Four Main Cybersecurity Challenges for Financial Services Firms

Many corporate executives are aware that without digital experience (DX), they risk becoming obsolete dinosaurs, easily defeated by nimble and transforming competitors. Internally, DX can allow employees to be more productive and engaged, and Gallup studies show that highly engaged employees drive 21 percent higher profitability. 

Externally, DX can ensure frictionless customer experience (CX), which is why IDC says firms will spend $2.3 trillion on DX in 2023. Most CIOs know that over 40 percent of their IT budget is now slated to DX, but most funds wind up in the garbage can, as 70 percent of projects fail.

Why is cybersecurity so important to financial firms?

Financial services firms are among the most regulated and in recent years, most U.S. states have implemented comprehensive civil codes that are difficult to interpret. The New York Department of Financial Services (NYDFS) guidelines and California Consumer Privacy Act (AB 375) are among the more stringent, but almost all states now have strict personally identifiable information (PII) protection requirements. 

The onus is now on security teams to prove that "false positive" security incidents are not positive, and if inadequate visibility prevents this, firms could be fined, forced to make public announcements and sued for millions by attorneys general. Internationally, new General Data Protection Regulation (GDPR) and Payment Services Directive 2.0 (PSD2) regulations are also causing headaches as financial services firms struggle to comply.

Cybersecurity teams now require far more visibility and connectivity than ever before. They need next-generation firewall protection optimized for many different use case including electronic trading infrastructures, secure branch connectivity, internal segmentation and advanced threat protection.  

At the same time, teams must enhance compliance mandate reporting and ensure the protection of PII. They must do all this with a security fabric that can protect the entire organization with multilayered defense visibility on a single pane of glass with centralized policy controls. All this needs to be accomplished without causing undue roadblocks to revenue-generating DX or CX initiatives. 

To avoid the costly consequences of a security breach, compliance fines or lawsuits and DX and CX initiative failures, financial services firms must now consider four key requirements for next-generation security technologies.

1. Near-zero jitter

When it comes to firewalls, you can't afford to rely on anything less than extremely high deterministic performance, especially for electronic trading. Protecting traffic between electronic trading platforms is paramount, and your firm's DX and CX initiatives likely require providing seamless and real-time information to customers.

Both could be undermined within the first few seconds after a transaction if the customer experiences a delay or if misleading information is transmitted to the banking side of the business. Both can occur if small packets of data pass through the firewall in non-sequential order and cause "jitter."

Fortinet's Next-Generation Firewalls (NGFWs) avoid this problem by offering the lowest latency in the industry, with near-zero jitter. Tests performed at two leading global banks validate this claim. Fortinet's NGFWs also allow deep inspection of secure sockets layer (SSL)/transport layer security (TLS) encrypted traffic with minimal impact on network performance. 

NGFWs can protect traffic moving between corporate systems and electronic trading infrastructures. Security features for mobile environments, intent-based segmentation with zero-trust access and a built-in intrusion prevention system (IPS) eliminate the need for disparate "point solutions." High visibility is assured through a "single-pane-of-glass" so you can improve operational efficiency. A robust application programming interface (API) enables automation to help you tailor electronic trading workflows and policies as required.

WWT recommends the FortiGate NGFW, which can upgrade your security posture by offering:

• highly scalable segmentation and ultra-low latency to protect network segments;
• automated workflow and auditing to continuously meet compliance mandates;
• threat sharing across an entire attack surface to provide fast and automated protection;
• single pane-of-glass visibility to manage assets regardless of location or form factor;
• SSL inspection to protect against malware attacks hiding in encrypted traffic; and
• continuous intelligence updates to protect against known and unknown threats.

2. Integrated security architecture with open APIs

Given the proliferation of cloud and mobile usage, most firms no longer maintain all their infrastructure on-premises within a controlled data center. Internet of Things (IoT) and mobile devices dominate the edge, as software-defined wide area networks (SD-WANs) drive traffic down public internet highways. 

For financial firms, given aggressive DX and CX initiatives and increased compliance demands, a perimeter-based approach to security is no longer feasible. What's needed is a virtual perimeter across multiple public and private clouds, IoT and mobile devices, corporate data centers and branch offices.

Fortinet NGFWs answer the call by using purpose-built security processors and vigorous threat intelligence from FortiGuard Labs to deliver a high-performance examination of encrypted and clear-texted traffic. Threat and infrastructure visibility is maintained through a single-pane-of-glass, and control across on-prem and cloud-based environments ensures stringent security and operational efficiency. 

The added benefit of Fortinet Security Fabric enables tight integration for Fortinet and third-party tools using Fabric Connectors and an open API. Advanced artificial intelligence (AI) powers effective threat intelligence that underscores the entire security architecture and enables real-time detection and response.

