Category Archives: Geographic

Singapore MAS Tech Risk Guideline (TRM) – Incident Reporting-SLA

Last post discussed the complication when running multiple bank applications on the same computing platform and need to decided when to report “a relevant incident” within one hour upon discovery.

This part will discuss on how this requirement going to affect Services Level Agreements in Singapore banking IT operations. Before this MAS notice come into effect, IT operations usually design system uptime or availability requirements according to business needs. System supporting real-time financial transactions has the higher uptime requirements. Even market data feed and AML systems which are not auxiliary to financial transactions requires high availability. Infrastructure system and monitoring services are usually regarded as secondary when availability is concerned. Failure of network monitoring system will not directly impact user or cause direct financial loss.

The MAS requirement on incident reporting within one hour upon discovery will change the importance of infrastructure system and monitoring services. Although it is possible for a bank to discover data breach or system malfunction weeks after the actual event happened, it is not what this MAS notice is designed for. The one hour upon discovery requirement is based on the bank has sound and robust monitoring infrastructure. Monitoring systems will need to run with similar availability requirement as the core financial system that requires monitoring services. Real log aggregation system like ArchSight and Splunk are important tool to discover network attacks and system malfunctions.  If a bank relies on these systems to detect attacks and provide real-time intelligence, their uptime will directly impact the bank’s capability to fulfill one hour reporting upon discovery requirement. For example, when ArchSight is used to monitor 200 servers and it is down due to an error when an SQL injection attack happened. The DB server log will still record the event happened at the correct time. When the ArchSight error is fixed, it will start processing server logs and the SQL injection attack will be identified. The time discovering this attack will be much later than the server log recorded. Could the bank claim the discovery is at the later time when the ArchSight is recovered from error ? Or MAS will deem the discovery happened when DB server recorded the attack?

The actual response and judgement will need to consider specific details of each case. However, the SLA of monitoring systems will need to improve in order to show the bank is committed to meeting MAS notice.

 

 

 

 

Singapore MAS Tech Risk Guideline (TRM) – Incident Reporting

When attending a PWC Singapore meeting on new MAS guideline, there are many questions in my head regarding how the 1 hour incident reporting requirement could be fulfilled.

The requirement requires banks operating in Singapore to report to MAS within one hour when relevant incident ( security breaches and malfunction) is discovered.

There are a few levels of complexity. One is boundary of application issue. The other is SLA issue.

Most international bank system are located in multiple time zone. Trading system maybe in London and centrally managed. Singapore application is running side by side with other regions applications. If only Japan application is under attack, shall MAS be informed taking the consideration that the affected JP application is running on same hardware platform as SG? If yes, MAS will be a central info hub of security incident globally. Also with time zone issue, international banks in Singapore will need to respond global incidents and be able to decide if the incident happening in London should be reported to MAS, not to mention the one hour requirement.

Systems are no longer running localized version. Virtualization and cost saving already change the old system to centralized and shared platforms. A clear boundary could not be easily draw when a component is affected.

I believe this question is already considered by relevant parties and MAS. One possible solution is focus on whether the remote incident materially impact Singapore operation. There should be some mutual understanding between regulator and banks on how to limited the catch all possibility of incident reporting requirement. Will talk about SLA later

Reading note on TRM guideline 2013

Reader of  the new TRM guideline from Singapore Monetary Authority will be surprised by the changes it made. It is not an simple update but a major rewrite of some of the sections. Also it incorporated key and fundamental changes in financial technology.

At the introduction section, the author set the tune for the whole document by stating that IT is no a cost center only and should be integrated with business strategies. This type of statement is advocated by vendors for a long time but I believe it is the first time a banking regulator making the same statement in a TRM guideline. From here, the reader could expect TRM function is not only about  system vulnerability or malware, project risk, governance and outsourcing are also important.

Para 1.0.1 “IT is no longer a support function within a financial institution (“FI”) but a key enabler for business strategies” 

The author also states user are more IT-savvy. from my experiences, the more accurate adjective would are user are getting more IT-demanding and require more features. Usability of non-financial internet and mobile applications has revolutionized by the uses of HTML5, AJAX and even 3D graphic. Users are demanding the old html only Internet banking to follow. MAS also sense these changes and urge banks to fully understand the risk before bending over backwards to please users.

Para 1.0.3 “FIs are also faced with the challenge of keeping pace with the needs and preferences of consumers who are getting more IT-savvy and switching to internet and mobile devices for financial services, given their speed, convenience and ease of use.”

Singapore MAS new TRM guideline

Singapore Monetary Authority after one year consultation released a Technology Risk Management Guideline. It is a major overhaul of the last version which was published in 2008. For sure, the banking industry and banking technology changed a lot with the omnipresence of 3G network and mobile devices.

As part of my job is to implement TRM in FI, I will write out my comments and observations in the coming posts. But first let us take a 3000 feet view of this document. A few text analysis tool and visualization graphic will do the job.

