Advanced Enterprise Security Case Study: Banking Sector Security

This report provides a comprehensive analysis of Advanced Enterprise Security, focusing on the challenges faced by the banking and finance sector, specifically using Investors Bank as a case study. The report explores various security threats, including phishing, pharming, man-in-the-middle attacks, and mobile malware, and their impact on customer data. It highlights the bank's current security measures and identifies vulnerabilities in their system. The report proposes several solutions, such as implementing Key Risk Indicators (KRI), providing secure online services, developing secure mobile applications, using virtual keywords, and establishing a strong "One Team" security culture with employee training and awareness campaigns. The report emphasizes the importance of digital defense, the adoption of risk mitigating approaches, and continuous research for customer data protection. The conclusion underscores the necessity of Advanced Enterprise Security for the banking sector to protect sensitive information and maintain customer trust. This assignment also elaborates regarding the importance of this topic in the Information Technology organisation.

Running head: ADVANCED ENTERPRISE SECURITY
ADVANCED ENTERPRISE SECURITY
Name of the Student
Name of the University
Author Note

1
ADVANCE ENTERPRISE SECURITY
Executive Summary
This report discusses the Advance Enterprise Security. This assignments also elaborate regarding
the importance of this topic in the Information Technology organisation. It elaborates regarding
the case study of the Advance Enterprise Security to identify the problems related to banking as
well as the finance sector. It also discusses the security issues related to cloud application of
banking sector and also how the customers are getting affected by using this kind of applications.
It discusses the solutions related to the case study related to this. This report concludes regarding
the importance of Advanced Enterprise Security related to the banking sector.

2
ADVANCE ENTERPRISE SECURITY
Table of Contents
Introduction......................................................................................................................................3
Case Study and Solution..................................................................................................................3
Conclusion.......................................................................................................................................8

3
ADVANCE ENTERPRISE SECURITY
Introduction
Advanced Enterprise Security is the procedure of reducing the security risk of an
Organization (Adham et al., 2013). For performing security, there are different levels of
authorisation required for various kinds of users. Risk management can also help to manage the
security of an IT organisation. This can achieved by using advanced services related to security
by providing several outsourcing services.
This report discusses the case study of an organisation related to Advanced Enterprise
Security (Ball, Borger & Greenwald, 2013). This report also provides a solution to this kind of
problem. It concludes regarding the necessity of Advanced Enterprise Security of an
organisation.
Case Study and Solution
The banking and finance sector is facing lots of security challenges in their organisation.
Due to the growth of the online banking these are carrying a huge amount of personal
information, user id and passwords of different customers. The banking sector named Investors
Bank is focusing on the strong security measures for giving the security of the customer data.
There are various types of regulations implemented by this bank for the data security of
customers (Beckers et al., 2013). These regulations cannot give total protection from security
threats. Sometimes the server of the bank can hack by the black hat hackers. It leads to the loss
data of the customers they face some challenges related to the security of the data of customers.
These include:

4
ADVANCE ENTERPRISE SECURITY
 Management of the huge amount of the security of data
 The bank authority understands the top level of security for ensuring the efforts
that can target as well as focused.
 Communication is done in a very efficient manner for the technical information of
the security of the Bank.
This bank does not have a strong security policy, and they know that it would be
marathon to cover up all kinds of point (Daniel & Jonathan, 2013). There can be various kind of
attack in the server of the Investors Bank. There are very kinds of attacks that are related to the
online banking of the Investors Bank. The most important attack is Phishing and Pharming. In
this case the attackers can create duplicate websites of the Investors Bank. Then they will send
mostly the false emails. These emails may look like the original email of the Investors Bank
(Dauda & Lee, 2015). The customers have no idea that something is going wrong. But all the
information is forwarded to the black hat attacker. In case of pharming, the customer checks the
correct URL of the Investors Bank in the browser because the redirection is performed by the
reconfiguration of the setting of the customer (Ekstedt et al., 2015). At current scenario, the bank
is using the One Time Password if they catch the data of OTP. But this can be done only a short
period.
For this reason, the black hat hackers design a new real time phishing attack which can
start another secret session on the web page of the Investors Bank contain all the information of
the customer. In case of man-in-middle attack of the banking server, this hampers the only the
portal with the malware that can change without querying anything the customers for any details.
In this type of attack in this bank, when the customer starts the transaction the attacker changes
the information such the account of the targeted bank and amount (He, Tian & Shen, 2015).

