8

What technologies, processes, or laws that relate to InfoSec apply specifically to the Financial industry?

If you're familliar with the Financial Industry, can you share details? For example:

  • What are specifics on common controls

  • What technology (or widely deployed product) satisfies a particular control

Improve this question

5 Answers 5

Reset to default
12

As mentioned the two main laws in the US are Sarbanes-Oxley Act (SOx) and the Gramm-Leach-Bliley Act (GLB).

If you are on the Banking side of the Financial Services sector then a must read is the Federal Financial Institutions Examination Council (FFIEC) Information Security Booklet dated July 2006.

The handbook references NIST, ISO, and COBIT. NIST's 800 series documents are an excellant source of guidance on a variety of topics. On the ISO side see the ISO/IEC 27002 standard.

If you fall under SOx then you will probably find yourself involved with two control frameworks, COBIT and COSO. The control frameworks aren't going to tell you exactly how to implement a control. Although not directly associated with SOx compliance SANS has published amoung other things a list of Twenty Critical Security Controls. These controls are a little closer to actual implementation, but still don't tell you exactly how to do it. How you implement a particular control is going to be highly dependent upon your environment.

Improve this answer
1
  • I would also add that the regulator provide supplemental guidance and requirements in addition to the Information Security Booklet, known as Financial Institution Letters (FILs). There are not always IT related, but some deal with BCP, authentication, etc: fdic.gov/news/news/financial
    – Eric G
    Commented Mar 9, 2013 at 0:29
6

Also in the UK the FSA requirements are, while pretty woolly and open to interpretation, based around industry de-facto standards such as ISO 27001, CobIT, ITIL etc, with the main aim being for an organisation to put in appropriate controls based on the data or processes.

The Data Protection Act is also high up the list of important regs to meet, especially now the ICO can levy fines for failure to protect personal data.

PCI is currently one of the top scoring regulations to comply with, as the drivers for financial services organisations are commercial. While passing PCI requirements is no guarantee of security, failing them presents very significant risks!

Improve this answer
5

One that's not been mentioned in the answers so far, but which may well be relevant in several areas of Financial Services is PCI DSS. It'll apply if the organisation processes credit/debit card details from any of the main schemes, so retail banking, insurance, basically anything that deals with individual customers.

One thing about PCI in comparison to things like SOx, is that it specifies far more in the way of technical detail in what controls are needed to comply. This can be seen as a good thing or a bad thing.

On the one hand it stops people arguing quite so much whether certain control classes are needed at all, but on the other hand it can drive quite a "check-box" mentality, where the organisation seeks to comply with the letter of the standard but not the spirit.

Improve this answer
4
  • 2
    PCI isnt really a "financial industry" regulation, it applies specifically to handling credit cards - and even that, only from MC, Visa, Amex... if you issue your own cards you are not obligated by PCI.
    – AviD ♦
    Commented Nov 24, 2010 at 14:00
  • 2
    While that may be strictly true, I think the answer has merit because it's probably safe to say that the vast majority of companies in the financial industry are going to have systems that need to be PCI compliant, since many institution accept major credit cards for payments, or in their ATMs.
    – Xander
    Commented Nov 24, 2010 at 14:15
  • @avid the question asks about de facto standards. PCI certainly fits that bill.
    – user185
    Commented Jun 21, 2011 at 19:00
  • Ah, the title says that, but the body mentions laws et al. Besides @Graham, my point was more that it's not the standard for financial industry, unless they randomly choose some standard...
    – AviD ♦
    Commented Jun 21, 2011 at 19:13
2

In the US, the two main regulations that apply:

Improve this answer
2
  • My understanding is that SOx (and others) don't provide detailed guidance, but just vague sugguestions. It's up to each company to implement a control. It would be nice to know if there are common or best practices to those controls...
    – makerofthings7
    Commented Nov 22, 2010 at 16:43
  • Yes, this is true. But you can also look at it as specifying high-level business requirements, without specifying how to implement them. As an example, IdM is not specified, but "accountability" is pretty hard to achieve without it.
    – AviD ♦
    Commented Nov 22, 2010 at 16:49
1

Majority of our financial clients stick with Vulnerability Assessments and Penetration Testing when it comes to handling their Information Security with the FDIC. To help our clients that are considering a higher level of testing (or attestation) we created an Information Security Guide. It's free and very useful.

Described in the guide:

  • Vulnerability Assessment (typically done in the Financial industry)
  • Penetration Test (typically done in the Financial industry)
  • Secure Data Flow Diagram
  • Design Review
  • Gap Assessment
  • BITS Shared Assessment (created by the Financial industry)
  • ISO 27002 Assessments
  • SAS-70
  • ISO 27001 Certification (highest level of assurance)
Improve this answer
2
  • This doesn't meet requirements for a good answer - please read the FAQ, especially the part on promotion. A better answer would include the core elements of the security guide in it, rather than just a link to your site!
    – Rory Alsop ♦
    Commented Jun 21, 2011 at 10:10
  • thanks for the update. It always helps visitors if you can include relevant detail, and your improved answer does give a good list poeple can learn more about.
    – Rory Alsop ♦
    Commented Jun 27, 2011 at 19:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .