Reliability and security best practices for financial services in ANZ

Every year, Australians lose over $6 billion due to financial fraud and cybercrime , so it is great to see the collaboration between banks in Australia to fight fraudsters head-on with the help of the Fraud Reporting Exchange (FRX ). The FRX is a trusted, secure, single platform providing timely and efficient means of reporting and actioning fraudulent (including scam) activities between banks.

Banks can continue to improve their security posture with an end-to-end SaaS analytics solution. A unified view of data across silos can help you overcome many challenges, from cybersecurity threats to effectively monitoring IT operations. It can also automate much of the compliance requirements of government regulators such as Australian Prudential Regulation Authority (APRA) and enable legacy systems modernization.

The same data can also monitor complex, multi-step financial processes such as payments and electronic trading, flag potential fraud, and improve services for customers by utilizing advanced analytics and machine learning. This delivers deep insights into customer behavior across all channels, the effectiveness of marketing promotions and usage of various financial services.

Financial services must adhere to the highest standards for reliability and security. No one wants to risk their funds, personal identifying information (PII), or struggle to work with their bank. Organizations like yours must have a seamless digital customer experience while promising the highest security.

These best practices are built around the five areas where reliability and security could be at risk.

Digital banking operations and security

Customers demand a superior online and app-based banking experience. Internet banking platforms have become complex, integrating digital services such as payments, product promotions, chatbots and mobile apps to facilitate multi-channel engagement.

Meanwhile, cybercriminals target Internet banking websites to collect enough information to gain access to personal accounts, severely damaging customer confidence, impacting customer loyalty and inflicting brand damage. They are using increasingly sophisticated approaches to find and exploit potential vulnerabilities in Internet banking applications, which are harder to detect and go beyond the realms of any single security product.

To protect your application, you must analyze, track, monitor and alert on critical aspects of Internet banking applications in real-time, extending the bank’s security ecosystem regardless of the incumbent technologies. This includes highlighting abnormal behavior, even if the behavior in isolation is legitimate. For example, during a credential stuffing attack, many accounts are accessed simultaneously, causing a spike that may go unnoticed by traditional security rules.

Sumo Logic can help to detect a wide range of threats using our advanced correlation rules and workflows.

External threats

• Cross-site scripting

• SQL injection

• DOS

• DDoS

• Phishing

• Brute force logins

• Failed 2FA attempts

Internal threats

• Malicious insiders

• Risky users

• Malware

• Viruses

• Trojan horses

As a prime target for hackers, security teams must ensure that comprehensive real-time log monitoring of the entire platform is in place. Sumo Logic Cloud SIEM goes beyond traditional security information event management (SIEM) solutions by providing a data-driven analytics approach to security. By capturing the raw data from the Internet banking platform and its supporting architecture, correlation searches can look for abnormal behavior through mathematical approaches, using statistics and machine learning to trigger events for review by security operations centre (SOC) analysts.

Not only does this augment your team’s security posture, but it can also streamline the process for your SOC team and reduce manual work.

Sales performance and client profitability analytics

Financial firms like yours strive for simplicity in products and services. But complexity in your operations can make it difficult to deliver on what seems like a simple set of requirements.

The regulatory rules about how to sell each product differ in each market, and a profitable product in one place can take a loss in another.

Real-time views of customer journeys can dramatically improve your ability to respond to a breakdown in process and prevent a minor issue from becoming a breakdown in a customer relationship.

You can measure profitability at a client level or by product, team or country — by any measure you choose. Design dashboards in Sumo Logic to show the appropriate information required for a person in any role, in any location, e.g. mobile relationship managers and branch teams.

Regulators demand that customers are treated fairly. Sumo Logic helps you measure your performance and record your actions accurately. Plus, you’ll have enough information to correct any mistakes early when they inevitably are made.

ATM operations and security

Most retail banks have extensive ATM networks, many of which operate in multiple countries, and are usually members of interbank networks like NYCE or LINK. The traffic flows of ATM usage vary significantly and are subject to seasonality and one-off events. That’s why it’s necessary to have systems to monitor and forecast usage so machines can be replenished on time.

ATMs are also susceptible to paper jams caused by damaged bank notes, network outages and power failures, and they are seen as easy targets for criminal activity. These factors combined mean that banks must monitor their networks carefully and pay close attention to where they locate their ATMs.

Many banks rely on Sumo Logic to give them a holistic view of their networks. ATMs generate detailed telemetry, so it is easy to find out the status of a specific ATM.

Real-time dashboards show the status of the entire network. These dashboards include:

• Network status
• Overview of incidents
• Predicted incidents
• Suspicious activity
• Network performance
• Financial performance
• Security status

Sumo Logic dashboards look at the history of incidents over time and use machine learning algorithms to forecast future incidents. These algorithms can predict when incidents are most likely to occur by location and type.

This ability to forecast incidents lets you become proactive and schedule maintenance routines based on the predictions, saving time and money and improving the network's uptime.

Security is crucial for ATM networks, which must comply with Payment Card Industry Data Security Standard (PCI DSS) 3.2. Sumo Logic can identify threats in real-time and automate the response when a threat is detected.

Predictive maintenance results in higher uptime and lower costs by building replenishment into maintenance schedules and paying attention to highly utilised ATMs.

Real-time payment operations and security

Payment networks must maintain complex network communications with banks and deal with many international differences between systems and processes.

Merchants require seamless operational reliability while preventing fraudulent transactions and meeting PCI compliance. To identify anomalies faster, banks need to aggregate the payments received across all supported networks to obtain a single view of customers, merchants and networks.

Payments generate large and complex messages that include information on the payment, merchant and recipient and the routing data that allows the payment to reach its destination. These factors, combined with very high volumes and inconsistent traffic, require all participants to deliver high levels of technical performance.

Firms building payment applications use Sumo Logic’s DevOps capabilities to improve application delivery and allow continuous updates. Real-time updates give your developers real-time insights across all development lifecycle stages. Developers can adopt a continuous-release methodology.

Security operations

The breadth of products and services and the associated complexities make it tricky to protect a payment system. Payment Services Directive (PSD2) has raised the bar on security, forcing banks to improve authentication and process security around APIs.

PCI DSS requires that all merchants, service providers and financial institutions meet minimum levels of security and monitoring of the systems in their cardholder data environment (CDE).

The DSS includes 12 requirements that businesses are expected to comply with, consisting of security policies, procedures and guidelines for storing, processing and transmitting cardholder data.

Sumo Logic has granular dashboards and reports that provide visibility to demonstrate PCI readiness and security best practices quickly and easily across your cardholder environment, including insights into network traffic, user activity, suspicious access, configuration changes, and more. Schedule reports can be run automatically or as needed to manage security investigations and respond to audit inquiries.

Sumo Logic is the only cloud-native platform with industry-leading logging, observability, SIEM and SOAR solutions that utilize a market-proven, scalable big data platform, continually augmented with actionable use case content. Sumo Logic breaks down data silos by providing a single pane of glass for seemingly disconnected data to come together to drive action in real-time across an entire organization.

Learn more about how Sumo Logic can specifically help financial services organizations like yours.