5
ADVANCE ENTERPRISE SECURITY
After the confirmation of the transaction customer do not receive any changes in the information
because the attacker modifies the data from the server of the Investors Bank. Authentication of
the OTP is not very important in this type of attack. Mobile malware can also occur for the
server of this bank. It mostly affects the mobile banking sector of this bank. This attack is used to
check to go through the SMS of the customer. It will be forwarded to the server of the attacker.
Investor Bank uses OTP to give authentication to the mobile banking of this bank. By using
these characteristics the attacker can get all the details of the mobile banking of the customer
(He, Tian, & Shen, 2015). The attackers are using the methodology named social engineering to
steal the information of customers.
Investors bank looks this matter very seriously to protect the information of the customer.
They can manage as well as balance the challenge related to the network of the bank to an
acceptable level. It mainly focuses on the remedy of the medium as well as a higher level of
vulnerabilities related to the software of the bank. They are using different kinds of automation
tools to minimise the different kinds of attacks happens on the server of the bank. They are using
the Key Risk Indicators for managing different kinds of risks (Peltier, 2016). Key Risk indicators
are the procedures that can be used by the metrics used by this bank for protecting the increasing
the risk in the several services of this bank. It can detect the appropriate things. It helps the bank
to take some decisions that can be made. It can protect the financial loss of the Investors bank. It
can detect risk very exactly. Advances in the cloud data storage, data aggregation as well as data
federation have enabled in the supply chains of data of the bank. To get rid of risk, the Investor
bank should follow some steps of KRI. They should consider several stakeholders of the bank. It
will make balanced selection of this KRI (Posey et al., 2014). It includes several indicators of the
performance of bank. Investor bank should investigate the main cause of the risks. The bank

6
ADVANCE ENTERPRISE SECURITY
should also notification methods. The banks are providing several types of authentication to
their customers for the phishing terms, hacking, Trojans and man-in-middle attacks. Secure
online security can give customers the confidence to use the online services of this bank. The
organisation named VASCO provides to protect the server-side risk management of this bank. It
majorly protects the various types of cyber-attacks related to the bank. The bank can develop the
secured mobile application for giving protection to the customer data. Investors bank needs
effective security models that have the potential of categorising the customers and the authorised
transactions. The present models are focused on the detection of the fraud instead of giving the
protection of frauds (Roy & Venkateswaran, 2016). This means that proper steps need to be
taken after the happening of the fraud. Analysing various security devices related to this bank it
is noticed that there are various layers of security and also methods that are jointly happened.
Virtual keywords can be the most used model in such a scenario. It can detect the security that is
related to detection of the fraud rather providing the prevention. In this particular case, Secure
Socket layers were not included because it is not considered in all online banking systems. SSL
only giving the security to the network layer but it is not capable of giving the protection against
the attacks (Ryoo et al., 2013). Basically the bank should exactly detect the customer and also
authorise the access to several types of transaction related to banking. This detection policy is
based on two major factors: secret information shared by the customer as well as the banks (For
example the passwords.) And the unique features of the device that can be utilised to access this
kind of service of Investors Bank. The models that are presently accepted by the Investors Bank
for online banking are based on the several layers related to the security. It mainly consists of
parallel solutions and also mechanisms that have the aim to give protection on the banking
application of this bank. Investors Bank can use the digital certificate for providing the

7
ADVANCE ENTERPRISE SECURITY
authentication to the customers as well as the banking server of this bank. This type of
authentication depends on the Public Key Infrastructure and also the Certificate Authority that
indicates the third-party for signing the certificates of the validation. Investors Banks should
provide several types of methodology for giving the security of the browser. This will protect the
customer as well as his or her account from the malware (Singh & Singh, 2016). This can be
performed by investing the area of the memory designed for browser. It will give the facility for
providing the detection of various types of malware and the theft. It will also capture several
informations. Investors Bank can use the virtual keywords for the proper use of the Keyloggers.
It is used to take the information that is typed in the device. These devices are based on the java
program as well as cryptography software. It will allow the portable nature among various kinds
of devices. At present these can be replaced by other attractive procedures that involve less
amount of processing powers and also very slow rate of transaction (Tarhini et al., 2015).
Completely Automated Public Turing Test is used to protect the server of the Investors Bank
from detecting the automated attacks against the authenticated sessions. The device registering is
another for protecting the Investors bank from security threats. This method stops for accessing
the banking server. These are previously known as registered devices. In this method, hardware
fingerprinting can be used for the identification of the customer. Investors bank can investigate
the transactions for creating the behaviour profiles that can provide the customer for accessing
his or her profile. There is another method known as CAPTCHA. This method is used to retrieve
the exact information related to security attacks by using the OCR software.
This bank establishes the digital defence for protecting the security attacks. It will
provide the facility of “One Team” security culture in which all the employees are invested at the
front end against the cybercrime. The banks need to provide a sufficient amount of training to the

