A key principle of the UK Financial Services Authority’s approach to regulating e-commerce and internet delivery of financial services is that it is technology neutral: the same general regulatory principles apply equally to e-commerce as to the regulation of “conventional” financial services. We are not in the business of creating a different or more onerous regime for e-commerce simply because it employs new technical features.
Central to the FSA’s approach is the need for senior managers to have a close grip on their firm’s internet strategy. This applies to the overall business strategy area and to the effective management of operational and security risk – the latter having a strong link to risk to reputation, with the media playing up IT and other glitches in internet delivery much more than in conventional financial services delivery.
The FSA has recently pulled together the results of findings from its market intelligence, on-site and supervisory work. These shed light on e-commerce operational and security controls within firms and provide a picture of emerging best practice.
Senior management awareness
The root cause of many operational problems we see is the immense competitive pressure to be first or at least early into the market. This can lead to fast tracking of projects without procedures on project planning, risk assessment or audit processes being carried through. An important factor in reducing or avoiding such problems is greater senior management awareness of IT and project risks in order that appropriate resources and risk mitigation techniques are used. It is tempting to draw parallels with the early days of financial derivatives when some senior managements were willing to sign off projects without the relevant technical knowledge or understanding. If short cuts are taken, this needs to be a conscious decision at the appropriate level of seniority, with adequate understanding and acceptance of the risks involved.
Some institutions have sought to demonstrate board or senior management buy-in by promoting a high level of awareness of the potential challenges, threats and opportunities presented to the firm in this area. This has been through a combination of their own participation in “e-awareness” programmes and by providing clear e-commerce strategy leadership.
Organization structure
In some larger firms we found e-commerce initiatives to be fragmented and uncoordinated and some firms even had difficulty in producing a comprehensive list of their e-commerce initiatives. This points to a lack of oversight and control by the group, which may mean that appropriate controls are not being applied across the firm, resulting in potential reputational risk if shortcomings lead to customer confusion and dissatisfaction. Sometimes we saw firms with good control over products and services at the centre but little or no overview of significant subsidiaries and/or joint ventures. Although decentralization can provide some advantages, it was clear that the downside of this organizational structure had not always been overcome and so learning points and best practices from successes or failure were not communicated to other parts of a group.
The two main models we saw for strategic and design cohesion achieved across a group or range of business lines were a speciWc line organization structure or an effective committee structure allowing cross-divisional communications and formal ratification of any departure from agreed strategies or standards. Somewhat less effective, but still useful, are committees bringing together senior business and IT personnel that enable knowledge sharing.
A clear conclusion from our work is that there are benefits from drawing the IT department and IS (information systems) security areas into e-commerce decision-making processes at the earliest stage. Apart from helping to ensure that IT and business strategies are aligned and that the businesses are aware of key technological developments, it helps ensure that the firm’s strategies don’t lead to project deadlines that are unrealistic and it reduces the risk of IT glitches or security breaches further down the line.
Outsourcing
Increased use of outsourcing or “strategic alliances” is a strong feature of e-commerce, with some firms outsourcing areas integral to their IS security. The importance of such areas and the size and number of such contracts have increased to such a point that they are now a signiWcant challenge for the outsourcing processes of the firms. The effort and expertise needed to manage multiple contracts in this way should not be underestimated, as the very factors that promote outsourcing in the first place – new technology, the pressure of speed to market and shortage of appropriately skilled IS resources – also make it difficult to set up and effectively manage these external contracts.
This is an area where the FSA has a keen interest, as firms may not always consider in advance, or on an ongoing basis, the risk implications of outsourcing. The FSA has issued general guidance on outsourcing [www.fsa.gov.uk/pubs/supervisor/] which currently applies to banks but is likely to be extended to all firms at a later date. This represents the FSA’s most comprehensive discussion of the issue to date.
