The financial sector is one of the most demanding sectors for cybersecurity. The networks of banks, securities, insurance, funds, etc. carry highly sensitive data such as customer’s money accounts, transaction records, and personal letters, which, if compromised or leaked, not only cause significant economic losses but also seriously affect financial stability and social trust.
High security requirements and challenges for financial industry networks
The network environment of the financial sector has several salient features: first, it is highly demanding in terms of security phase-III or IV, core operating systems of financial institutions are usually required to wait for a 2.0 level III or IV, some critical information infrastructure requires higher levels of security protection, network access as the first line of defense for inner network safety must meet strict safety standards; second, the financial sector is subject to strict regulatory compliance requirements and is regulated by various regulatory bodies such as the People ' s Bank, the Silver Insurance Supervisory Board, the Securities Supervisory Board, etc., and there are numerous regulations and norms that need to be complied with, including the Data Security Act, the Personal Information Protection Act, the Financial Industry Network Safety Management Scheme, the Commercial Bank Information Technology Risk Management Guidelines; Third, networks of financial institutions are strictly organized and are usually divided into production areas, office areas, development testing zones, DMZ zones, Internet areas, etc., with strict access control and segregation between regions; fourth, there is strict end controls, financial institutions have very stringent employee terminals, which often require the uniform installation of anti-toxic software, desktop management systems, data protection against leakage (DLP), etc., prohibiting unauthorized software and externalities; fifth, audit retroactive requirements are high, and all network operations and access by financial institutions require complete recording and auditing, as well as regulatory inspection and judicial evidence requirements. These characteristics dictate that network access deployments in the financial sector must be carried out."Highest safety standards"To guide, security will always be the first between safety and experience.
Multi-regionally graded access strategy design
Financial institutions should have a network access strategy designed according to regional classification, with different security levels using different intensity of access controls. The highest level of security is in the production area (core business systems such as bank core accounting systems, securities trading systems), where only authorized transport terminals are accessible and multiple factor authentication (pass code+cert + dynamic tokens) is required for access, terminal compliance checks (the specified safety software must be installed, configured to meet security baselines), double-man authorization or work order approval, access can only be obtained through access to designated systems and ports, all operating full-course recording screens and audits. The security level in the office area (the daily office space for staff) is second, with 802.1X+ terminal compliance checks used, certified by employees through a domain account, which must be checked for compliance (intoxication software running, patch update, no non-offence software, no violation outside), and different network access rights are allocated according to the department and role of the employee. Once again, the security phase in the test area is developed, the test terminal can be accessed, but it must be strictly isolated from the production area, without direct access to the production system, and data from the testing environment should be desensitive. Access to the DMZ and Internet areas is mainly external, controlled through firewalls, VPNs, zero-confidence gateways, etc. Internal terminals need to be represented and audited. Cross-regional visits between regions must be strictly authorized and approved, with full time recording and auditing."Minimum Permissions"and"Deep defense."In principle, ensure that each region, endpoint and user has access only to the resources necessary for their operations.
Multi-factor authentication and robust identification
Multi-factor authentication (MFA) is required for the financial sector. Multi-factor certification usually combines two or more factors: knowledge (knowing things, such as passwords, PIN codes); possession (using things, such as USB Key, smart cards, mobile phone dynamics, certificates); and biological (principal characteristics of users themselves, such as fingerprints, faces, rainbow films). In the context of Internet access to financial institutions, common multi-factor certification combinations include: password+USB Key certificates (office network access for staff), password+mobile dynamic sign (vitage access production area), password+print (high-permit administrator) and smart card+PIN (physical door block and network access connection). The advantage of multiple-factor authentication is that even if a factor is leaked (e.g. password stolen), the assailant still cannot pass the certification, which greatly enhances security. In addition to multifactor authentication, financial institutions should also use robust identification mechanisms: first, certification of certificates that issue digital certificates for each employee and terminal, which are stored in USB Key or the Trusted Platform Module (TPM), validating certificates at validation; second, binding equipment, user accounts with specified terminals, recording only on authorized terminals to prevent account numbers from being used on unauthorized equipment; third, unusual login detection, where an irregular login is detected by the system (e.g. non-official location login, very non-utility device login, irregular time-line, multiple login failures within a short period of time) triggering additional identification or direct refusal to log in and alert. Strong identification is the basis for access to financial industry networks, only to ensure"The person who has access is legal and the equipment that is in access is authorized."Subsequent access controls are meaningful.