8
ADVANCE ENTERPRISE SECURITY
new employees of the bank. The bank should hire a bulk amount of cyber-crime as well as
ethical hacking specialist for protecting the customer data from this type of crime. Investors bank
must hire EC Council Certified Ethical Hackers for preventing against the website hacking done
by black-hat hackers (Vegh, 2013). The bank should provide several kinds of awareness
campaign related to Cybersecurity throughout the year. The bank should provide the employees
the live training in this Cybersecurity. They should provide training for using various kinds of
tools that are related cryptographic security. They are providing information related to the
Cybersecurity to the customers. But it should be regularly. It also provides the campaign related
to the security rules stipulated by American Bar Association. The Digital defence section of this
bank should provide latest technologies and also adopt several risk mitigating approaches. They
provide lots of metrics for giving progress for the information security of the bank (Tarhini et al.,
2015). It includes executive employees as well as the Board. The information security analyst of
this bank provides various strategies related to vulnerability management. This is very easy for
implementation for the bank. The security team should perform tremendous research for
protection of the information of the customer. It will help manage as well as track the risk related
to the information security of Investors Bank (Ryoo et al., 2013). The Digital Defense team of
this bank can provide excellent support regarding this matter.
Conclusion
The information security of the Investors Bank for ensuring various kinds of availability,
integrity as well as the confidentiality of several services of this bank. Three main parts of this is
that software, hardware, and data. In this report, it is explained regarding the various types of
situations related to the security of banking applications in daily life. But it becomes very much
difficult to separate the attacks related to security. The threat is a happening that is responsible

9
ADVANCE ENTERPRISE SECURITY
for causing harm. This harm can happen because of loopholes of vulnerabilities. For tacking this
kind of situation, the security experts can block these threats or terminates the vulnerability. This
report discusses the several security issues related to cloud applications related to Investors bank.
The assignment elaborates the resolving mechanism related to the cloud application of Investors
bank. This report concludes that information technology is very important for banking, as well as
other sectors but the authority, should provide efficient security measure.

10
ADVANCE ENTERPRISE SECURITY
References
Adham, M., Azodi, A., Desmedt, Y., & Karaolis, I. (2013, April). How to attack two-factor
authentication internet banking. In International Conference on Financial Cryptography
and Data Security (pp. 322-328). Springer, Berlin, Heidelberg.
Aliyu, A. A., Rosmain, T., & Takala, J. (2014). Online banking and customer service delivery in
Malaysia: data screening and preliminary findings. Procedia-Social and Behavioral
Sciences, 129, 562-570.
Ball, J., Borger, J., & Greenwald, G. (2013). Revealed: how US and UK spy agencies defeat
internet privacy and security. The Guardian, 6, 2-8.
Beckers, K., Côté, I., Faßbender, S., Heisel, M., & Hofbauer, S. (2013). A pattern-based method
for establishing a cloud-specific information security management system. Requirements
Engineering, 18(4), 343-395.
Daniel, P. E. Z., & Jonathan, A. (2013). Factors affecting the adoption of online banking in
Ghana: implications for bank managers. International Journal of Business and Social
Research, 3(6), 94-108.
Dauda, S. Y., & Lee, J. (2015). Technology adoption: A conjoint analysis of consumers׳
preference on future online banking services. Information Systems, 53, 1-15.
Ekstedt, M., Johnson, P., Lagerström, R., Gorton, D., Nydrén, J., & Shahzad, K. (2015,
September). Securi cad by foreseeti: A cad tool for enterprise cyber security
management. In 2015 IEEE 19th International Enterprise Distributed Object Computing
Workshop (pp. 152-155). IEEE.

11
ADVANCE ENTERPRISE SECURITY
He, W., Tian, X., & Shen, J. (2015, April). Examining Security Risks of Mobile Banking
Applications through Blog Mining. In MAICS (pp. 103-108).
Peltier, T. R. (2016). Information Security Policies, Procedures, and Standards: guidelines for
effective information security management. Auerbach Publications.
Posey, C., Roberts, T. L., Lowry, P. B., & Hightower, R. T. (2014). Bridging the divide: A
qualitative comparison of information security thought patterns between information
security professionals and ordinary organizational insiders. Information &
management, 51(5), 551-567.
Roy, S., & Venkateswaran, P. (2014, March). Online payment system using steganography and
visual cryptography. In 2014 IEEE Students' Conference on Electrical, Electronics and
Computer Science (pp. 1-5). IEEE.
Ryoo, J., Rizvi, S., Aiken, W., & Kissell, J. (2013). Cloud security auditing: challenges and
emerging approaches. IEEE Security & Privacy, 12(6), 68-74.
Singh, S., & Singh, N. (2016, December). Blockchain: Future of financial and cyber security.
In 2016 2nd International Conference on Contemporary Computing and Informatics
(IC3I) (pp. 463-467). IEEE.
Tarhini, A., Mgbemena, C., Trab, M. S. A., & Masa’Deh, R. (2015). User adoption of online
banking in Nigeria: A qualitative study. The Journal of Internet Banking and Commerce, 20(3).
Vegh, S. (2013). Classifying forms of online activism: The case of cyberprotests against the
World Bank. In Cyberactivism (pp. 81-106). Routledge.