Information Security Report: Financial Sector Security Analysis

This report provides a comprehensive overview of information security within financial institutions. It begins by highlighting the importance and objectives of information security, emphasizing the need to protect sensitive customer data and financial transactions. The report delves into potential threats, risks, and vulnerabilities faced by financial organizations, particularly those arising from the increasing reliance on information technology and open systems. It examines information security systems, policies, and monitoring parameters, emphasizing the need for comprehensive strategies. The report also covers the scope and domains of information security policies, the selection of appropriate security standards, and traditional policies followed by financial institutions. Furthermore, it discusses policies for remote access, email usage, network configuration, network protocols, network access, and external access. The report also addresses the importance of testing and verifying the effectiveness of information security systems and outlines a response policy for security incidents. Finally, it explores the types of training required for staff to implement a proper information security program and offers recommendations for accomplishing information security goals, making it a valuable resource for understanding and improving security practices in the financial sector.

Running head: INFORMATION SECURITY
Information Security
Name of the Student:
Name of the University:
Author note:

2INFORMATION SECURITY
Table of Contents
Introduction................................................................................................................................3
1) Importance and objectives of information security............................................................3
2) Potential threats/risks and vulnerabilities..............................................................................3
3) Information security systems/policy......................................................................................3
4) A new information security monitoring parameters and its metrics......................................4
5) Scope and domains of information security policy...............................................................4
6) Select appropriate information security standard with proper justification...........................4
7) Highlight the policies and traditional standards followed by financial institutions..............4
8) Policies for remote access, email usage, network configuration, Network protocols,
network access and external access............................................................................................4
9) Test and verify the effectiveness of the information security system....................................4
10) Response policy when a security accident happens for sample bank..................................5
11) The kinds of training are required for staff to implement proper information security
program......................................................................................................................................5
12) Appropriate recommendations to accomplish information security....................................5
Conclusion..................................................................................................................................5
References..................................................................................................................................6
Timeline.....................................................................................................................................7
Importance and objectives of information security....................................................................7
Select appropriate information security standard with proper justification...............................7
Response policy when a security accident happens for sample bank........................................8

3INFORMATION SECURITY
Introduction
Information security is considered to be a set of practices as well as techniques that
prevent unauthorized access, modification and destruction of sensitive data. The main focus
of information security is to maintain integrity, availability and confidentiality of
information. Information technology is playing a significant role in various industries. With
the growing usage of ICT, security issues are also increasing. Information security is gaining
importance in the financial organizations for securing the sensitive information of the
customers and protecting any financial transaction using IT. This report explains about the
potential risks that are related to the standards along with the parameters that are used for
monitoring information security. This report gives a brief overview about the standards and
policies of information security that are followed by financial organizations. It also provides
suggestions regarding the accomplishment of information security.
1) Objectives and importance of information security
Customer information is considered to be one of the most valuable assets of financial
organizations. Hence, financial organizations are incorporating strong security standards as
well as policies in its business processes for securing sensitive financial information.
Information can be represented in various forms such as printed documents and electronic
files (Kshetri 2013). Information can be transmitted through several communication channels.
Information can take any frame size and it needs to be stored and transmitted in a secure
manner. With a specific end goal to enough deal with these data security hazards that are
winding up always enhanced and perplexing, money related foundations are encouraged
above all else to learn the idea of hazard, and afterward to set up the required safety efforts
and work toward their unswerving execution, similarly as they oversee different attacks
(Kshetri 2014). This paper explains attention deeply parts of data security chance

4INFORMATION SECURITY
administration by monetary establishments. The skills used by Bank of Japan have been used
in this paper. Kim and Kim (2015) stated that bank of Japan has gathered this skill through
thorough research, studies, conference and examination with outside organization and
applicable household. It has also used its experience that it has gained by working for so
many years. The appended "Project of Information Security Measures for Systems That
Make Use of the Internet" calls attention to real things for checking the data safety efforts in
singular frameworks that utilization the Internet (Martins et al. 2014). The connection along
with this paper will serve financial organizations and institutes in creating and actualizing
their data safety efforts. Then, in spite of the fact that the utilization of open frameworks has
opened the best approach to give more advantageous budgetary administrations, it has
additionally differentiated and confused the idea of attacks (Graves et al. 2016). As it were,
while attacks, for example, framework breakdowns and unapproved acts by representatives
have existed paying little heed to shut or open framework condition, with the expanded
dependence on open frameworks, there are currently enormously expanded attacks, for
example, burglary or adjustment of data transmitted over systems (Laudon and Laudon
2016). Moreover, there is the rise of new attacks, for example, unapproved access all things
considered and benefit interferences that are particular to open frameworks.
2) Potential security and data threats, risks and vulnerabilities
Financial organizations such as banks are exposed to potential security as well as data
threats and risks. Information security is being evaluated by financial organizations due to its
transactional risk that is considered to be the most harmful risk for a financial. Japanese
financial organizations are getting to be noticeably mindful that, with the fast changes in the
business condition, it is basic for administration to give clients advantageous monetary
administrations rapidly and cheaply (Dhillon et al. 2016). In order to accomplish this
objective, money related organizations have been continuously using IT, which has

5INFORMATION SECURITY
experienced astonishing advances as of late. There has been an especially substantial measure
of specialized development in the territory of open frameworks encapsulated by the Internet,
and that has made it conceivable to construct such open frameworks significantly more
inexpensively and rapidly than traditional frameworks and to give services to a more
extensive scope of clients too (Li 2015). The monetary business is likewise mindful that a
rapid reaction to the administrative issues of building up a client base is basic, and thusly
more money related foundations utilize the Internet as an approach to accomplish this.
Meanwhile, this expanded dependence on IT and the extended utilization of open framework
in the money related administrations segment engenders data security hazard that requires
new countermeasures for chance administration by individual budgetary organizations.
Selamat and Babatunde (2014) stated that Japanese financial foundations have
actualized safety efforts that are predicated on the utilization of shut frameworks construct
basically in light of centralized computer, for example, (a) physical partition through services
of passages and ways out of computer focuses and through the development of systems with
rented lines, (b) the utilization of redid programming and correspondence conventions
(principles), and (c) observing utilizing surveillance cameras and human observation in
branch. Because of the utilization of such measures, security attacks from the outside have
been moderately uncommon in these shut frameworks (Lipper et al. 2014). With the
expanding push toward open frameworks, it is substantially simpler now to increase
unapproved access all things considered and robbery of information than before. The inside
business preparing frameworks of budgetary foundations are being associated with other
outside systems and a more noteworthy utilization of regular correspondence convention. In
addition, there are numerous gadgets utilized for client exchanges that might be overseen by
monetary establishments less adequately than money allocators and programmed teller
machines (ATMs).

6INFORMATION SECURITY
3) Information security systems and policies
Sharma and Warkentin (2014) mentioned that formulation of security policies and
standards are essential for every financial organization for mitigating security issues that are
involved in its business processes. In light of the more prominent utilization of open
frameworks for a budgetary foundation's numerous business preparing needs, an assortment
of specialty units inside those associations are under strain to execute data safety efforts. For
the whole association to cooperate and successfully execute countermeasures under these
conditions, strategies and their particular points of interest ought to be composed, and after
that it must be guaranteed that the whole association is informed completely (Connolly et al.
2015). Albeit Japanese monetary foundations do have involvement in the utilization of
measures for data security and in many examples these measures appear to have been
conceived on an individual or single framework premise. Japanese money related
organizations are behind their partners in Europe as well as North America with regards to
the cross-sectional countermeasures that are covering the entire framework.
4) New information security monitoring metrics and parameters
Organizations combine the applicable frameworks of risk with all the control sets of
the ISCM or information security continuous monitoring methodology for providing a
holistic approach to compliance and carrying out the process of risk management (Kidwell et
al. 2016). This can be done by providing controls over a wide range of areas along with a
high level details and guidance on its metrics. As the utilization of open frameworks
increments, there is a relevant need to get a handle on the data security attacks confronting
the whole association precisely and to build up arrangements and norms that are vital for the
definition and usage of fitting countermeasures (Von Solms and Van Niekerk 2013). Data
security arrangement is the systematization of methodologies and strategies identified with
the plan of data safety efforts to be connected inside an association so as to react to the

