corrections

Submitted to

Dr. Asila Sayedi

By

Sravan Kumar Reddy

ID: 515221

California University of Management and Sciences, Virginia.

July 17th 2016

VII. Recommendations and implementations

Protecting the user information and preventing the phishing attempts from various threats across the globe is something which Citibank Group & Co. should constantly keep a track of. Market analysts around the world estimate a loss of $400 Billion each year due to cyber-attacks and moreover the financial firms are attacked more frequently than any other firm in the world. Constant monitoring along with the implementation of new threat-effective technology will help Citibank Group & Co. stay alert and shield itself from cyber-attacks.

With this primary conviction the security risk management approach outlines few necessary requirements for Citibank Group & Co. to consider itself cyber-safe in the web of threats. The constant need to prevent intrusion, protect the sensitive data and secure the transaction system has helped come up with few plans that shield the financial firm from cyber-attacks. (Crossman, 2016).

Plans recommended for Citibank Group & Co. for better security

Security threats can be both internal and external threats. However, the security risk management approach helps come up with few recommendations for Citibank Group & Co. whose implementations need to be strategized.

I. Detecting the intrusion

The online trade of shares and stocks has become the order of the day for the investment bankers. These trades are mostly carried out by the servers which are secured through various protocols. These protocols are easily invaded by hackers around the world when they have access to the primary keys through which these servers are secured. The decrypted server is something which endangers the entire organization and can put an end to the further transactions of the trading world. (Irrera, 2014)

II. Protecting sensitive data

Every trader registered with the bank can trade over NASDAQ scales or NYSE scales. These are generally done through the entry access given by Citibank which have the user ID’s and access control parameters which can help the trade to run smoothly. These ID’s help traders to identify themselves and have access in order to invest or sell the stock. These access names and ID’s can be easily fall into the hands of intruder who phish to get control of all the transaction through impersonating a particular user. Hence there is always a need to protect this sensitive data. (Elliot, 2016)

III. Securing the transaction system

The transaction system is basically the IT hardware and software implemented in order to process all the trading through proper encryption. These transaction systems are the core for all the transactions. This system can be corrupted through malware which affects the transaction system and there by the access to various stock values can be achieved and the entire stock market can be mutilated. This can be a big threat to Citibank and proper implementations need to plan in order to stay secure at times of a malware attack. (Citibank Group & Co., 2016).

Implementation strategy for the recommended plans

The implementation strategy for the recommended plans can be categorized based on the plans themselves. These recommendations can never be settled for as accomplished as time to time work has to be done in developing the existent technology so that future Trojans can have no effect on the present implementations.

I. Preventing the intrusion into the servers

a. Biometric authentication

The users and account holders are provided with various credentials which are required to be kept safe. Most of them are on papers credentials which are safe most of the time but the online credentials are never safe. Hence a need for biometric authentication arises. (Goldstein, Perlroth & Sanger, 2014)

b. Sophisticated trader-dealer digital agreements

The trading over various shared assets occurs from multiple servers across the world. People from all over the world are interested in constant investment in these assets and most of it is online these days. Hence these trades are mostly exposed to these threats. And digital agreements prevent such intrusion. (Titcomb, 2014)

c. Access control and digital alarming devices

The account holders of Citibank have certain authentication data which they have to use at the time of processing a transaction online. These transactions can include anything from a simple transfer of funds between accounts to buying or selling shares over the stock market. When such process is interrupted by foreign attacks and disrupted by the involvement of cyber-threats Citibank must implement the latest technology which aretechnologies which are the digital alarming devices. (Pultarova, 2014)

These devices alert the administrator and the network engineer mainly to realize the existence of a threat and help them act according to the damage expected based on the threat detected.

Along with the implementation of alarming devices the latest technology used by Citibank currently is the access control and authentication restriction through a two factor keying system. This system prevents the entry of any phish into transaction system and its attempt to corrupt the system. (Snider & Johnson, 2014)

II. Protecting sensitive data

a. Investing in data security tools and firms

The investment banking is now a days mostly online and the data is mostly processed through a server -client technology. This technology helps exchange of information over a particular protocol and thus facilitating the need to develop the transmission of online trade over the server protocols. This facility is there by provided by the secure transaction of the bank terminal and can thereby be processed through a secure link of web servers. These servers can be instigated with a defense mechanism through the investment of tools and firms can thereby be selected as a firm secure implementation over the entire organization structure. (American Bankers Association, 2016)

b. Fraud management tools

Fraud can include anything from simple online duplication to creation of false identity which only increases the number of accounts for the firm. But these useless accounts only serve as the loss trackers. This can strictly be avoided when such fraud can be detected. The fraud is mainly due to the phishing attacks attempted by hacker all over the world. Citibank been the biggest investment banking company in world has the highest chance of been affected by these cyber- threats. (Bernard, 2014).

