Palo Alto Networks 2015 Predictions: Financial Services & Payment Processing

As 2014 comes to a close, our subject matter experts check in on what they see as major topics and trends for the new year. (You can read all of our 2015 predictions content here.)

Although financial institutions have long allocated resources to security, they have often been under siege, and have frequently been victims of some of the largest breaches in recent years.

Bottom line: they still need to do more. Here are a few of my predictions on this industry for 2015:

1. The pace of investment will accelerate and companies with best-in-class security will stand out.

2015 will see a change in the level of innovation and investment, and overall spending and investment in resources will accelerate, driven by companies that have kept pace with security, implementing all best practices, from network segmentation to systematic patching.

Organizations that have best in class security will stand out from others who still need to catch up. We’ll know this because hackers will prey on the least protected companies as low hanging fruit – easy to spot.

2. More regulations will surface for segments that are core to the integrity of the international financial markets including trading exchanges.

In 2014, the SEC in the US and its Office of Compliance Inspections and Examinations (OCIE) issued an alert focusing on the cybersecurity preparedness of institutional investment organizations and capital markets. More than 50 registered investment brokers and advisers were surveyed on their level of preparedness.

This exercise is just one of many examples showing that more guidelines and, potentially, regulations will be crafted to ensure a consistent and higher level of security in financial markets. The SEC guidelines and survey documents can be used today as a resource to evaluate your security posture. Use the alert to close any gaping holes in your defenses!

3. 2015 will see the start of the overhaul of the payment processing segment, especially in the US.

American credit cards have historically been lagging behind the rest of the world when it comes to security. While the US market will slowly migrate to chip and pin cards, the market is now opening for more innovative payment technologies.

Unfortunately, priorities on new payment technologies are still based on costs and fees more than security. 2015 will most likely be the year where the adoption of Apple Pay or Google Wallet by consumers get weighed against merchants’ preference for alternative CurrentC because of its lower fee model.

Just like any other new and hyped technology, Apple Pay and virtual payment schemes will no doubt become prime hacking targets. Securing payment processes should remain a top priority for any business.

 

The challenge of securing financial services organizations is among many industry-specific topics planned for Ignite 2015, where you will tackle your toughest security challenges, get your hands dirty in one of our workshops, and expand your threat IQ. Register now to join us March 30-April 1, 2015 in Las Vegas — the best security conference you’ll attend all year.

 [Palo Alto Networks Blog]

 

Palo Alto Networks Named a Winner in GSN 2014 Homeland Security Awards

We’re pleased to announce that Palo Alto Networks has won in the Government Security NewsHomeland Security Awards category for Best Network Security/Enterprise Firewall.

We were also announced as a finalist in the Best Anti-Malware Solution category.

 

The GSN 2014 Homeland Security Awards Program was organized to honor distinguished vendors of IT Security and Physical Security products and solutions and the dedicated federal, state, county and municipal government agencies, whose combined efforts help to keep the United States secure.

You can view the full list of Homeland Security Awards winners here.

[Palo Alto Networks Blog]

Industrial Automation and Control Systems Security Needs Strong Governance

Ivan Alcoforado, CISSP, PMP
The cybersecurity landscape has changed and evolved to more sophisticated threats targeting the enterprise IT and industrial automation and control systems (IACS) supporting pipelines, refineries, manufacturing and power plants, mining, and railways. It is evident that critical infrastructure organizations must appropriately manage this new risk in their environments.

Very often, however, we find that organizations jump to the implementation stage without adequately establishing all of the processes needed to achieve their goals. From failing to establish cybersecurity risk management targets to having little oversight over metrics and controls, these companies do not have an IACS security program with proper governance.

IACS security and IT security are usually undertaken by separate teams with different drivers and requirements. The IACS devices (e.g., distributed control systems, programmable logic controllers, supervisory control and data acquisition) are managed by the engineering or automation department, whilst the IT components (e.g., IP network, infrastructure, servers, operating systems) are the responsibility of the IT department. Without proper coordination, there is often uncertainty about where the responsibility for IACS support and security lies, and gaps occur in the organization’s security capabilities.

I believe we need IACS and IT security strategies to be aligned to the business, ensuring that resources are allocated in an efficient and effective manner to bring consistent results. These results need to be measurable, comparable and in line with the company’s risk appetite.

Failure to establish proper IACS security governance can lead to poor management of risk with dire consequences to the organization’s operations. It may lead to individual security project flops, operational impacts to the very IACS we are trying to protect or to overestimating the organization’s own cybersecurity capabilities.

My recent ISACA Journal article talks about leveraging industry standards to build an IACS program with an adequate governance structure. This should give senior management a better view of the company’s IACS risk profile, enable clearer communications with all stakeholders, optimize the allocation of resources, and give clarity of roles to engineers, IT security professionals and IT auditors when it comes to IACS security.

Read Ivan Alcoforado’s recent ISACA Journal article:
Leveraging Industry Standards to Deal with Industrial Cybersecurity Risk,” ISACA Journal, volume 6, 2014.

[ISACA]

Nir Zuk Talks Securing the IoT

The Internet of Things (IoT) promises to revolutionize how we use everyday objects, creating new consumer and business applications that we can’t yet imagine. However, adding connectivity to so many devices also presents some serious security issues. Later this week at IGNITION: Future of Digital in New York, our founder and CTO Nir Zuk will detail the security considerations IoT developers must take into account when building products for the IoT.

Conference: Business Insider’s IGNITION: Future of Digital
Session: “There’s A Hacker In My Fridge! Securing the Internet of Things”
When: Wednesday, December 3, 2014, 8:00 a.m. ET
Where: Session 1 Room, The TimesCenter, 242 West 41st St., New York, NY

Interested in attending? Order tickets for the event here.

[Palo Alto Networks Blog]

English
Exit mobile version