FACING

THE FUTURE
OF SECURITY
How the banking, financial
services and insurance (BFSI)
sector can prepare for the
digital age
AT A GLANCE
The digital transformation dilemma
Opportunities for enterprises – and cyber criminals

A global story
How cyber security has changed forever

The challenge now

Why traditional security solutions can’t keep up

The need for a holistic approach

People, Process, Technology

Tata Communications’ Managed Security Services

Leading the way to a secure, connected state

2
THE BANKING
AND FINANCIAL
SERVICES SECTOR
IS FACING A
DIGITAL DILEMMA
From managing paper records to offering online
purchases and one-click premium payments, banks
and insurance entities have invested heavily to
elevate the customer experience – and differentiate
their offering. The COVID-19 pandemic has only
served to accelerate this move online, but while
digital transformation is a way to improve the
bottom line and future-proof businesses, it comes
with increasing security concerns too.

Given the critical importance of customer security in online and mobile

banking, the growing threat of cybercrime is of particular concern to the
BFSI sector. With attacks on digital banking systems, core transactional
and back-office systems, and even ATMs, enterprises must act to protect
their customers, their reputation – and the complex IT systems that make
their business possible.

3
Data breaches are on the rise
422 million 143
As financial institutions forge ahead with
Number of customers whose data Of cash machines are vulnerable
digital transformation efforts, the pace of was exposed in a 2019 breach of to attack7
change has created more opportunities one of India’s largest banks3
for attacks against networks and critical
infrastructure. One of the most significant
threats comes in the form of ransomware and
extortion – with one organised gang claiming
profits of over USD $100 million in a single 542% $3.92 million
year.1 And just one attack on New Year’s Eve
Spike in DDoS attacks Average cost of a data breach8
last year cost currency exchange firm Travelex (from Q4 2019 to Q1 2020)4
a staggering USD $2.3 million to regain access
to its data.2

Meanwhile, traditional phishing attacks that

aim to steal login credentials and Distributed
Denial of Service (DDoS) attacks that attempt
80% $6 trillion
to sabotage digital transactions, are causing Global rise in DDoS attacks (Q1 Expected global spend on
considerable damage to the BFSI sector. There 2020 versus Q1 2019)5 cybersecurity by 20219
has been a marked increase in DDoS attacks
on the critical servers of banks and financial
services institutions, with the financial and
personal data held by the sector making it a
prime target for Advanced Persistent Threat 143
groups, including terrorist organisations. These Cash machines shut down by
attacks are designed to disrupt operations by Belgian bank Argenta following a
targeting critical workloads. ‘jackpotting’ cyberattack in 20206

Source:
1, 2. https://www.bankinfosecurity.com/global-financial-industry-facing-fresh-round-cyberthreats-a-15409#:~:text=Although%20the%20global%20financial%20industry,Carnegie%20Endowment%20for%20International%20Peace
3. https://www.businessinsider.in/slideshows/biggest-data-breaches-of-2019/slidelist/72465909.cms#slideid=72465983
4. https://www.businesswire.com/news/home/20200630005295/en/DDoS-Attacks-Increase-542-Quarter-over-Quarter-Pandemic-Nexusguard/
5. https://tech.hindustantimes.com/tech/news/ddos-attacks-against-educational-resources-grew-by-350-in-h1-2020-71599653043082.html
6. https://carnegieendowment.org/specialprojects/protectingfinancialstability/timeline
7, 8, 9. https://fortunly.com/statistics/data-breach-statistics/
4
THE THREAT TO USA
The US Federal Deposit Europe

THE BFSI SECTOR

Insurance Corporation issued
a statement on heightened The European Banking
cybersecurity risk11 that Authority10 has provided
recommends implementing guidance on the importance
and maintaining effective of ICT security and security

IS GLOBAL
cybersecurity controls. And risk management in the
in July, the SEC12 issued COVID-19 crisis, highlighting
a warning about a rise in compliance with EBA
ransomware attacks on Guidelines on ICT and
American financial firms. security risk management,
applicable from 30 June
Banking authorities around the world 2020.

