Experience From the Financial Sector with Consumer Data and ICT Security

Abstract

This chapter describes some standards and norms and best practices related to ICT security used within the financial services industry in the Netherlands. Although some of the best practices are sector specific, such as ATM security measures, we assume that most of the ICT security challenges for banks are similar to the challenges of the energy sector. Therefore, we hope that this paper will bring up new ideas for those who are responsible for ICT security in the energy sector. Information security and business continuity measures together belong to the area of operational risk management in a banking environment. Operational risk management is highlighted in Section 9.2. Operational risk management within a bank can best being described as a structured approach to respond to a number of threats according to the principles of Basel II. One the key elements is the capital calculation for operational risks. Section 9.3 explains a simplified model for the analysis of operational risks and the classification of data into three quality aspects: availability, integrity and confidentiality. In Section 9.4 state-of-the-art attacks, such as man-in-the-browser attacks, on Internet banking systems are discussed as an example of external fraud banks face today. The next Section explains the industries co-operative responses to those attacks. Finally, in Section 9.6 a parallel is made towards the energy sector with some conclusions and policy and research recommendations.