Internal policies and standards
Policy is a fundamental area that is sometimes left until last and then “retro-fitted” to previously determined processes and procedures. There are firms where policy formulation on e-commerce has continued to operate in line with best practice, but there are also instances where the policy framework has been unable to keep pace. In some cases this has led to problems further down the project cycle where a lack of standardization and inconsistent application of detailed policies/standards has allowed vulnerabilities to develop. An example would be a lack of standards covering the set-up of key IT systems regulating access to the internet, which may result in a hacker obtaining access through a known weakness.
But policy alone is not enough – the best policies in the world will be of limited use if they are applied haphazardly. In cases where groups decentralize this may mean that their policy framework is not (or is not properly) applied and then the introduction of internal protective measures, for example internal Wrewalls, might be appropriate. Most firms do try to adopt a range of measures to ensure compliance with policy but this is an area where we often see weaknesses.
Most security improvements would not involve a great deal of organizational or financial investment but rather the consistent application of what should be seen as standard policies and procedures. Furthermore, from an operational perspective some of the improvements to the infrastructure can be fairly simple, such as adjusting a few settings or applying a number of security patches. As usual, it is often a matter of doing the basic things well.
Design of security
We sometimes receive a telephone call or on a visit get asked questions such as: “Does the FSA expect a dual firewall configuration?” A flippant answer is that one firewall managed well is much better than two managed badly. Although we often see dual firewall configurations in the design of external gateways, all such design elements are only a means to an end. The objective for the firm, and focus of the regulator, is the achievement of appropriate security.
Many firms are re-evaluating or are implementing new system designs as they attempt to rationalize the infrastructure spaghetti that has grown up over the years. In this context, there appears to be a general move to centralized and standardized gateways to the outside world, often taking the opportunity to build in a higher degree of contingency and resilience. Quite a few institutions have projects along these lines due to be completed this year or early next. This has advantages as a decentralized and non-standard design may lead to inconsistent compliance with security standards and procedures and difficulties in ensuring that all gateways are adequately monitored and managed by skilled staff.
Proactive monitoring is an important component of security and best practice is evolving rapidly here. Quite a few institutions are piloting or adopting intrusion detection systems (IDS), but these systems are not plug and play, and a considerable amount of work needs to be done to make their output useful. We saw institutions that have piloted the use of IDS but have yet to refine the large amount of information received from this source into different risk categories with appropriate actions attached. A few institutions are outsourcing the monitoring of the network perimeter, including intrusion detection.
In more advanced institutions we saw policies and processes in place for firewall monitoring and analysis of logs, including the compilation and analysis of management information relating to trends in attacks on the network perimeter. Without proper proactive review of firewall logs it is possible that these important trends in suspicious activities or a successful hacking incident might go undetected. Furthermore, the data from Wrewall logs may be relevant to the firm’s risk analysis and response process.
Some of the difficulties encountered in effective monitoring and analysis of alerts and potential incidents include: – the amount of raw data; – the different sources of such data; and – problems analyzing the data with the software tools available.
However, we see a deWnite trend in best practice towards more proactive monitoring and attempting to integrate alert information from a variety of sources, including IDSs and firewalls, into the process of systems management. Other regulators have observed the same trends and have issued guidance in this area (e.g. www.occ.treas.gov/).
A further and important component of proactive monitoring is regular and frequent checking of security alerts from outside organizations. Not checking or acting on technical alerts by external organizations could result in operating and software vulnerabilities not being fixed and thus exposing the firm to a successful hacking attack. It is worth noting that vulnerabilities can also be opened up either by accident or through malicious intent during changes to the firewall and external gateway configuration. Thus, good change management procedures are particularly important here.
Testing
We have seen several cases where difficulties in testing e-commerce applications in pseudo-live conditions have resulted in security flaws only being uncovered in live running. The testing phase is one of the areas that comes under pressure in the race to deliver e-commerce as quickly as possible. It can also be genuinely difficult to develop tests that will realistically replicate the sort of stress conditions that actually cause flaws in live running, although this is an area where testing tools appear to be developing to meet this demand.
