Capitol Tech Talk Feb 17 2022 Cybersecurity Challenges in Financial Sector

Capitol Technology University Presents

Presented by Dr. Susan Goodwin
Cybersecurity Challenges in
the Financial Sector

Agenda
Bill Gibbs
Cap Tech Talks Host
1. About Capitol Technology University
2. Session pointers
3. About the presenter
4. Presentation: Dr. Susan Goodwin
5. Q & A
6. Upcoming webinars
7. Recording, Slides, Certificate

About
Established in 1927, We are
one of the only private
Universities in the state of
Maryland specifically
dedicated to engineering,
cybersecurity, computer
sciences and tech
management.

Nonprofit, Private &
Accredited
Capitol is a nonprofit, private accredited university
located in Laurel, Maryland, USA
Capitol Technology University is
accredited by the Commission on
Higher Education of the Middle
States Association of Colleges
and Schools
The University is authorized by
the State of Maryland to confer
Associate’s (A.A.S.), Bachelor’s
(B.S.), Master’s (M.S., M.B.A.,
T.M.B.A), and Doctoral
(D.B.A.,D.Sc., Ph.D.) degrees.

Session Pointers
• We will answer questions at the conclusion of the presentation. At any
time you can post a question in the text chat and we will answer as many
as we can.
• Microphones and webcams are not activated for participants.
• A link to the recording and to the slides will be sent to all registrants and
available on our webinar web page.
• A participation certificate is available by request for both Live Session and
On Demand viewers.

About the presenter: Dr. Susan
Goodwin
• Cybersecurity Consultant / Subject Matter Expert
• Capitol Technology University:
• Ph.D. Technology (2020)
• Adjunct Faculty / Dissertation Chair
• University of Massachusetts Lowell (M.S.
Cybersecurity, M.S. Information Technology, B.S.
Computer Science)
• Senior Member: IEEE, Society of Women Engineers
• Industry engineer experience: financial, healthcare,
government, military, and commercial; research, development,
consulting, cybersecurity/information assurance, system
administration, release engineering, documentation, quality
assurance, risk management
• Musician: cello, flute

Agenda
 Research
 Financial Sector Cybersecurity Challenges
 Cybersecurity Frameworks
 The NIST Cybersecurity Framework
 Recommendations
 Conclusion
 Q&A

Research
Dissertation: The Need for a Financial Sector Legal Standard to Support the NIST Framework for
Improving Critical Infrastructure Cybersecurity (Dr. Susan Goodwin, Capitol Technology University,
ProQuest, January 2021)
• My dissertation focuses on research and analysis of reported Financial Sector risks, failures and
impacts due to weak or lack of cybersecurity controls.
• The study also provides analysis of success stories of Financial Sector and other entities which have
adopted a cybersecurity framework.
• Dissertation research findings assert an upward trend of cyber attacks in the U.S. Financial Sector
during the COVID-19 pandemic, showing a need for adoption of cybersecurity best practices
throughout the sector to mitigate the trend.
• Several industry reports indicated a continued increase in cyber attacks from 2018 to 2020 with no
downward trends.

Financial Sector Cybersecurity
Challenges
Global cyber attack opportunists used the 2020 COVID-19 pandemic to exploit cybersecurity
vulnerabilities and gaps in the U.S. Financial Sector.
In 2020, Kellerman and Murphy published a report, Modern Bank Heists, summarizing the
findings of the VMWare Carbon Black survey of 25 chief information security officers from
leading financial institutions
https://www.vmware.com/resources/security/modern-bank-heists-2020.html

Challenges
• 27% of all cyber attacks in 2020 have targeted either the healthcare sector or the
financial sector, according to VMware Carbon Black data.
• Over one-quarter of all cyber attacks which occurred during the first five months of
2020 targeted the financial and healthcare sectors.
• The two sectors are entities within the United States Critical Infrastructure.

Challenges
• 82% of surveyed financial institutions said cybercriminals have become more
sophisticated, leveraging highly targeted social engineering attacks and advanced
tactics, techniques and procedures for hiding malicious activity.
• These criminals exploit weaknesses in people, processes, and technology to gain
a foothold and persist in the network, enabling the ability to transfer funds and
exfiltrate sensitive data.

Challenges
• 64% of surveyed financial institutions reported increased attempts of wire transfer
fraud, a 17 percent increase over 2019.
• The statistical upward trend only includes the first five months of 2020, but also
during the beginning of the pandemic.

Challenges
• 25% of surveyed financial institutions said they were targeted by destructive
attacks over the past year.
• Destructive attacks are rarely conducted for financial gain. Rather, these attacks
are launched to be punitive by destroying data.
• One risk associated with this type of attack is the permanent loss of data when a
financial sector entity does not have a data backup plan.

