Module 1: Introduction to Cybersecurity in Finance

Why cybersecurity is critical for financial institutions:
- Importance of safeguarding customer data, financial transactions, and institutional reputation.
- Risks from evolving cyber threats like ransomware, phishing, and financial fraud.
- The cost of cyber breaches: financial, operational, and reputational damages.
Overview of regulations (PCI-DSS, GDPR, FFIEC):
- PCI-DSS: Ensuring secure card transactions with guidelines for payment data protection.
- GDPR: Handling customer data responsibly and adhering to privacy laws.
- FFIEC: Cyber risk management and compliance standards for financial institutions.

Module 2: Threat Hunting and Monitoring

Tools like SIEM, IDS/IPS, and endpoint monitoring:
- Security Information and Event Management (SIEM): Real-time log analysis and anomaly detection.
- Intrusion Detection/Prevention Systems (IDS/IPS): Identifying unauthorized network activities.
- Endpoint monitoring: Protecting endpoints like ATMs, employee devices, and mobile apps.
Analyzing suspicious activities in real-time:
- Using threat intelligence feeds and logs to detect anomalies.
- Prioritizing threats based on risk scoring and business impact.

Module 3: Forensics and Recovery

Evidence collection and chain of custody:
- Techniques for capturing forensic data: disk imaging, memory dumps, and log preservation.
- Maintaining a secure chain of custody to support legal investigations.
System restoration and preventing recurrence:
- Steps for restoring compromised systems.
- Lessons learned and hardening systems against future attacks.
Hands-On Labs
Threat detection using SIEM tools:
- Configure a SIEM to monitor logs and alerts.
- Detect and respond to simulated attacks.
Simulated incident response tabletop exercise:
- Role-playing an attack scenario to practice detection, containment, and recovery.
- Testing communication and coordination during a cyber event.

Module 4: Security Governance and Frameworks

Governance structures and cybersecurity policies:
- Defining roles and responsibilities (CTO, IT staff).
- Creating a cybersecurity policy aligned with organizational goals. (example for internal and external (vendors))
Implementing security frameworks (e.g., NIST, ISO 27001):
- Overview of NIST Cybersecurity Framework’s core functions (Identify, Protect, Detect, Respond, Recover).
- ISO 27001: Building an Information Security Management System (ISMS).
Cybersecurity maturity model assessments:
- Evaluating organizational security posture.
- Planning incremental improvements to achieve advanced maturity levels.

Module 5: Data Protection and Privacy

Data classification and protection strategies:
- Identifying sensitive data types and assigning protection levels.
- (implement DLP, monitor emails, categorize data types)
- Using encryption and tokenization for secure data storage.
Privacy laws and data governance:
- Compliance with global and regional laws (GDPR, CCPA).
- Creating policies for data access and retention.
Data breach prevention and response planning:
- Proactive controls like DLP (Data Loss Prevention) tools.
- Incident management plans for responding to breaches.
Hands-On Labs
- Know encryption
- Demo on real-world ftp files exchange with client using PGP (Pretty Good Privacy)

Module 6: Employee Training and Awareness

Building a culture of security within the organization:
- Leadership involvement in promoting cybersecurity awareness.
- Encouraging employees to adopt best practices.
Phishing awareness and social engineering prevention:
- Training staff to recognize phishing emails and suspicious behavior.
- Conducting mock phishing campaigns for testing awareness.
Continuous training and testing:
- Regular workshops and updates on emerging threats.
- Gamified cybersecurity training to improve engagement.

CEFI-YN: Cybersecurity Essentials for Financial Institutions