7INFORMATION SECURITY
requirements as sketched out above. It is an arrangement on shields went for playing it safe to
guarantee security of data and data frameworks claimed by an association. By and large
talking, much of the time it comprises of a fundamental way to deal with data safety efforts
essential approach and "measures and benchmarks material all through the association norms.
5) Domains and scope of information security policy
The domain as well as scope of the information security policy needs to be defined
after a financial institute implements its security policies and measures for the purpose of
securing information. The formulation of data security strategy is relied upon to bring
budgetary establishments the adequacy of upgraded security levels as made conceivable by
the usage of exhaustive and successful data safety efforts for the whole association. As of
now clarified, both its significance and attacks inalienable to IT are expanding for budgetary
establishments. In this way, it turns out to be evident that one of the basic issues of
organizations is the administration of data security hazard on an association. Kshetri (2014)
commented that keeping in mind the end goal to guarantee the required security level, it is
important to commit the proper administration assets and to increase satisfactory
comprehension and participation from every specialty unit inside the monetary organizations.
In any case, it is troublesome for officials and staff to ordinarily detect the immediate focal
points of data safety efforts, and thusly, it is difficult to advance these measures in a base up.
In this manner, considering own particular IT techniques, administration is prescribed to play
a dynamic part in the hazard administration process (Joo and Yoon 2014). This might be
carried out, for instance, by ensuring that the administration gets an exact idea and view of
data security hazards and propose vital measures to overcome it. In particular, there is a need
to make a reasonable and solid sense that the whole association must hold fast to this strategy
by detailing data security approach under the administration of administration. The duties of

8INFORMATION SECURITY
every specialty unit identified with data security and tenets, keeping in mind that issues
emerge because of breaks of approach, ought to be clear to all inside the association.
6) Selection of appropriate information security standard with proper justification
Organizations need to select an appropriate security standard out of several standards
that is best suited for its business processes. Galliers and Leidner (2014) stated that in the
event that there is even just a single gap in data security, there is a hazard that unapproved
gets to or other hurtful acts may happen. In this way, it is essential to intermittently affirm the
most recent data on security and to set up components in a day by day course of business for
checking the security arrangement itself as fundamental. As worldwide business operations
and association of frameworks create, Japanese monetary organizations will be required to
guarantee that their data security strategies are perfect with universal benchmarks (Abbasi et
al. 2015). To accomplish this, it is ideal that they assess the reasonableness of their own
measures frequently, while offering thought to the most recent innovation patterns and
legitimately alluding to worldwide gauges and rules 16 detailed by the ISO (International
Organization for Standardization). When data security approach is characterized, security
levels and definite substance of safety efforts required for each different framework are
resolved. With a shut framework, essential hardware is situated in a computerfocus and
subsequently hazard could be confined in framework divisions, especially in framework
working units. Be that as it may, with application to primary operations of open systems, as
epitomized by the Internet, different security advancements are important to guarantee
required data security levels. In any case, these security advancements are not generally
simple for clients to actualize as a result of different limitations, for example, cost of
presentation and its constrained flow. In this manner, in view of an adequate level of data
security hazard and taking expenses into Unauthorized access, Closed frameworks, Firewall
Encryption, Theft Alteration, VPN (virtual private networks), Encryption Digital mark, Use

9INFORMATION SECURITY
of shut systems, One-time passwords, Digital time-stamping, Biometric confirmation, Digital
mark, Open frameworks account, Impersonation ID Password, each monetary establishment
should draft thorough measures by properly joining advancements as per the significance of
data and data frameworks and different elements.
7) Highlight of the policies as well as traditional standards followed by financial
institutions
The traditional standards and contextual policies that are followed by financial
organizations have been explained in the point of this study. Electronic confirmation utilizing
open key cryptography is now settled and very assessed for giving a larger amount of security
than passwords (Fahy 2014). Nonetheless, since electronic confirmation isn't exceptionally
easy to understand, it has not gotten on as a technique for client verification in Internet saving
money and different divisions. In any case, should IC cards that contain private keys as well
as computerized declarations come to be sold at a low cost and turn into a settlement measure
that is general; we can anticipate that money related establishments will encourage the
utilization of open key cryptography (Kahate 2013). In addition, new validation innovations
are advancing, for example, biometric verification and computerized time stamping (an
"advanced legal official" innovation, which permits confirmation by an outsider of "who
made and sent what information and when") that utilizes physical properties, such as,
fingerprints, penmanship, retina imaging and voice prints. If, later on, different conditions for
presentation are set up pair with propels in innovation and the more far reaching utilization of
such innovation, or if attacks ought to uplift as a result of exchange sum limits being raised, it
will be a smart thought to emphatically seek after approaches to apply new data security
innovation as the necessities emerge. The quick pace of mechanical progress as for the
equipment and programming that contain open frameworks implies that security gaps are
persistently springing up, and, if these openings are dismissed, they will ease the process of

