A Glimpse Into Security Assessments – Safeguarding Your Wealth

Most people would keep quiet about their wealth. This is the knowledge that they may not want to share with anyone or any organisations. Nevertheless, people are willing to entrust their savings to banks: not for the petty interest that banks will generate for them, but mainly because banks are simply the most secure and convenient place to put their money in. Apart from acting as fund depositories and sources of lending, banks are intertwined with everyone’s lives as the service providers of various forms of payments, eg. cash dispensers at ATM, credit card bills payment, etc. Governments understand the important role that banks play and are naturally taking a cautious approach to ensure that banks are exercising good governance to safeguard their patrons’ wealth.

So when banks start to grow beyond their brick and mortar presence and start offering more innovative channels of payment, eg. over internet and mobile phone, many governments are looking very carefully on these development and make sure that sufficient security measures are in place. The Hong Kong Monetary Authority (HKMA) is the regulatory body in Hong Kong with oversight on the operation of the “Authorised Institutions” (AI is used as the collective terms to address licensed banks, restricted licence banks, and deposit-taking companies). The regulators understand the threat posed by cyber attacks in the new fintech era. “Financial crimes will occur whenever there is money to be made, and for sure criminals and hackers alike will use their best endeavours to penetrate the defence of the cyber world to rob or steal”, commented Norman Chan, Chief Executive of HKMA in his keynote address at the Cyber Security Summit on 18 May 2016. HKMA has since in the early 2000’s published numerous papers in the form of manuals, code of practice, circulars, guidelines that AIs need to follow. The objective is to allow a more secure and sustainable growth of the AI’s in the cyber age. When a bank roll out a new service, the bank’s officers (yes, there is a “s” here, we are talking about the heads of departments in Risk, IT, Compliance) will need to sign on the HKMA’s Compliance Assessment Form, signifying that the AI has completed all due diligence process to follow the industry good practices, performed adequate risk management, and fulfilled all relevant regulatory requirements.

How can the banks know that they are following “industry good practices”, what risks are the banks exposed of, how to identify them, how to mitigate these risk “adequately”, which regulatory requirements are applicable to them ? What if these due-diligence processes are not handled correctly? These are not trivial questions. Getting the answers incorrectly will result in a delayed launch of products and even a “private session” with the regulator. Now you can appreciate that signing this Compliance Assessment Form is never simple. It constitutes a major undertaking by the bank and by its officers. For those readers who have tried to convince a bank how great your product is, but was puzzled by the never-ending questions from your bank clients, you may start to appreciate the issues that your banks clients have to resolve, before investing their money on your product.

Readers interested in knowing more about the security assessment process can contact the author directly. The author will be pleased to explain how your products’ security can be enhanced while meeting regulatory requirements at the same time.

About Thales:

Thales Critical Information Systems and Cybersecurity (www.thalesgroup.com/cic), one of the Hong Kong Mobility Partners, operates a security consulting practice across the globe.  Thales’ clients include airlines, financial services, the health sector, manufacturing, telecoms, utilities companies, and government agencies.  The company recently completed a number of independent security assessment projects to allow some top banks, payment service providers and technology vendors to launch their new products and services on NFC mobile, eCheque and P2P payments in Asia.

About the author:

Welland Chu (Welland.Chu@thales-esecurity.com) has over 22 years of experience on information security. He is certified as an Information System Auditor (CISA). He provides information security consulting service to governments and large enterprises across Asia.