CEFI-YN: Cybersecurity Essentials for Financial Institutions

• Able to understand the key cybersecurity risks and challenges facing financial institutions today.
• Able to recognize the importance of regulatory compliance (e.g., GDPR, PCI- DSS) in the context of financial cybersecurity.
• Demonstrate cybersecurity posture of financial organizations such as identifying vulnerabilities and mitigation strategies.
• Able to understand and participate in advanced threat detection tools, methodologies, and processes.
• Able to participate in investigation, containment, and remediation of cybersecurity incidents in a financial institution’s infrastructure.
• Able to analyze real-world cyber incident especially in financial line.
• Able to understand the role of cybersecurity in protecting financial data, customer privacy, and business continuity within the financial industry.
• Able to develop knowledge of common cybersecurity frameworks and best practices (e.g., NIST, ISO/IEC 27001) for financial institutions.

Module 1: Introduction to Cybersecurity in Finance

• Why cybersecurity is critical for financial institutions:
  • Importance of safeguarding customer data, financial transactions, and institutional reputation.
  • Risks from evolving cyber threats like ransomware, phishing, and financial fraud.
  • The cost of cyber breaches: financial, operational, and reputational damages.
• Overview of regulations (PCI-DSS, GDPR, FFIEC):
  • PCI-DSS: Ensuring secure card transactions with guidelines for payment data protection.
  • GDPR: Handling customer data responsibly and adhering to privacy laws.
  • FFIEC: Cyber risk management and compliance standards for financial institutions.

Module 2: Threat Hunting and Monitoring

• Tools like SIEM, IDS/IPS, and endpoint monitoring:
  • Security Information and Event Management (SIEM): Real-time log analysis and anomaly detection.
  • Intrusion Detection/Prevention Systems (IDS/IPS): Identifying unauthorized network activities.
  • Endpoint monitoring: Protecting endpoints like ATMs, employee devices, and mobile apps.
• Analyzing suspicious activities in real-time:
  • Using threat intelligence feeds and logs to detect anomalies.
  • Prioritizing threats based on risk scoring and business impact.

Module 3: Forensics and Recovery

• Evidence collection and chain of custody:
  • Techniques for capturing forensic data: disk imaging, memory dumps, and log preservation.
  • Maintaining a secure chain of custody to support legal investigations.
• System restoration and preventing recurrence:
  • Steps for restoring compromised systems.
  • Lessons learned and hardening systems against future attacks.
• Hands-On Labs
• Threat detection using SIEM tools:
  • Configure a SIEM to monitor logs and alerts.
  • Detect and respond to simulated attacks.
• Simulated incident response tabletop exercise:
  • Role-playing an attack scenario to practice detection, containment, and recovery.
  • Testing communication and coordination during a cyber event.

Module 4: Security Governance and Frameworks

• Governance structures and cybersecurity policies:
  • Defining roles and responsibilities (CTO, IT staff).
  • Creating a cybersecurity policy aligned with organizational goals. (example for internal and external (vendors))
• Implementing security frameworks (e.g., NIST, ISO 27001):
  • Overview of NIST Cybersecurity Framework’s core functions (Identify, Protect, Detect, Respond, Recover).
  • ISO 27001: Building an Information Security Management System (ISMS).
• Cybersecurity maturity model assessments:
  • Evaluating organizational security posture.
  • Planning incremental improvements to achieve advanced maturity levels.

Module 5: Data Protection and Privacy

• Data classification and protection strategies:
  • Identifying sensitive data types and assigning protection levels.
  • (implement DLP, monitor emails, categorize data types)
  • Using encryption and tokenization for secure data storage.
• Privacy laws and data governance:
  • Compliance with global and regional laws (GDPR, CCPA).
  • Creating policies for data access and retention.
• Data breach prevention and response planning:
  • Proactive controls like DLP (Data Loss Prevention) tools.
  • Incident management plans for responding to breaches.
• Hands-On Labs
  • Know encryption
  • Demo on real-world ftp files exchange with client using PGP (Pretty Good Privacy)

Module 6: Employee Training and Awareness

• Building a culture of security within the organization:
  • Leadership involvement in promoting cybersecurity awareness.
  • Encouraging employees to adopt best practices.
• Phishing awareness and social engineering prevention:
  • Training staff to recognize phishing emails and suspicious behavior.
  • Conducting mock phishing campaigns for testing awareness.
• Continuous training and testing:
  • Regular workshops and updates on emerging threats.
  • Gamified cybersecurity training to improve engagement.