: Rogue software are software that leverages pop-up ads
which generates erroneous or misleading alerts in an attempt to lure users into believing
they need to download or buy software to address a cybersecurity problem. the
consequence of downloading rogue software includes credit card fraud or identity theft.

Page 17 of 26
Digital Banking - Data Analytics

Distributed Denial of service: A distributed denial-of-service (DDoS) attack is a

malicious attempt to disrupt the normal traffic of a designated network, service or server
by overwhelming the target with a flood of Internet traffic using multiple computers with
the aim of preventing the web resource’s normal functioning – a total ‘denial of service

Denial of service: A denial-of-service (DoS) attack is a type of cyber-attack in which

aims to render a computer or other device unavailable to its intended users by interrupting
the device's normal functioning. DoS attacks is characterized by overwhelming a targeted
machine with requests until normal traffic is unable to be processed, resulting in denial-of-
service

Password attacks: Password attacks simply refer to the theft of your password by a
hacker.

Phishing: Phishing is a type of cyberattack where an attacker sends a fraudulent

("spoofed") message designed to trick a victim into revealing sensitive information to the
attacker or to deploy malicious software on the victim's PC in order to steal user data,
including login credentials and credit card numbers.
Malware: is a software that is specifically designed to gain access or damage a computer
without the knowledge of the owner. Malware is introduced into a network through
phishing, malicious attachments, or malicious downloads, but it may gain access through
social engineering or inserting flash drives into PCs or servers. Types of Malware
Ransomware, Fileless Malware, Spyware, Adware, Trojan, Worms, Rootkits, Keyloggers,
Bots, Mobile Malware.

Page 18 of 26
Digital Banking - Data Analytics

Examples
Man in the Middle: The attacker installs a packet sniffer to analyze network traffic for
insecure communications. When a user logs in to a site, the attacker retrieves their user
information and redirects them to a fake site that mimics the real one. The attacker's fake
site gathers data from the user, which the attacker can then use on the real site to access
the target's information.
In this scenario, an attacker intercepts a data transfer between a client and server. By
tricking the client into believing it is still communicating with the server and the server into
believing it is still receiving information from the client, the attacker is able to intercept
data from both as well as inject their own false information into any future transfers.

Drive by Download : A cyberespionage group called Patchwork (or Dropping Elephant),

used drive-by download techniques — such as creating a fake social video website called
YoukuTudou to target victims in China — to download and execute an xRAT Trojan under
the guise of an Adobe Flash Player update
Malvertising if you see an ad on a reputable website that promises “15% off iPhone 12
pro for Jumia users,” it might be a malvertisement. If you click on such an ad, you won’t
be redirected to the official Jumia website. Instead, it may take you to a malicious website
or download malware onto your device.
Rogue software example: While visiting a website, a popup displays a fictitious
warning stating that someone's machine is infected with a computer virus, and encourage
them through manipulation to install or purchase scareware in the belief that they are
purchasing genuine antivirus software.
Denial of service example: Imagine getting to the office. After you've checked your e-
mail, you're ready to do some research online, You open your web browser but then you
notice your browser was denied access to the network, preventing you from connecting to
the Internet. In desperation, you turn your power of the PC and restart it. After the
reboot, your computer still cannot reach any networked service. Since only your computer
was involved, Its a Denial of Service attack.

Page 19 of 26
Digital Banking - Data Analytics

Distributed Denial of service example : In 2000, Michael Calce, a 15-year-old boy

who used the online name “Mafiaboy,” launched one of the first recorded DDoS attacks.
Calce hacked into the computer networks of a number of universities. He used their
servers to operate a DDoS attack that crashed several major websites, including CNN, E-
Trade, eBay, and Yahoo

Phishing example: An email from Access Bank arrives telling the customer that their
account has been compromised and will be deactivated unless they confirm their debit
card details. The link in the phishing email takes the victim to fake Access Bank website
and the stolen credit card information is used to commit further crimes.
Password attack example: A group of hackers attacked Zoom and leaked about half a
million credentials up for sale. How did they do it? With credential stuffing. They collected
multiple dumps of leaked credentials in the darknet or internet, cracked them, and used
them with automated tools on Zoom’s login page. They could then evaluate the response
and determine the valid credentials, which they put up for sale.

