Financial Services Technology Consortium March 18, 2008, Yale University Dan Schutzer Executive Director FSTC CyberTrust – PI meeting Unsolved Problems and Issues

Financial Services Technology Consortium 2 What’s changing in US Banking? Going Global Mergers and Acquisitions Increased Regulations Payment Convergence, SEPTA Increased Threat Non-conventional competition Web 2.0 and N Gen New Revenue Opportunities Non-conventional competition

Financial Services Technology Consortium 3 Public Policy  Compliance and Regulatory reporting and monitoring  Patriot Act  Anti-Money Laundering  Sarbanes Oxley  Federal Rule of Civil Procedure (FBCP)  Regulation E and CC – payment related  Basel  Data Leakage notifications  FFEIC two factor guidance to enable financial institutions to support secure remote access.

Financial Services Technology Consortium 4 Business Processes  Steeped in tradition and bound to legacy systems  Based on paper-bound processes  Need for more checks and balances and less reliance on PII data, such as social security numbers, mothers maiden name, and account numbers  Need for innovative re-thinking on key processes such as:  Account opening  General ledger  Risk Management  Record classification  Disaster Recovery and Incident management  Auditing  Payments and Trade Processing

Financial Services Technology Consortium 5 Social Norms  Huge, global  Functional Decomposition along relatively independent product lines  Need for customer-centric integrated access to information, and cross- channel, cross-product services and features  Current behavior of employees and customers need to be more security-aware  Major emphasis on data leakage; less emphasis on more critical areas such as prevention of data tampering and service denial

Financial Services Technology Consortium 6 Data Privacy and Security  Customers rights to access information requires, easy to use, but strong encryption and access controls  Privacy often impacts security  Monitoring employees for Insider Threat  Monitor customers for anonymous behavior  Find and shutting down spoof web sites  Contradicting policies around the world  Europe, opt-in  US, opt-out  Who owns information about customer reputation?

Financial Services Technology Consortium 7 Are laws and regulations working?  Laws and regulations are reactive, not proactive  Too many regulations to comply with, often contradictory  Have trouble monitoring employees and customers from a security and fraud finding requirement  Law of unintended consequences

Financial Services Technology Consortium 8 Questions? Dan Schutzer