The first graph is a word cloud which shows high frequency keywords. FI means Financial Institutions. Most of the words are general IT terms like data and systems. But should notice that “ensure” appears in a relative big size !!

The left graph show the three selected keywords: Ensure, Access and Recovery. The peaks of access and recovery show that although they are used often, this keyword mainly used in one particular chapter.

FI

FI

TRM key work chart

To cloud or not to cloud ?

If you ask the above question to the various cloud services providers, I am sure their answers are “Definite yes”.

If you ask the same question to end users, their answers may end up like “I really don’t care.”. And for the question again to business owners, their answers will probably are “May-be’s” because seriously no one really reveals all the cloud benefits, implementation pros and cons to them.

To IT professionals, however, we will probably provide a vague answer – “It depends.”. The long form of the answer is – “It depends on the maturity of the cloud market, technology and whether the solution available today can match your budget, quality requirements, and expected service level. More importantly, whether cloud technology and solutions can help your company to improve competitive advantage.”

That’s exactly what Cloud Security Alliance (CSA) and Information Systems Audit and Control Association (ISACA) did in a recent survey to answer part of the question – what is the maturity of the cloud technology and market, now ? A collaborative project by CSA and ISACA , the Cloud Market Maturity study provides business and IT leaders with insight into the maturity of cloud computing.

The study also reveals that cloud users in 50 countries were least confident about the following issues (ranked from least confident to most confident):

  1. Government regulations keeping pace with the market (1.80)
  2. Exit strategies (1.88)
  3. International data privacy (1.90)
  4. Legal issues (2.15)
  5. Contract lock in (2.18)
  6. Data ownership and custodian responsibilities (2.18)
  7. Longevity of suppliers (2.20)
  8. Integration of cloud with internal systems (2.23)
  9. Credibility of suppliers (2.30)
  10. Testing and assurance (2.30)

None of these findings are really a surprise, I suppose, however it is important to conduct such project because it helps us to understand how the cloud market will change over time, and how it advances from infancy to full maturity.

Do check out the press release and the full report to understand more about the findings, or you can check out the following infographics – the whole report in one picture.

4 key questions about your security programme

If you are the CISO of your organization and implementing a security programme, what questions shall you ask yourself to help realizing a successful programme rollout ? No, it is not about what software to use, what hardware to install, what process to put in place or even what vulnerabilities you are going to remediate or mitigate. In fact, they are:

  1. Are we doing the right things ?
  2. Are we doing them the right way ?
  3. Are we getting them done well ?
  4. Are we getting the benefits ?

Four simple questions about your security programme, all about the business results – but not technology, schedule, and resources. Four questions about the reality such that your company can make informed decision. In addition, each of the four questions can be further elaborated, for examples:

Are we doing the right things ?

  1. What technology, processes are proposed ?
  2. For what business outcome ?
  3. How do the deliverables within the programme contribute ?

Are we doing them the right way ?

  1. How will it be done ?
  2. What is being done to ensure that it will fit with other current or future capabilities ? (e.g. Business / Operational / Technical capabilities)

Are we getting them done well ?

  1. What is the plan for doing the work ?
  2. What resources and funds are needed ?

Are we getting the benefits ?

  1. How will the benefits be delivered ?
  2. What is the value of the security programme ?

You shall answer all the questions based on relevant, current accurate business-focussed information. By that time, I am sure, you will find that to have a successful security programme, it is no longer depending on the technology, process and policy only, but also an investment that has an enormous impact on creating and sustain business value.

Dissemination of Information Security Knowledge

The daily work as information security practitioner is rather a chaotic one. The challenges has nothing to do with the zero-day attack that may happen any second or project deadlines. After more than 12 years of experiences as auditor, security manager and security consultant, I found the security domain is growing exponentially as user and business are more aware of risks in their even more Internet connected lifestyle. A security manager job duty is expanding from purely IT departments controls to application controls and even to privacy compliance.

With such rapid development of risk landscape, daily work of a security practitioner is no different from studying three to four PhDs concurrently with hundreds of email arriving your mail box. Research in information security and risk management is difficult as it is still evolving and also closely tied to cultural and management style. Research skills are important but doing it alone without the directions and collaboration with other professionals is like the toil of Sisyphus.

“make the knowledge accessible and usable”

The most rewarding experiences in my career is the discussion and sharing with people in the industry. By joining activities and meetings organised by PISA, CSA, ISC2 and ISO SC27, I met with friends and mentors who are both intellectual and forwarding thinking. The idea of having a blog connecting information security professionals in Asia is coming from these experiences.

The satellite image at the top only shows the Asia regions are physically separated by ocean. It does not show there are also legislation, languages and ideology separations. These logical separations create some obstacles for close collaboration. Unlike security professionals in US and EU where they could meet and collaborate relative conveniently, Asia professionals will need to rely more on cyberspace for idea exchanges.

In short, this team blog has one goal as stated in the About page ” to inspire more information security professionals and practitioners to come forward and share their knowledge, understanding, and experience with the community.”