Malware called Fireball infected 250 million computers and devices in 2017, hijacking
browsers to change default search engines and track web activity. However, the malware
had the potential to become more than a mere nuisance. Three-quarters of it was able to
run code remotely and download malicious files.

Page 20 of 26
Digital Banking - Data Analytics

MODULE 5
Cybersecurity
For Financial
Services
U1.0

Introduction
Financial services have a fiduciary obligation to their customers and by virtue of their
business hold sensitive customer financial information which makes them prime targets for
malicious actors who seek to compromise their information system to have access to this
data. This information includes banking details, Bank verification no. (BVN), home
address, email address, Passport information, National identity card no., phone,
transaction history, and other income information. With technology evolving by the day,
advances in digital technology, payment solutions, social media, internet of things,
artificial intelligence have increased the surface area financial services players need to
protect against malicious actors.

Definitions
Deepfake: use of ML & AI to generate a fake image, audio or video of a person

CYBER THREATS IN THE FINANCIAL SERVICES:

• Identity & customer data theft: is a crime in which a malicious actor obtains
key pieces of personally identifiable information, such as BVN, Bank login numbers,
debit or credit card information to impersonate someone else. The stolen

Page 21 of 26
Digital Banking - Data Analytics

information can be used in purchasing goods and services in the name of the victim
or to fleece the victim of their financial resources.
• State sanctioned attacks: some cyberattacks are actually conceptualised,
financed and launched through proxies by foreign governments. State sanctioned
proxies are able to inflict significant damage to an entity (nation, company) with
their computers, an internet connection and the backing of government. This is the
modern mode of warfare between countries, as rather than employing military
might in pursuit of state goals, countries are now turning to cyber warfare to
advance their agenda.
The Russian Federal Security Service (FSB) (Secret service) has developed a bad
reputation for partnering with malicious actors by protecting, recruiting into active service
hackers who it then uses to carry out online attacks.
• Employee Oversight: Banks have strict recruitment processes and procedures in
place with regular training carried out for its staff members, however in spite of this
from time to time there is a lapse in employee security consciousness or a complete
absence of knowledge which malicious actors swiftly take advantage of. Example an
employee unknowingly opening a phising mail on his work laptop which then
installs a virus on the institutions network.
• Ransomware: Ransomware is a malware that takes over a victim’s computer
system, an organizations data by encrypting the data and making it impossible for
the owner to access the ransomed data unless they usually pay a large fee
(ransom). These attacks target financial institutions because the criminals know
their targets would pay huge amounts for customer data not to be leaked or
compromised further.
• Third-party vendors: Financial services use vendors to deliver certain services
that are usually outside its focus or expertise. These 3rd parties provide a wider
surface area for malicious actors to exploit in order to compromise the security
architecture of companies. Consequently, financial services have to establish
adhered to service protocols to reduce the vulnerabilities their interaction with 3rd
party vendors expose them to.
• New Gen Technologies: Technology is evolving faster than financial services can
keep up with the entry of Deepfake technology, key officers in a firm can have their
identity cloned and used to gain access to sensitive data that only they would
otherwise have had access to, thereby posing a huge threat to financial services.

Multi-factor Authentication: It is an authentication process that requires the user to

provide at least two or more verification information, before the user can access personal
data. The Multi-factor authentication helps protect users by adding an additional layer of
security, making it harder for cyber criminals to impersonate a user.
Multi Factor Authentication combines at least two separate factors. These are typically
your username and password, which is something you setup yourself. The other could
be: Something you possess: Phone, key-card, or USB that could verify your identity.
Something you are. Fingerprints, eye scans, or some other biometric data to prove that
you are who you say you are.