An additional aspect of testing with e-commerce is to do penetration testing of the platform. The majority of firms have a clear policy on scope and frequency, including a rolling programme covering all firewalls. Nearly all also use independent external penetration testers that check gateway security more rigorously than that provided by automated tools.
A few institutions alternate between two external testing companies to increase the chance of loopholes being found and to check for potential weaknesses in any one external company – testing the testers. Although it is difficult to recruit and retain the necessary expertise, we have also seen institutions that aim to have internal testing teams that match the best external penetration testing teams.
This area of testing security is one that firms need to focus on, if they are to allay public and media fears that e-commerce is insecure. In particular, deficiencies in policy, failure to use skilled personnel or to properly test e-commerce platforms can result in vulnerabilities remaining undetected.
IT resources
Scarce IT resources are a general problem. Clearly the ideal is to seek to ensure that all key staff have the appropriate level of technical skills and experience required for their roles, and that there is no over-reliance on one individual to perform critical tasks. Most firms are striving towards these goals. We did note that this was made more difficult where a firm operated decentralized IS functions as this can increase the risk that key specialist roles, such as firewall management, are inadequately staVed. Outsourcing technologically complex areas can be seen as a solution – this typically changes, but does not do away with, skill issues, as the firm will still need to have a sound management team with a good understanding in order to retain control of the outsourced function.
The problems do not stop at finding suffciently skilled staff to design, implement and operate systems. The systems then have to be adequately audited. In some areas, for example public key infrastructure (technology for provision and management of digital certificates and signatures), finding appropriately skilled auditors is difficult. As with much of e-commerce, the focus on short time scales for project delivery worsens problems of skill shortage leading to inadequate security, testing, resilience etc. In general, the smaller the firm, the more difficult the task of obtaining and managing the skill requirements.
Incidents
Our discussions with firms suggest that the main success so far for those with malicious intent has been in defacing promotional material on websites or creating spoof sites. There have been very few significant incidents of serious external attack, although those firms with detailed monitoring procedures are detecting a large number of “suspicious” activities at the electronic perimeter. Given that, we do find it odd when an institution claims that it is not seeing any suspicious activity at its network perimeter. We know from our visits to other firms that a reasonable number of hacking software probes or attempted attacks, such as “portal of doom”, “deep throat” and “trojan cow” should be expected at the electronic perimeter each month.
| Bailey: fast track with care | ||||||
In fact, most incidents we have seen to date have been own goals by financial institutions themselves. A common feature has been where higher than predicted demand for a new service and subsequent volatility have overwhelmed the initial capacity provided, and resilience planning has not been robust enough to cope. A couple of cases have occurred in retail e-commerce where unexpectedly high volumes and the tweaks made to increase throughput have led to security problems, with customers being able to see each other’s details.
The publicity effect of an e-commerce incident can be hard to gauge, but it is normally considered at least damaging to a firm’s reputation. Interestingly, we have also noted that a security incident, if adequately handled, can increase the number of new customers in the following weeks – though this is not a promotional method the FSA would encourage.
One area where we believe most firms need to perform some work is in the handling of crises associated with e-commerce. Most institutions have crisis management plans but these need to be reviewed to ensure that they cater for e-commerce risks. From our work it appears the key elements are that the process should enable: – a
| Lord: basics must be handled well | ||||||
As indicated at the start, the regulatory challenges surrounding e-commerce – including consumer protection and market stability – are not vastly different in principle than for any other area of financial services. The key messages for firms in dealing with e-risk are quite simple – senior management need to: – be fully involved in e-commerce business and operational strategy; – operate close control where fast tracking is involved; – keep a grip on outsourcing policy and practice; – and make sure that the basics are done well.
Lydia Bailey and Crispian Lord work in the FSA’s Complex Groups Division, This article is written in a personal capacity and does not necessarily reflect the views of the FSA
