Fraud Prevention and Cybersecurity - Integrated Lines of Defense

Fraud

1. Fraud Prevention and Cybersecurity Integrated Lines of Defense Christopher B. Faustino CISM AVP / Deputy CISO, Converge ICT November 2023

2. Define: Cyber Attack and Cyber Fraud: Cyber Attack: Attempt to compromise or exploit a computer system or network in order to serve a malicious purpose. Cyber Fraud: Attempt to deceive or trick individuals, groups, or organizations for financial gain.

3. Not all Cyber Attacks involve Cyber Fraud. Denial of Service / Distributed Denial of Service is a notable exception. These attacks are designed to overwhelm a website or network with traffic, causing it to crash or become unavailable.

4. But the majority do! The top cybercrimes reported to the PNP-ACG in 2022-2023 are: online scams illegal access computer-related identity theft automated teller machine/credit card fraud cyber threats data interference photo and video voyeurism computer related fraud unjust vexation. Items in RED involve fraud. Source: PNP-ACG, Sep 15 2023

5. The Cybersecurity Mindset The cybersecurity mindset emphasizes systemic security. Defense in Depth. Any security system is only as strong as its weakest link (usually, people). CIA Triad – Confidentiality, Integrity, Availability. Most of the time, cybersecurity professionals ensure that access to a specific system or application is tightly controlled. Whatever transactions happen after successful authentication are beyond their scope of work .

6. The Fraud Prevention Mindset The fraud prevention mindset focuses on monitoring transactions even after authentication. Fraud prevention assumes that even properly authenticated users may be operating under the influence of fraudsters. Finding irregularities in transactions is the key.

7. Silos: Or, how not to approach Fraud and Security When fraud prevention teams don’t design their strategies to keep the principles of systemic integrity in mind, they risk wasting time and effort and can lose millions to criminals. Conversely, when cybersecurity efforts are solely focused on guarding access to account-based information and not monitoring what users do afterward, firms are vulnerable to several forms of attacks .

8. How do we combine the two? 1. Train Teams Empower both teams with a centralized view of account lifecycle events and attributes for continuous monitoring and protection. Be mindful of data protection regulations, but allow teams to make the most of the company’s data resources. 2. Optimize Resources Allow the tools developed or purchased by one area to benefit another one to make the most of your firm’s resources. Consider platforms or tools that support adaptable data integration and organization across diverse data sources. 3. Encourage Collaboration Ensure that both disciplines learn from one another to promote success. Consider establishing joint drill sessions for functions with functional overlaps, such as bot activity detection and account protection.

9. What are the benefits? 1. Improved threat detection By seamlessly incorporating cybersecurity and fraud prevention measures, businesses can enhance their ability to promptly and efficiently recognize potential threats. This involves deploying fraud detection software, conducting frequent employee training sessions, and harnessing the combined expertise of both teams to pinpoint suspicious activities. 2. Increased data protection A unified approach to security and fraud prevention is crucial for businesses to safeguard sensitive data and thwart unauthorized access. Employing identity verification measures, conducting thorough background checks, and fortifying internal controls are key strategies that enable companies to mitigate the risk of data breaches and ensure the security of their customers' information. 3. Enhanced response capabilities The synergy between cybersecurity and fraud prevention teams empowers businesses to respond promptly and effectively to potential threats. Establishing precise protocols for incident response, conducting routine drills to assess response times, and capitalizing on the collective expertise of both teams contribute to the development of effective mitigation strategies.

10. What are the benefits? (continued) 4. Improved customer trust When businesses actively focus on cybersecurity and fraud prevention, they not only show a commitment to safeguarding sensitive information but also earn customer trust. This commitment can lead to increased customer loyalty, repeat business, and positive word-of-mouth recommendations. 5. Cost savings When businesses combine cybersecurity and fraud prevention, they can cut costs related to incident response, investigations, and mitigating breach damage. This approach helps companies stay financially competitive and steer clear of expensive legal and regulatory fines.

11. Questions?

12. Thank you! All rights reserved (c) 2023