Client: Financial Institution A (a first-tier financial company)
Project period: Carried out for about six months in 2013
Project background and subject
The client, a first-tier financial institution, is required under the Regulation on Supervision of Electronic Financial Transactions to conduct a security review when developing or building an information system. Because the newly developed information system is mainly a financial service that uses smartphones, the purpose is to secure safety from a security standpoint by reflecting, in the analysis, design, development, and test phases, (personal) information protection requirements from a compliance perspective, including not only the existing supervisory regulations but also various newly issued guidelines and comprehensive countermeasures.
IT and Information Security Environment
Business and IT environment
As a first-tier financial institution, the client is continuously pursuing development and upgrades in order to provide a variety of financial transactions and product-introduction services using smartphones, along with its existing PC-based internet banking service.
In the current situation, in which the number of smartphone users nationwide has exceeded 30 million, a smartphone is a good customer channel from the client’s business perspective. By using smartphones to acquire a variety of customers and to provide an easy financial transaction service, the client can expand financial products for existing customers and acquire new customers.
Information protection environment
Bank A, which is under the supervision of the Financial Supervisory Commission, standardizes and operates the procedures and methods that must be followed when developing information systems. In order to check conformity with the related regulations and guidelines for the new service in hybrid-app form, and to prevent technical security vulnerabilities, it carried out a security review and a vulnerability assessment at each development phase.
Project CSF
- An accurate understanding of the information system being built (system components, protocols, and so on)
- Derivation of the exact security requirements mentioned by higher supervisory agencies and in related guidelines and guides
- Presentation of guidance at the level of a concrete implementation method so that developers can implement the security requirements
- Immediate change management of security requirements when information system development requirements change
- Establishment of effective and appropriate security measures for security vulnerabilities that inevitably remain despite repeated security vulnerability assessment and remediation
Key Activities and Deliverables
| Phase | Key activities | Deliverables |
|---|---|---|
| Security in the analysis phase | – Analysis of security requirements in related laws, regulations, and guidelines – Analysis of the developed information system and analysis of technical security requirements – Identification of security requirements for the development environment – Identification of the causes of related security-incident cases and reflection of the requirements | – Security requirements definition document (development environment, technical elements, legal and institutional requirements, and so on) |
| Security in the design phase | – Analysis of possible security threat scenarios – Security countermeasure guide for each security requirement – Development of, and training on, developer security policies and guides | – Security threat scenario analysis report – Security application guide for each security requirement – Developer security guide |
| Security in the development phase | – Advice on issues when applying information security requirements – Build security solutions – Perform a security inspection of development source code and correct findings – Establish a vulnerability assessment inspection plan for each information system component | – Source vulnerability assessment result report – Security vulnerability assessment plan |
| Security in the test phase | – Security vulnerability assessment for each component and presentation of remediation measures – Remediation of discovered vulnerabilities and repeated performance of the vulnerability assessment – Identification of residual risk and establishment of countermeasures | – Security vulnerability assessment result report – Security vulnerability assessment comprehensive report |