Page 22 of 26
Digital Banking - Data Analytics

IMPORTANCE OF MULTI FACTOR AUTHENTICATION TO

FINANCIAL SERVICES
• Multi Factor Authentication makes identity theft harder: Identity theft is easier than
ever, and it’s a growing threat to all businesses.
• Helps fortify the strength of credentials considerably such that when malicious
actors gain access to stolen passwords, the impact is considerably reduced
• It is simple and relatively easy for financial services to roll out across all their
customer segments and doesn’t require complex integration to be done.
• Helps increase the security of your existing security architecture, as the other
cybersecurity tools and solutions, like anti-virus and firewalls that make up the
architecture are only as strong as their user authentication procedures.
• It can be used specifically for administrative and executive accounts to protect
High-ranking employees and highly privileged user accounts which are a constant
target for malicious actors

VULNERABILITIES OF MULTI FACTOR AUTHENTICATION

• Channel Hijacking: Channel hijacking can be used to compromise the multi factor
authentication security that financial services use as part of their security
architecture. This is done by attacking a victim’s phone or computer through
malware. The PC malware uses man-in-the-browser or web injects to get the users
information. In some cases, attackers even steal text messages via the cell tower
directly or via a rouge cell tower, taking over the victim phone number.
• Real time phising: tricks a victim into accessing a proxy server (a server that
acts as an intermediary) controlled by an attacker. The “proxy” looks similar to the
original website. Using this fake website, the attacker manipulates the victim to
hand over the authentication code along with his credentials.
• Sim Swapping: In a SIM-swapping attack, an attacker fraudulently obtains a SIM
card with the same number as their victim, enabling them to receive any SMS-
based multi factor authentication tokens on their own phone instead of the victim’s
phone.
Designing Secure Digital Systems in Financial Services
Digital systems are increasingly facilitating easy customer interactions with financial
services. As these services are delivered over the internet, the risk of hijacks and attacks
becomes more pertinent. Designing secure digital platforms minimises the risk of attacks
and hacks that could lead to financial loss for various parties in a digital transaction. Below
are some of the key considerations in designing secure financial platforms:

Adopting open-standards
- Open standards like OAuth allows organisations to securely establish identities
across platforms
- The availability and extensibility of open standard components creates the right
conditions for organisations to further strengthen their systems

Page 23 of 26
Digital Banking - Data Analytics

Modular designs (Microservices)

This is an approach to developing software as a suite of small services called
microservices. Monoliths are designed as a single platform and provide more risks because
if one aspect of the monolith is exploited or otherwise fails, others may follow.
Microservices can be implemented with additional security checks between services to
make such services even more secure.
Encrypt/Hash Sensitive Information
Encryption is a very important line of defence in designing a secure financial system as it
makes the use of intercepted data as difficult as possible. Through encryption, hackers
can be prevented from accessing digital transactions.
Vulnerability Assessments
Vulnerability assessment reviews the weakness of digital systems before they are released
to end-users by evaluating if a system is susceptible to any known vulnerabilities and
recommends remediation measures, so that developers can fix these vulnerabilities before
the deployment of such services.
Input Validation
* Input validation involves the proper testing of any input supplied to digital systems to
prevent code injections that could put such systems at risk
* input validation attack occurs when an attacker deliberately enters malicious input to
confuse an application and cause it to carry out some unplanned action

CYBER SECURITY BEST PRACTICES IN IMPROVING THE

CUSTOMER EXPERIENCE
- Proactive response: Data breaches damage consumer trust. swift and proper
response to any data breach can reduce the damage to a brand’s reputation. Being
proactive and following the highest standards of cybersecurity practices for
protecting user privacy can go a long way in providing a secure customer
experience.

- Strong in-house cybersecurity policies: Establishing and implementing policies

on using computing resources is a first step in securing technology infrastructure.
For example, controlling and limiting access to data and devices can limit the
damage. In addition, a robust asset management system can further help
businesses track all devices and secure their infrastructure.

- Refining data collection practices: Malicious attackers know how valuable

customer data is, which is why they work so hard to steal it and most times sell the
data on the dark web. To protect your customers from data exposures and protect
your business from liability, review the customer data you collect.

Page 24 of 26
Digital Banking - Data Analytics

- Employee awareness training: Training employees to be aware of different

cybersecurity threats and tasking them to communicate common customer
vulnerabilities to customers in their interactions at different touchpoints can go a
long way in ensuring customers do not fall victim to cyberattacks.

- Transparent customer data policies: Being transparent and communicating

data policies will help organizations build trust with their users. In addition,
informing customers about how and what data is collected, stored, and used and
giving them the option to opt-out or delete will bring customer loyalty.

Page 25 of 26
Digital Banking - Data Analytics

Page 26 of 26