WWT can help you deploy and integrate the Fortinet Security Fabric with NGFWs to:

• provide a virtual perimeter across multiple clouds, and IoT/mobile devices;
• eliminate manual security processes to improve operational efficiency;
• consolidate security solutions to eliminate redundant licenses and lower costs;
• simplify compliance reporting and avoids frantic, last-minute audit preparations;
• enhance security with real-time threat intelligence and automated response workflows; and
• deliver a high-performance inspection of encrypted and clear-texted traffic.

3. Remote network security

Most financial institutions have numerous branch or remote locations. IoT and mobile device usage increased network traffic exponentially, especially between cloud data centers and branch/remote locations. DX and CX initiative goals escalated the need for increased security and lower costs while maintaining acceptable levels of network performance to minimize customer friction. Using multiprotocol label switching (MPLS) bandwidth can be time-consuming and expensive, and usually does not scale to meet future network requirements.

In recent years, cyber criminals started feasting on vulnerable IoT and mobile edge devices as they are often easier to penetrate. A secure SD-WAN helps to eliminate risks by ensuring network traffic is secure when traveling across multiple connections between corporate, remote cloud and branch locations. Routing all traffic through the data center for inspection is no longer required, which prevents latency bottlenecks that can throttle CX efficiency. Expensive bandwidth investments and scalability roadblocks are avoided as branch locations are added.

WWT recommends simplifying and merging branch office networking and security capabilities by using a Fortinet SD-Branch, which can be administered from a single FortiGate NGFW. This solution combines FortiSwitch switches, FortiAP wireless access points and the FortiExtender LTE WAN extender. NSS Labs validated higher SD WAN performance and an order of magnitude lower TCO against most other solutions. 

Full visibility and control over edge IoT devices is provided by the FortiNAC network access control (NAC) solution. This can be a critical component as policing electronic and physical access points has become increasingly difficult. Imagine a scenario where a hacker, posing as a vendor with branch access, gains access to your network via a USB device. Also, a new employee might misconfigure a system or incorrectly attach a peripheral device that could cause a security breach, system failure or expensive downtime. 

Now imagine failing a compliance audit due to the inability to disprove a false positive caused by a lack of visibility. FortiNAC can help avoid these catastrophic consequences by improving visibility and offering detailed profiling of headless devices on your network via agent and agentless scanning for detection and classification.

WWT can help you deploy FortiNAC, FortiGate Secure SD-WAN and Fortinet SD-Branch to:

• simplify and merge branch office networking and security capabilities;
• lower the risk of malicious or inadvertent damage from unknown network devices;
• make it harder for attackers to penetrate sensitive information from branch locations; and
• improve operational efficiency by combining networking and security into a single solution.

4. Advanced threat protection

To comply with new compliance and state mandates, security teams must often analyze hundreds or even thousands of alerts to weed out the false positives. Insider threats are also escalating and can be just as difficult to isolate and control. Best practices dictate a two-pronged approach to target malicious malware and evasive attackers simultaneously. This can be accomplished through real-time threat intelligence.

WWT best practice recommendations include using Fortinet Security Fabric tools to leverage threat intelligence from FortiGuard Labs, which is based on one of the world's largest intelligence networks. Advanced AI and machine learning (ML) help identify zero-day and unknown threats. 

FortiSandbox provides an additional layer of defense by examining unknown files in a safe location before allowing them onto your network. The secure sockets layer/transport layer security (SSL/TLS) inspection capabilities in FortiGate NGFWs can spot encrypted malware and other suspicious traffic without diminishing performance or impacting DX and CX.

FortiDeceptor snares would-be attackers by luring them into exposing their identity before they can cause damage. FortiInsight continually monitors users and endpoints for noncompliant, suspicious or anomalous behavior to mitigate insider threats. 

Two-pronged advanced threat protection fortifies financial firms against malicious attacks by: 

• targeting malicious malware and evasive attackers simultaneously;
• creating a multilayer defense to detect zero-day threats; and
• catching attackers in the act by matching their technological sophistication.

WWT, Fortinet & financial services

Financial services firms are among the most regulated, attacked and at risk for DX and CX failures due to ultra-high cybersecurity requirements. Protecting valuable assets, PII and sensitive information while empowering compliance and successful DX and CX initiatives creates a difficult balance. 

The Fortinet Security Fabric, deployed and integrated by WWT, offers a unified platform that enables you to build a secure, efficient and integrated network that dramatically lowers the risk of cyber attacks while ensuring compliance and DX/CX success.

WWT is a Fortinet authorized partner that uses a proven and innovative approach to help our customers discover, evaluate, architect and implement advanced technology. We take an integrated approach to security rather than focusing on point solutions. This helps us align business goals and objectives to technical solutions, providing more effective outcomes and solutions that further the development of an enterprise architecture. 

Learn more about how we can integrate and deploy Fortinet solutions to help you reduce vulnerabilities, setting the stage for future innovation. Schedule time in our labs today.