clearly recognise the increased threat of

cyberattack, and are issuing advisories
to help the BFSI sector respond.
India
Cert-IN and RBI have set out
Security in an uncertain world measures that authorised
payment systems operators
(PSOs) should take to
Disruption in the wake of COVID-19 pandemic has brought protect their servers.
a fresh slew of challenges for the BFSI sector, with personal
and corporate banking customers a natural target. There has
been a significant rise in the number of COVID-19-themed
phishing attacks – emails to customers that appear as if they
are offering financial support from the bank, but are in fact
fraudulently asking customers to provide or validate their
account or identity information. Other emails may contain
malware that downloads onto a customer’s system once a Cyberattacks against the financial
link is clicked.
sector increased by 238% from
Source:
February to April 2020, amid the
10. https://eba.europa.eu/sites/default/documents/files/document_library/Risk%20Analysis%20and%20Data/Risk%20
Assessment%20Reports/2020/932012/JC%202020%2067%20Autumn%202020%20Report%20on%20Risks%20
COVID-19 surge.”13
and%20Vulnerabilities.pdf
11. https://www.occ.gov/news-issuances/bulletins/2020/bulletin-2020-5a.pdf
12. https://carnegieendowment.org/specialprojects/protectingfinancialstability/timeline
13. https://www.helpnetsecurity.com/2020/06/17/cybercriminals-sophisticated/
5
OPERATING ON
THE FRONT FOOT
Where does this leave security teams working
to navigate increased threats, with the added
challenges of a global pandemic? As today’s
threat landscape becomes increasingly complex,
traditional, prevention-focused security tools are
simply not enough.

Security solutions must flex for a continually evolving digital

environment, where new applications and workloads in the cloud blur
the corporate perimeter. Now enterprises must protect both legacy
and new cloud infrastructure, moving towards detection and response,
and to net-new infrastructures.

While the Internet brings its own challenges – with expanding attack
surface and vectors causing local breakouts that are difficult to secure
and increase complexity – the right security strategy can become an
enabler for change, rather than a barrier.

It is time for a new perspective

on cyber security – one that
puts it at the heart of digital
18%
of financial companies
51%
0f BFSI firms plan to
transformation efforts.” have already deployed
hybrid cloud14
shift investment to
hybrid cloud in three
to five years15
Source:
14, 15: https://www.expresscomputer.in/news/financial-companies-embrace-hybrid-cloud-with-security-and-flexibility-top-
of-mind/57846/ 6
THE CHALLENGE

How many
Disparate technologies and products:
With an average of 25 security OEM vendors in the enterprise environment,
enterprises lack unified control – lowering productivity levels and adding to the
complexities of managing such a vast security infrastructure.

of these Increase in cloud workloads:

Like most enterprises, banks are increasingly moving data to the cloud – opting for
private over public cloud in most cases. The need to quickly migrate to new IaaS cloud

limitations
environments often increases risks, through access point misconfiguration.

Lack of visibility, control, and compliance in a hybrid environment:

Lack of context arising from not having a clear view of distributed systems, combined

feel
with high intelligence and alert load, causes high volumes of false positives.

Vulnerable security posture and readiness to manage breaches:

Due to weak detection, response and breach handling capabilities and processes.

familiar?
Lack of automation/orchestration for prioritising alerts:
Implementing automation and orchestration beyond rudimentary tasks can be
difficult, but the resulting shift to manual operations is labour-intensive, inefficient and
makes prioritising higher risk alerts harder.

Struggling resource strategy (headcount and competency):

High cost of in-house SOC management and a lack of skilled security staff to keep
pace with technological advancements.

The complication of compliance:

BFSI enterprises tend to be geographically widespread. As a result, they must comply
with multiple international/regional regulations and compliance requirements – with
data compliance differing across continents, countries, and even states.

Inability to manage complexity:

Disparate tools, working in silos, with inconsistent processes and low/non-existence of
a priority matrix don’t support a unified control and execution model, causing a delay
in mean time to detect (MTTD) and mean time to respond (MTTR).

7
THE SOLUTION

OVERCOMING Financial organisations need to go beyond simply securing the perimeter

in order to protect a growing digital infrastructure that is global, scalable,
dynamic and mobile. Effective cyber security demands the right tools,

TODAY’S frameworks, policies, and processes – all held together by a specialised

skillset that will build confidence in security operations, and security
teams.

SECURITY With a greater understanding of the forces at work, organisations can optimise their
security operations, moving from reactive to proactive, in order to protect their business,

CHALLENGES
and their digital ambitions. By harnessing next-generation tools, advanced automation and
threat intelligence, enterprises can proactively detect and mitigate attacks before they
take hold.

Five ways to bring security up to speed – right now

Leverage proactive security frameworks,
Through Advanced Threat Management
automation and analytics
It’s critical to invest in new automated tools that leverage the latest threat intelligence,
Make use of hybrid SOC to stay ahead analytics and cloud-based resources and skills to actively seek out intrusions. While Red
of alerts Team exercises are key to reducing exposure from Zero-Day attacks.