Terminal compliance inspections and security baselines
Financial institutions have very strict terminal compliance requirements, and network access certification systems must have a strong end compliance capability to ensure that only terminals meeting security baselines can access the network. The terminal compliance checks typically include: one operating system security check, an operation system version, patch level (the latest secure patches must be installed), service configuration (to close unnecessary services and ports), account strategy (code complexity, account locking etc.); Second, the security software status check whether the specified anti-virus software, terminal detection response (EDR), desktop management system, data leak protection (DLP) etc. are installed and that the software is running, viral library and rule bank have been updated to the latest version; third, software compliance check whether the non-compliant software (e.g. pirate software, games, P2P download tools, remote control tools etc.) has been installed and hazardous processes run; fourth, external controls check for access to the offsetting exteriors (e.g. Udisk, mobile hard disk, smart cell phone, wireless web cards, etc.) and register and control of unauthorized extra-exercises; The fifth is network configuration, which examines whether terminal IP configurations, DNS configurations, proxy settings are in compliance with security requirements and whether there are irregular network sharing or routers. Based on the results of compliance checks, the system divides terminals into full compliance, partial compliance, non-compliance levels: fully compliant terminals have full access rights, partially compliant terminals have limited access (only access to patches, poison-killing servers, etc., restorations, and guidance to users), non-compliant terminals are isolated or denied access. It should be noted that compliance strategies should be properly configured to the security requirements and end environment of financial institutions, that too many checks affect the speed of certification and user experience, that too few are not safe and require regular evaluation and optimization.
Audit retrospective and compliance statements for the financial industry
The financial industry has a very high retroactive audit requirement and network access certification systems must have sound log-recording and auditing capabilities to meet regulatory inspection and judicial evidence requirements. One is a complete access log, which records the network access behaviour of each endpoint and user: time of access, access location (exchange port, AP position), terminal information (MAC, IP, hostname, operating system), user identity (account number, name, department, role), authentication method, authentication results, compliance check results, assigned permissions, online duration, traffic use, downline time and reasons, etc., with log retention for no less than six months (the core system usually requires more than one year and partial supervision requires three years) and logs are not altered (using read-only storage or block chaining certificates); Second, operational audits, where all system administrators (strategic changes, equipment registrations, rights adjustments, user administration, log queries, etc.) require complete records, including operators, operating times, content, and results of operations, where critical operations require double authorization or approval and the operation record cannot be deleted; third, compliance statements, which enable the system to generate compliance check reports that meet the requirements for insurance 2.0, safety codes for the financial industry, regulatory requirements, etc., including end compliance rates, access success rates, unusual log-in statistics, terminal statistics, security event statistics, etc., supporting one key export and periodic automatic generation; The fourth is to interface with the security operating platform, which synchronizes access logs and security incidents to the security operations centre (SOC) or SIEM platforms of financial institutions, links analysis with firewalls, intrusion detection, terminal security, database audit, other safety equipment logs, and upgrades overall security situational awareness and threat detection capabilities; fifthly, judicial evidence support, system logs and audit records should meet the requirements for forensic evidence and be capable of being used as evidence, including the integrity of the log, non-frozenness, time accuracy (using uniform time synchronization)."To cope with the inspection"It is an important means of security management and risk prevention for financial institutions, and a necessary condition to meet regulatory compliance requirements.
The financial scene is highly available and disaster-prone.
Financial institutions have very high business continuity requirements, and no malfunctions of network access systems can affect the proper functioning of financial operations. Therefore, network access deployment to the financial scene must ensure high availability and disaster preparedness. In high utility areas, network access certification systems should be deployed using two-error heat or multinode clusters, RADIUS servers should deploy multiple load balances and troubles switches, and identification sources (AD, LDAP, Unified Identification Platform) should also be highly available for deployment, with databases deploying from main replications or clusters to avoid single point failures. The system should be connected to the switch, wireless controller, firewall with a time-consuming and downgrade mechanism. When access is compromised, network equipment can automatically fly-open (discussion of certified terminals) or fail-close (deactivated, configured according to security requirements), while triggering alert alerts for carriers."Two-field three."or"Three-Team Five."In the case of emergency security, financial institutions should develop a well-developed emergency plan for network access: how to quickly switch to standby systems in case of serious system failures, how to temporarily liberalize access strategies to ensure operational performance, how to inform relevant departments and personnel, how to conduct safety checks and audits after failure recovery, and how to perform emergency preparedness exercises (at least half a year) on a regular basis to ensure that operators are skilled. Special attention should be paid to the need for caution in the change of access strategy in the financial landscape: any change of strategy may affect operations, must be fully validated by a test environment before deployment in the production environment and should be deployed at low operational peaks (e.g. early morning), phased out through greyscale distribution, sustained observation after deployment, and confirmed that no anomalies exist until completion is completed.
The financial sector ' s network access certification system must be deployed, guided by the highest security standards, to build a first line of financial safety in-nets through multi-regional and graded access strategy design, multifactor certification and robust identification, strict end compliance checks and security baselines, improved audit retrospective and compliance statements, high availability and disaster preparedness. For financial institutions, access is not the first line of defence for financial in-network security."Optional"Instead, it is essential to build financial network security and the basic conditions for meeting regulatory compliance requirements. Against a backdrop of increasingly complex financial science and digital transformations, increasingly diverse terminals and security threats, the deployment of a secure, reliable, compliant network access certification system is an important safeguard for protecting financial data security, maintaining financial stability, and gaining customer trust.