Security in Digital Finance – Jussi Leskinen, F-Secure
The way to compare an analog and digital world in fraud and crime area is really, really hard. Those are totally two different worlds. So it’s kind of comparing like a bank robbery. A guy enters a bank office with a gun he can cause lots of damage there. But what are the losses for the banks, it can be a loss of a human life. But actual monetary losses, not so hard. But if you compare it to the digital world, for example the Swift case a couple of years ago, when the adversaries were able to extract tens of millions of dollars from bank without causing any harm for a human being. So, it’s really hard to compare which one is safer. We need different kind of people mitigating these risks. Digital world, digital people, people like us, in our company, and analog world demands different kind of people mitigating those risks. What the open APIs are bringing to the cybersecurity world, I think it’s widening the threat landscape. But it’s opening more, how to say, attack vectors for adversaries. Like Finnish bank, Finnish customers, they are opening up their APIs to world. So when the customer base gets more international, so will be the threats. When you handle customer data like the big companies are handling in this world, it definitely brings more risks. But if you handle the data according to laws and regulations, the risks against privacy get smaller. This is the way the world is now. We have to use the data, that the companies have to use the data The key point is how to do it. I would say that the open APIs and the world they open, it demands more resources, more skillful people to work for the cybersecurity. The latest trends of testing a security is attack simulation. The two kinds of services that you can engage in are red teaming or attack path mapping. In red teaming it’s more like term “black box testing” You conduct an attack simulation using real life adversaries’ tactics, tools and procedures. It’s more about testing the company’s ability to detect and response. And the other way is attack path mapping which is a more collaborative way. Where we do an attack simulation together with the customer. We talk with the customer and we create attack paths to the organisation. Both are attack simulations, but the one is done in covert, and one is collaborative with the customer.