In today’s dynamic world, the fifth generation of global wireless technology (or as we know it, 5G) is driving innovation in the financial sector, and the global pandemic is changing everyone’s lifestyle and payment habits, online payments become more and more important. Against this backdrop, the most dominant tendencies are mobile and online banking, as well as investment banking. The rapid development and increased usability of online banking involve constant sharing of customers’ financial information electronically and securely, and this has become a significant challenge for the financial industry.
PSD2 in a Nutshell
Bankshave to allow a secure way for the customer to authorize a third-party provider to:
(1) have direct access to account and transactions data,
(2) make and authorize payments via APIs.
Customershave to be able to trust the privacy and security of their information, hence multi-factor authentication (at least two-factor one) and granular authorization controls (“entitlements”) have to be in place.
PSD2 Main Areas
We have previously reviewed the PSD2 requirements in detail and highlighted the technical aspects concerning logs of online banking. We also reviewed the European Banking Authority (EBA)’s Guidelines regarding secure logs, showing the importance of protecting logs related to payments.
However, keeping logs protected, and therefore – customer data unbreached, is not a trivial task. Financial organizations are often challenged by their legacy systems which don’t allow easy and straightforward integration. SIEM Software appears to be the best solution for them, as it’s combining different security aspects that need to be covered.
How Can aNextGen SIEM cover PSD2 Privacy and Security Requirements?
Visibility
Ability to “see” everything that is going on in a complex architecture.Logs, Traces, and Metrics to be enforced for collecting and analyzing data
To address this requirement, LogSentinel SIEM provides full, 360-degree visibility of everything that’s going on in one centralized command centre. Traces and action-specific logs are being gathered and analyzed thanks to the AI-powered behaviour analytics of LogSentinel SIEM.
Logs
Logs required are the records of discrete events. Often a combination of text and numerical data. Examples: an API request, transaction error, etc.
LogSentinel SIEM keeps all business-specific logs securely and in a readable format. Unlike other SIEMs, LogSentinel supports “Privacy of Logs“, enabling organizations to send encrypted logs and still do search and analysis with LogSentinel’s end-to-end searchable encryption.
Unlimited log retention: It’s important for most financial organizations to keep logs safe for longer periods of time. Thanks to LogSentinel SIEM, you can keep audit logs for as long as your compliance requirements mandate. We’ll accommodate that with smart storage management
Audit Log Integrity: Log integrity is crucial for security and PSD2 compliance. LogSentinel SIEM uses strong blockchain-inspired cryptography for legally-sound digital evidence
Conclusion
The Financial sector is one of the highly regulated sectors from a variety of standards and regulations, concerning information security, KYC and AML, open banking and more. Due to the high amount of payment transactions, the financial sector is also a primary target of cyber-attacks according to multiple reports.
Denitsa Stefanova is a Senior IT Business Analyst with solid experience in Marketing and Data Analytics. She is involved in IT projects related to marketing and data analytics software improvements, as well as the development of effective methods for fraud and data breach prevention. Denitsa supports her IT-related experience by applying her skills into her everyday duties, including IT and quality auditing, detecting IT vulnerabilities, and GDPR-related gaps.