10INFORMATION SECURITY
hacking and various other types of abuses (Ab Rahman and Choo 2015). Hence, any data
concerning security gaps must be instantly researched to decide if an issue exists, and
appropriate measures executed if vital. In such manner, it is attractive to (an) appropriately
assess to what degree attacks may be brought around then in the earth, (b) input assets
esteemed fundamental immediately, and (c) quickly execute the vital measures. It is attractive
to stay up to date with improvements on the innovative front all the time. Only concocting
data safety efforts on an individual premise won't create powerful outcomes. For instance, in
taking measures to forestall unapproved get to, simply putting in a firewall isn't sufficient;
money related establishments must be continually mindful of the likelihood of unapproved
get to and stay watchful for indications of such intrusive exercises (Lipper et al. 2014). By
social affair, data identified with examples of unauthorized access as well as firewall
openings and executing fitting countermeasures, the danger of assault can be brought down.
It is additionally essential to get ready for threats by setting up crisis measures to limit harm
and to have systems prepared for quick warning ahead of time. Moreover, the usage of
interruption tests appointed to particular organizations is significant to affirm the viability of
every safety effort. Fitting execution and administration are important to get the full
advantage of data safety efforts. Data security levels can be maintained and also enhanced by
building up a ceaseless checking cycle for (a) examining data security attacks (to what
degree, where and what type of hazard), (b) concocting as well as actualizing both the
innovation and the framework based countermeasures for the perceived attacks, (c) teaching,
training and preparing workers (counting part-clocks and also subcontractors), (d) affirming
the status and position of execution via data security reviews, and (e) ensuring that the review
that comes about are reflected in future investigation of the hazards. One specific result of the
more noteworthy measure of appropriated handling affected by frameworks is that the
powerless purposes of data safety efforts might be left unnoticed. Also, over the long haul,

11INFORMATION SECURITY
conventional safety efforts end up noticeably lacking in view of changes in the innovative
condition (Grinblatt and Titman 2016). In particular, there are not a couple of cases that
element to harm data security in frameworks utilizing the Internet are continually and
constantly showing up. In light of that, we need to continue refreshing countermeasures. In
these cases, if a checking component is as of now settled, intermittent examinations can be
directed to stay up to date with new attacks and plan for compelling reactions by the whole
association.
8) Policies for email usage, remote access, network configuration, network access,
network protocols and external access
According to Da Veiga and Martins (2015), there are various areas that are included
in financial organizations such as network configuration, remote access, protocols and access
that require policies as well as security measures for securing information in the organization.
As portrayed above, all together for monetary foundations to capitalize on IT insurgency to
build up their organizations, they should turn out to be adequately mindful of the obviously,
given that the specifications and level of hazard administration required will shift enormously
contingent upon the framework utilized and the business exercises of each money related
establishment and furthermore given the emotional changes originating from specialized
advancement, there is no single solution for security (Bond and Goldstein 2015). Each
budgetary establishment should always refresh its own reaction while alluding to the different
rules and other significant data distributed by universal associations, institutionalization
associations, and different organizations. The Bank of Japan is mainly focused on supporting
such endeavours through budgetary establishments and also will take after the advance made
by each and every money related organizations in its administration of data security chance
from individual monetary foundation's hazard administration see. As expressed in "Standards
for in the vicinity Examination and Off-site Monitoring for Fiscal 2000," the Bank is

12INFORMATION SECURITY
persistently trying to acquire an exact idea of the conditions at money related organizations
and also encourage their executions of required measures, including through the Bank's
focused on examinations with an accentuation on data security.
9) Testing and verifying the effectiveness of the information security system
Testing and verification of the system effectiveness is carried out after the
implementation of information security system. Data security is accomplished by actualizing
an appropriate arrangement of controls, including forms, strategies, techniques, hierarchical
structures, programming as well as equipment security systems (Hovav and Gray 2014). The
way towards setting up, checking, actualizing, evaluating and improving these controls
expect association to persistently and constantly distinguish and deal with each and every
adjustments in the security attacks, business condition, industry best practices along with
lawful prerequisites. This is to ensure that specific security along with business objectives of
the association is met and the security procedure needs to be done in conjunction with various
business administration forms and procedures (Dhaliwal et al. 2014). For precisely
recognizing and seeing each and every progression that the associations are confronting,
contributions from all the divisions along the association are critical. Administration has
several objectives for the associations, and some of the time specialized individuals are not in
the position for comprehending these subtleties. The two gatherings need to comprehend that
security is not something that can be kept in a bundle and purchased from a shop. It is
considered to be an objective that the two gatherings endeavour to keep up. Information
Security Management Committee can be set up to fill up the security gap. There is
dependably a misinterpretation on the duties of actualizing data security in an association.
The prevalent concept is based on the fact that it is only the duty of the Information Security
Department to ensure that the organizational data is secure and well protected. In any case,
this is in no way, shape or form right.