Key Financial and Cybersecurity Compliance Regulations
Today’s extensive security compliance regulations are a result of attacks like this.
However, as different countries and states have sought to regulate their way toward widespread security, it’s vital to have a clear understanding of precisely which applies to your financial enterprise.
Here are the key financial and cybersecurity compliance regulations and how to achieve them.
PCI DSS
The Payment Card Industry Data Security Standard (PCI DSS) is focused explicitly on the secure handling of payment info online. Its latest update, 4.0, mandates some proven secure network design, like a firewall; encryption of all data being sent over public networks; avoiding any default authentication details; and restriction of physical access to cardholder data.
On top of that, new requirements include Multi-Factor Authentication and regular penetration testing. Fines and the suspension of card payment processing can be levied against any organization in breach of this.
Check Point helps retail and transaction providers achieve PCI DSS via a suite of security hardening tools.
Transmission can be secured with Virtual Private Network, but older firewalls aren’t able to content with this degree of encryption: Check Point’s Next Gen Firewall (NGFW) offers deep packet inspection that analyzes and secures all ingoing and outgoing connections.
Gramm-Leach-Bliley Act (GLBA)
A US-specific one, the GLBA had a huge impact on the ways in which financial services can operate: it allowed banks and insurance companies the freedom to consolidate, making it immensely wide-ranging upon its implementation in 1999. Ignoring its potential impact in the ensuing 2008 crisis, a derivation of the GLBA was the Safeguards Rule, which mandates that every financial institution needs to establish a written information security plan.
While it was one of the first widespread regulatory requirements, it’s since been updated with new demands that took effect in 2023. It details how every organization needs a written plan of preparedness and ongoing efforts to protect clients’ personal information – which applies to all consumer information, past or present, related to the institution’s products or services.
Alongside this, GLBA also requires every organization to designate at least one employee to oversee the safeguards:
- Conduct comprehensive cybersecurity risk analyses for each department
- Develop and test a program to secure the data
- Continuously update safeguards
For the CISO or security manager made responsible, GLBA compliance demands an in-depth understanding of the vulnerabilities and cyber risks facing an organization. Check Point Infinity simplifies security by combining AI security assessments with the threat intelligence of an industry leader.
GDPR
GDPR, like GLBA, is legally binding: unlike GLBA, it’s valid for all European citizens, and has racked up some of the largest single fines on record since its implementation in 2018.
Central to GDPR’s security demands is the principle of security by design. This demands all systems be built in accordance with an organization’s own written security policies, and then further protected with suitable safeguards that reflect the criticality of data being stored. Similar to the GLBA, it demands an individual or team be held liable for this ongoing protection, and also identifies the need for regular re-assessments.
These security obligations also extend to any data processor that handles the personal data of an EU citizen – making it one of the farthest-reaching regulations today.
Non-compliance fines are eye-watering: less severe infringements can expect fines of up to €10 million, or 2% of global annual revenue. More severe fines go up to €20 million, or 4% of turnover – whichever is higher. Meta has been hit with a €1.4 billion fine for violating GDPR – not including the fine levied against WhatsApp, which it owns, for another €225m.
Large organizations need to be particularly aware of GDPR’s requirements.
To achieve this, they need to implement security by design: but how do you retroactively secure systems that have been in place for years? NGFWs with AI-driven alert analysis is one way for teams to cut back the large alerts generated by sprawling tech systems, and an integrated security suite can further drive proactive GDPR compliance.
Key to keeping this compliance is a high degree of DevOps security: large organizations can maintain build quality with Check Point CloudGuard, which continuously monitors DevOps systems for misconfigurations pre-deployment.
Federal Financial Institutions Examination Council (FFIEC)
The FFIEC is a cross-agency council in the US that focuses on enforcing cyber security regulations across financial institutions. It was one of the first regulations to explicitly mention biometric and two-factor authentication in 2006, but suffered from little real-world implementation thereof.
Because of this, in 2007, it relaxed its requirements to simply ‘layered security’.
Despite its slightly looser requirements, its FFIEC Cybersecurity Assessment Tool is used for self-assessments, and it offers training programs for financial institution examiners.
Check Point exceeds FFIEC requirements with automated Security CheckUps, which allows you to assess all network data points – and their corresponding security coverage – in minutes, giving lean teams an immediate head start.
New York Department of Financial Services Cybersecurity Regulation (NYDFS)
The NYDFS, or just DFS, is a comprehensive framework that applies to all financial institutions in New York. DFS 500 requires all financial organizations to establish structured security programs, with specific requirements for the ways in which data is protected. Firewalls, encryption, least-privilege authentication, and secure network routing are all outlined, as well as regular assessment periods and suitable personnel identified.
It’s an in-depth regulation that hasn’t shied away from fines: recent settlements include a $35 million fine for Nordea, and $1.2 million on an unspecified trading platform for violating those security requirements.
While DFS compliance requires a number of core security tools, it can be difficult to keep an eye on whether your organization is staying on top of it all. To gain this insight, Check Point provides a full suite of tools – along with a real-time map of all dataflows within your networks, including third-party services. This lets you explore the efficiency of your security tools, and how well different types of data are protected.
Condense all of this information into a regular reporting schedule and ensure continued compliance.
Revised Payment Service Directive (PSD2)
Another European regulation, PSD2 demands electronic payment platforms adopt strong customer authentication and secure communication channels. Part of this is to establish a standardized way of accessing online payment accounts – which makes it possible to identify third-party payment services.
This demands that financial organizations retain a degree of visibility into the different services they interact with.
PSD2 isn’t necessarily punishable with fines, but instead becoming an industry expectation; it’s likely that EU countries will individually issue corresponding laws in the near future.
Monetary Authority of Singapore (MAS) Regulations
The MAS cybersecurity regulations lay out some similar requirements as DFS’: they require that senior managers have suitable expertise in the field, establish processes that collect and analyze all information related to the enterprise’s security, and make use of wider threat intelligence.
Penetration testing is explicitly detailed, as is keeping DevOps standards in line with secure cybersecurity practices.
We’ve already touched on how CloudGuard helps with this, but Check Point’s manual penetration testing team can dig into the deepest corners of an enterprise’s attack surface, and deliver actionable results. Rather than a single flat report, Check Point’s pen testing team delivers prioritized results along with on-the-ground recommendations – whether it’s external network testing you want, or social engineering.
These help enterprises remain compliant, even with MAS’ most recent update which places emphasis on complex, third-party supplier risk. It lets enterprises build a:
- Set of industry standards for all vendors
- Vetting process for any third party using the enterprise’s API.
Since MAS fines can reach up to $1 million per violation, it’s never been more important to remain on top of financial compliance.
Feedback