Banking and Finance Sector-Specific Plan - U.S. Department of ...

1. Common operating picture architecture;
2. Next-generation Internet with built-in security; and
3. Resilient, self-diagnosing, self-healing systems.
These goals will be achieved in the financial services industry only in conjunction with commensurate advances in CI/KR
technology. These advances will be achieved only if steady focus is maintained on the financial industry R&D challenges.
4. Research Guidance
This guidance explains why R&D in the FSSCC research challenge is a good and proper area of focus for R&D in the area corresponding
to the lettered column of the NIPP columns (A-M) of the matrix. For example, paragraph B in section 4.1 below is
meant to be understood as:
Secure Financial Transaction Protocol (SFTP) R&D is a good and proper area of focus for R&D in the area of protection and prevention systems
because protection and prevention systems are needed to protect against abuses of batch and real-time transaction processing capabilities
and to prevent certain fraudulent transactions from being processed.
This guidance also explains why the FSSCC R&D Committee has proposed four categories of R&D plans and programs that are
not addressed specifically in the NIPP. It describes why R&D focused on FSSCC research challenges will need to concentrate
some effort on the more general R&D theme identified (in columns N-Q of the matrix). For example, the paragraph Q in section
4.1 below is to be understood as:
R&D focused on SFTP requires as a prerequisite some focus on the “Economics of InfoSec” because the widespread acceptance of the results of
SFTP research will rely on the development of an economic model for secure communications types. This is because the costs to implement
and maintain SFTP must not present an unacceptable burden to smaller merchants or local banks that may operate with limited technical
expertise and lower budgets.
The format of each guidance paragraph is abbreviated because it is not intended to reproduce either the NIPP or FSSCC research
challenge document, but rather is intended to enable an academic researcher, a DHS reviewer, or other interested reader to
determine quickly the applicability of the FSSCC research challenge to a larger NIPP or other research area field of study.
4.1 Secure Financial Transaction Protocol (SFTP)
B Protection and prevention systems are needed to protect against abuses of batch and real-time transaction processing capabilities
and to prevent impersonation-enabled fraudulent transactions from being processed.
H Advanced infrastructure architectures are required to assure that availability and resiliency demands for SFTP are met. This
includes non-stop processing and intelligent distributed systems designs to achieve agreed-upon service levels.
J Compatibility of communications systems with interoperability standards is a must for any SFTP to assure that, regardless
of the sender’s computing resources, transactions can be interpreted and processed successfully.
K SFTP requires that mutual authentication of parties is established prior to transaction processing. Both automated and
human-interactive operations are in scope.
L SFTP, as well as any other secure protocols that accomplish NIPP R&D programs, should utilize and thus benefit from
rigorous acceptance methodology, including submittal to the ANSI X9 Committee for ratification and eventual certification
by the International Organization for Standardization (ISO) for Finance and Banking Standards.
Appendix : FSSCC Research and Development Agenda