Challenges
• Ransomware attacks against the financial sector have increased by nine times
from the beginning of February to the end of April 2020.
• This statistical upward trend occurred during the onset of the pandemic in the
United States.

Challenges
• 20% of surveyed financial institutions experienced a watering-hole attack during
the past year.
• In these attacks, financial institution and bank regulation websites are hijacked
and used to pollute visitors’ browsers.
• This tactic is increasing as cybercriminals recognize the implicit trust consumers
have in bank brands.

Challenges
• The research results demonstrate that the number of cyber attacks in the U.S.
Financial Sector continue to grow in an upward trend across several major
categories of attacks between the beginning of 2018 and the end of the first five
months of 2020.
• The trends continued to increase upon the emergence of the 2020 COVID-19
pandemic, such as the number of ransomware attacks multiplying by nine times
between February and April 2020.

Challenges
• Cybercriminals became more sophisticated and exploiting weaknesses in people,
processes, and technology in the U.S. Financial Sector.
• Cyber attack actors took advantage of the pandemic to further seek and exploit
cyber infrastructures in the U.S. Financial Sector.

Cybersecurity Frameworks
Prameet Roy, Information Security & Risk Management Consultant, performed a study in 2020
comparing the NIST Cybersecurity Framework and the ISO 27001 Information Security Standard.
Roy found that both frameworks provide robust methodologies on cybersecurity which address
threats and breaches, ensuring the 3 pillars of confidentiality, integrity, and availability.
Roy concluded that the main advantages of the NIST Cybersecurity Framework over ISO 27001
are:
• The structure of the NIST Framework enables its implementation at an enterprise level
• The NIST Framework is more user friendly
• The NIST Framework is streamlined
https://www.nist.gov/cyberframework

Cybersecurity Frameworks
• The National Institute of Standards and Technology (NIST) published the NIST Framework
for Improving Critical Infrastructure Cybersecurity of 2014, followed by an updated version in
2017.
• The Framework, which was developed as a joint effort between the U.S. Federal Government
and the private sector, serves only as a guideline and is not mandated by any legal authority.
Currently, adoption of the Framework is voluntary.

The NIST Cybersecurity
Framework
The NIST Framework provides general guidance which pro-actively addresses the elements of each
of the findings:
• Risk management
• Planning cybersecurity incident response
• Setting policies processes, and procedures
• Planning the requirements for protective technology
• Planning controls and detection
• Planning post-incident analysis
• Planning mitigation for future incidents

Framework
The NIST Cybersecurity Framework consists of Three Components:
1. Framework Core
2. Implementation Tiers
3. Profile
https://www.nist.gov/cyberframework/online-learning/components-framework

Framework
1. Framework Core
• A set of desired cybersecurity activities and outcomes organized into categories and aligned
to Informative References
• Designed to be intuitive and simplistic
• Consists of three parts: Functions, Categories, and Subcategories
• Five high level functions: Identify, Protect, Detect, Respond, and Recover

Framework
The NIST Cybersecurity Framework Core:

Framework
2. Implementation Tiers
• Tiers describe the degree to which an organization’s cybersecurity risk management
practices show the characteristics defined in the Framework
• The Tiers range from Partial (Tier 1) to Adaptive (Tier 4) and describe an increasing degree
of rigor, and how well integrated cybersecurity risk decisions are into broader risk decisions,
and the degree to which the organization shares and receives cybersecurity info from
external parties
• Tiers do not necessarily represent maturity levels

Framework
The NIST Cybersecurity Framework Implementation Tiers

Framework
3. Profile
• An organization's unique alignment of organizational requirements, objectives, risk appetite,
and resources against the desired outcomes of the Framework Core
• Profiles can be used to identify opportunities for improving cybersecurity posture by
comparing a “Current” Profile with a “Target” Profile

Framework
• The authors of the NIST Framework intended its guidance to be voluntarily adoptable by any
organization in any country (not only by U.S. organizations), and the Framework’s core functions
are identical for all adopting organizations
• The findings and recommendations from NIST Framework assessments, are examples for other
organizations, such as U.S. Financial Sector entities, for cybersecurity risk assessment and
mitigation through Framework adoption.
• The Framework’s cybersecurity principles and risk management guidance can apply to any
organization.