Threat intelligence can provide critical quality and context, with artificial intelligence,
Secure remote access for internal and machine learning and UEBA capabilities, next-generation security analytics and managed
external stakeholders detection and response (MDR) capabilities enabling anytime, anywhere monitoring of
remote workers and their endpoints. So you can actively, proactively seek out intruders -
for faster detection and remediation of threats.
Secure the cloud environment

Secure the endpoints

Click to expand each step towards enhanced security…

Source: https://www.expresscomputer.in/news/financial-companies-embrace-hybrid-cloud-with-security-and-flexibility-top-of-mind/57846/ 8
THIS ISN’T A CHALLENGE
YOU NEED TO FACE ALONE
Digital security threats are global, but their impact can be felt keenly at a local level. Tata Communications’
Managed Security Services deliver a holistic approach to security, equipping you with the intelligence,
technology and knowhow you need to protect your business from modern threats.

By working closely with BFSI organisations, we’ve put in place the systems to stay safe and compliant. Our
comprehensive solutions cover IT infrastructure end to end, giving you the confidence that you’re securing
your networks, endpoints, applications, data, and identity.

Flexible services work best when they have a strong framework to underpin them. We provide a multi-
layer information security strategy that includes a Confidentiality, Integrity and Availability (CIA) model
built on the three pillars of people, process and technology.

Introducing the powerful platforms, integrated solution frameworks and

managed services to simplify cyber security complexities across the
digital estate.

Intelligent, integrated Powerful, pervasive Experienced, expert support

solutions platforms
Our security teams have
Our advanced threat detection and Our integrated native platforms are demonstrated the expertise to
management is driven by analytics built to deliver next-gen services, seamlessly weave security across
and machine learning, informed by including SOAR as a Service, network, cloud, storage and more,
our global Big Data lake. Catalyst Platform, DDoS Scrub Farm for 24/7/365 support.
and globally deployed honey pots.

9
THE SOLUTION

COMPREHENSIVE
SECURITY FOR COMPLETE
PEACE OF MIND

10
DISCOVER TATA COMMUNICATIONS’
MANAGED SECURITY SERVICES

Complete security, Dynamic solutions One-stop cloud, content & identity security
always-on conectivity for dynamic enterprises
Our multi-layered security framework protects against
application layer attacks (for both cloud and on-premise),
while ensuing the right people always have access.

• Public Cloud Security

• Hybrid Cloud Security
• Cloud Access Security Broker
• Cloud Security Management Platform
• Web Application Firewall
• Data Leak Prevention
• Identity as a Service
Safeguard your Advanced protection • Privilege Access Management
reputation and data against advanced threats • Multi-Factor Authentication

Click to explore the four stages of 360-degree security…

11
NOW’S THE TIME
TO MAKE THE RIGHT
INVESTMENT
Digital transformation offers incredible
opportunities for growth. But any
vulnerabilities in your approach give cyber
criminals the opportunity to take advantage
too. As you look to navigate an increasingly
contactless economy, driven by post-
pandemic uncertainty, now is the time to
upgrade your cyber security programme.
So that you can continue to embrace the
innovation that will deliver the anywhere,
anytime service today’s customers demand.

As the leading digital ecosystem enabler with a truly global

footprint, Tata Communications has the experience – and the
experts – to deliver the next-generation security solutions
you need. To protect your customers, your business and your
transformation ambitions.

12
A PARTNER YOU CAN TRUST
Delivering security for leading businesses worldwide

case study video video case study

DDoS protection for Sharekhan A fully managed SOC for a leading Hybrid DDoS solution for a leading SIEM solution for a Major Financial
banking services firm in India banking group in India Services Firm

case study case study case study case study

Hybrid SIEM solution raises the bar A best-in-class SIEM solution for Mitigating DNS Water Torture for Mitigating a multi-vector DDOS
for a financial services provider a global securities depository a leading bank in India attack for a large bank in India

13
 Where next?
Putting in place an effective cyber security
programme can be complex. But handled right,
it can be a true enabler for your business. The
foundation for growth and a critical component
for success in an ever-more digital future.

If you’re ready to start your journey towards

becoming a secure, connected enterprise –
we’ll guide you there.

Let’s talk

© 2022 Tata Communications. All rights reserved. TATA COMMUNICATIONS and TATA are trademarks of Tata Sons Private Limited.
14