The data duplication is a severe threat and hence fraud management approach helps prevent the existence of fraud accounts.

c. Multiple layers of webbed secure networks

The process of money transfers whether it is investing in a particular or trading for a particular entity over the banks protocol based transaction system is generally a process which has to go through several levels of security. These secure layers are generally bytes of code generated by developers hired by the firm. The IT department takes care of the entire processing and the protocols generated by these developers help enhance the risk measures taken by the organization. (Banking Tech, 2016)

Webbed security layers are implemented in such a way that the highest priority risk which can cause the maximum damage is defended first and the threats are managed based on the priority levels. Multiple web layers ensure secure transaction and thereby facilitating the transaction mechanism with the highest possible security level. (Witty, 2015)

d. Employing trust worthy

The employers within the organization maintain the database of over millions of customers all over the world. The most secure information which identifies the users and their sensitive information which may include the social security numbers, account numbers and other sensitive information which is actually exposed at their disposal. managing such information requires the utmost ethical discipline of the employee as a small change of thought of the employee can result in the collapse of the entire organization. The unethical behavior should strictly be avoided within the organization’s functioning. The complete database is generally secured with utmost encryption which helps secure the information of the users. The trade and commerce of Citibank also depends on the employer’s ethics and the trustworthiness of the employers plays a very critical role in gaining the customer confidence. (Bernstein, 2016)

III. Securing the transaction system

a. Digital certifications

The transaction system is generally accredited by several government agencies which check for its proper functioning. Over and over again these agencies constantly check for the performance and validity of the transaction system and its functioning. With the approval of these agencies the transaction system is generally certified. These certifications are mostly digital these days and the entire transaction system is monitored remotely from various other localities of the firm technical support. (Conference of State Bank Supervisors, n. d.)

Digital certifications like SSL, act as blockers. They help to block sites which have broken links and also prevent any access attempts made through such broken links. (Sheen, 2016)

b. Cyber Insurance

Insurance generally ensures any firms or individuals assurance or future in case of any occurrence of disaster over the period wherein the person or the firm pays the insurance premiums. a similar facility is provided for the all the disasters which occur over the internet. This kind of insurance is called Cyber- insurance and helps ensure restoring of the organization’s assets to the maximum possible extent in an event of cyber-attack. (Morgan Stanley, 2015)

According to Horne (2014), Cyber -insurance nowadays is offered by the federal clients after the 2007 disaster which collapsed the entire US and world economy. United States at least has taken up the task of creating the insurance plans for all the possible disasters possible and helps grant the funds to restore the property. Cyber-insurance however only helps the firm and not the account holders or the users. Hence, it is the responsibility of Citibank to ensure that the maximum funds are restored first to the users or account holders and later on the firm should look into investing in its development and restoring activities.

Cyber Insurance helps the financial firm during times of hacker attacks and in times when the firm faces huge financial losses. (Horne, 2014)

c. Coordination with law enforcement agencies

Coordination with law enforcement agencies helps provide a legal backing to the firm and thereby allowing the federal agencies to take care of the security. The law enforcement agencies take on the monitoring of the transaction system. Citibank when collaborating with these agencies tends to develop a security which will help the firm to attain stability in times of any huge debacles. (McGee, 2014).

The entire turn over loss can be recovered through staying signed in and collaborating with these agencies thus providing the platform to grow and expand with proper back up so that any future trade can be easily processed with federal security. (Luyendijk, 2015).

d. Secure ETF

References

Adam, J. (2010). Citibank Group SWOT analysis. Free SWOT Analysis. Retrieved from http://www.freeswotanalysis.com/swot-analysis-of-banking-sector/41-j-p-morgan- -co-swot-analysis.

American Bankers Association. (2016). Cybersecurity/Fraud. Retrieved from http://www.aba.com/Tools/Function/Cyber/Pages/default.aspx.

Banking Tech (2016). Cyber security. Retrieved from http://www.bankingtech.com/tag/cybersecurity/