Framework
According to the U.S. Government’s Cybersecurity & Infrastructure Security Agency (CISA), the
NIST Cybersecurity Framework can be used for:
• Alignment of mission objectives with cybersecurity decisions
• Organization of security requirements derived from policy, legislation, regulation, and best
practices in industry
• Communication of cybersecurity requirements to stakeholders, including suppliers and partners
• Integration of the risk management of civil liberties and privacy into cybersecurity activities
• Measure current state and express desired state
• Prioritize cybersecurity resources and objectives
• Analysis of risk and expenditure trade-offs
https://www.cisa.gov/using-cybersecurity-framework

Framework
In 2020, NIST published an online catalog of eight NIST Cybersecurity Framework global success
stories, including three U.S. academic institutions: University of Kansas Medical Center, University
of Pittsburgh, and University of Chicago.
The university implements the Baldrige Cybersecurity Excellence Builder, a framework for self-
assessment and program development, in conjunction with the NIST Cybersecurity Framework.
Results and positive impact of Framework adoption by the University of Kansas Medical Center
include:
• Identification of gaps resulting in action plans, funding opportunities and deep alignment to
the business
• Better understanding by team members of their roles and engaging other employees and
partners in cybersecurity protection
https://www.nist.gov/cyberframework/success-stories

Framework
Initially, the University of Pittsburgh did not have centralized cybersecurity management or a
unifying cybersecurity standard.
Adoption and implementation of the Framework provided the university with “better knowledge and
perspective about its management of cybersecurity risks and identified multiple opportunities for
better coordination of its cybersecurity approaches, investments, and priority needs”.
The benefits of Framework adoption by the University of Pittsburgh include:
• Consistency in data management standards across a decentralized environment
• Execution of a security assessment across the organization which identified the need for a
prioritized data security mitigation and remediation plan

Framework
All twenty-three departments of the Biological Sciences Division of the University of Chicago
benefitted from implementation of the Framework with a “consistent, risk-informed, cybersecurity
program” of:
• Aligned security risk expectations
• A common set of target outcomes
• Prioritized security goals
Results of Framework implementation include the education of all users on the university’s
cybersecurity program and continuous monitoring of program improvements.

Recommendations
• The Financial Sector, one of sixteen Department of Homeland Security critical infrastructure sectors,
should be mandated to adopt a framework such as the NIST Cybersecurity Framework, based on
risk impacts and inconsistency and accountability of best practices implementation across the sector.
• As an example, the NIST Cybersecurity Framework provides a tailorable outline of best practices,
including risk management.

Recommendations
• The NIST Cybersecurity Framework has been proven to be successful in preventing cybersecurity
incidents as determined in case studies from academia and various industries.
• The implementation of the NIST Cybersecurity Framework in each of the cases was proven to
mitigate or reduce cyber risk impacts as well as strengthen the organizations’ cybersecurity
infrastructure.

Conclusion
• Until the U.S. Financial Sector takes action to adopt consistent cybersecurity best practices,
especially as shown by vulnerabilities exposed during a pandemic, the risk impacts will continue to
rise as cyber criminals become more sophisticated in their actions.
• Vulnerabilities during the pandemic include gaps in infrastructure personnel coverage, cybersecurity
infrastructure weaknesses due to employees working from home, delays of cybersecurity
infrastructure updates.
• Established and proven frameworks, such as the NIST Cybersecurity Framework, provide guidance
for prevention and mitigation of such vulnerabilities.

Questions
Dr. Susan Goodwin, Ph.D.
Adjunct Faculty
Capitol Technology University
smgoodwin@captechu.edu

Upcoming Webinars
Infrastructure: Critical
Challenges &
Differences
Between the Private &
Public Sectors
Dr. Nikki Robinson
Mar.17
Tech Career Skills
Identification &
Communication in
Writing a Resume
Connie Harrington
Apr. 14
Tips for Finding
Career Success in
Technology
Vennard Wright
May 19

www.captechu.edu/webinar-series
To learn more, and to register visit:

Recording, Slides & Certificate
A copy of the slides and a
link to the recording will be
sent to all registrants.
Watch for an email
A Certificate of Completion
is available upon request to
both live session and On
Demand viewers
Simply reply to the email

Thanks for Joining Us!
Thank You!
This concludes today’s webinar
Watch for a follow up email that contains:
1. How to get a Participation Certificate (Available by
request for both Live Session and On Demand
viewers)
2. Link to the webinar recording and slides
3. Info on upcoming webinars

Capitol Tech Talk Feb 17 2022 Cybersecurity Challenges in Financial Sector

More Related Content

What's hot

What's hot (20)

Similar to Capitol Tech Talk Feb 17 2022 Cybersecurity Challenges in Financial Sector

Similar to Capitol Tech Talk Feb 17 2022 Cybersecurity Challenges in Financial Sector (20)

More from CapitolTechU

More from CapitolTechU (20)

Recently uploaded

Recently uploaded (20)

Capitol Tech Talk Feb 17 2022 Cybersecurity Challenges in Financial Sector