Banking and Finance Sector-Specific Plan - U.S. Department of ...

N R&D focused on SFTP will require effort to develop information-hiding techniques because they are needed to protect
sensitive customer and confidential information from unauthorized access while avoiding more onerous or unmanageable
cryptographic practices. (A related requirement is that key management needs to be simple, secure, and transparent.)
Q R&D focused on SFTP will require effort to develop economic models for secure communication methods because costs
to implement and maintain SFTP must not present an unacceptable burden to smaller merchants or local banks that may
operate with limited technical expertise and lower budgets.
4.2 Resilient Financial Transaction System (RFTS)
B, C, & F A distributed, resilient financial system must use best practices to prevent damage or destruction, including restricting
entry and access to physical infrastructure. Research and practices in those areas could be applied to any infrastructure
with high reliability and resiliency requirements. The distributed environment could be used to house detection and sensor
systems and to disseminate the information those sensors carry, to aid in the system’s self-healing capabilities.
E Automated decision-support and analysis are a subcomponent of any resultant transaction system. Increases in online fraud
have made the financial industry fertile ground for such real-time analysis.
H As the financial industry becomes more and more automated, financial systems technology architects and engineers
require access to research in the design of complex systems, including modeling, operation, and failure-recovery.
I Government and private sector coordination during a terrorist attack and risk communication and management will be
key areas for maintaining CI/KR to support a functioning financial sector during a natural or manmade disaster. Models
developed in this area would apply broadly to other CI/KR sectors.
L The processes, standards, and procedures developed to run such a system would be applicable to other systems with similar
scope and resiliency requirements.
4.3 Enrollment and Identity Credential Management
B, H, & K The necessary improvements in enrollment and identity credential systems require advances in protection and prevention
systems, development of advanced infrastructure architectures, and advanced methods to authenticate and verify
personal identity to meet the performance objectives.
I Improvements in financial systems customer enrollment, data consumption, and aggregation habits require greater knowledge
of human and social issues. Decisions that financial services customers make with respect to personal privacy and
convenience are both appropriate and well-defined topics for research.
4.4 Suggested Practices and Standards
A, B The financial sector is the most common target of miscreants’ activity due to the potential for financial gain. The sector
is subject to constant attack, both traditional and innovative. Hence, it is a most fertile field for research on detection and
sensor systems, and the sector also has been a leader in combining detection with prevention, as potential fraud activity
triggers additional control. Research results in layering these technologies easily could be ported to the requirements of
other industries.
C Due to the FDIC guidance with respect to two-factor authentication, the financial sector has established cooperative efforts
devoted to entry and access portals. Researchers in these areas are encouraged to contact the Financial Services Technology
Consortium (FSTC) to learn more about them and to join and contribute to these efforts through the Object Management
Group (OMG), Open Web Application Security Project (OWASP) and other standards groups where financial institutions’
Banking and Finance Sector-Specific Plan