1. Increased Role of Board and Senior Management

All members of the Board of Directors (BoD) have direct responsibility for oversight of technology risk. It is a wake-up call for some institutions who see IT as just a cost function.

Some key requirements to note are as follows:

• BoD and Senior Management must have members with knowledge to understand and manage technology risks.
• FIs should appoint a Chief Technology Officer and a Chief Security Officer (or equivalent, for smaller FIs).
• BoD should have governance and oversight over technology risks, including making key IT decisions.
• FIs should have a technology risk management strategy in place.
• BoD should undergo security awareness training.

For technology and information security leaders, MAS TRM Guidelines 2021 presents a new window of opportunity to engage your higher management on technology and security matters. It is essential to communicate what the FI's technology risks are, and more importantly, how it impacts the business. It is equally important to present a plan of action to manage these risks.

Technology comes with costs and risks, but it is also a business enabler that can provide value and efficiency if a proper strategy is in place. It is a culture change on the part of higher management to have an open mind when it comes to understanding technology opportunities, challenges, and risks.

The challenge for technology and security professionals is to deliver a technology risk management strategy that clearly explains the impact on business objectives for higher management to understand and appreciate.

2. IT Project Management

Another key focus is the governance of IT projects undertaken by FIs. This includes creating a project committee for large and complex projects, clear requirements for conducting vendor due diligence, Security-by-Design and a quality management process.

First and foremost, senior management is expected to be involved in large and complex IT projects that impact the business. This is to ensure that all business and security project risks are adequately addressed.

Requirements for vendor due diligence are made more explicit in MAS TRM Guidelines 2021. FIs should establish standards and procedures for assessing the security of the vendor and its applications. Depending on the criticality of the application, the Guidelines suggest that the FI should have access to the source code of the third-party software.

There is also an emphasis on Security-by-Design that is in line with the industry trend of shifting security left of the software development lifecycle. A Security-by-Design approach streamlines the development of a secure application, avoiding the complications that normally arise from having security as an afterthought.

3. Software Application Development and Management

The secure development of Application Programming Interfaces (APIs) is the key focus here. MAS recognises that financial services have become an interconnected ecosystem. FIs will increasingly collaborate and provide complex financial services to consumers by connecting to each others systems using APIs.

APIs should be sufficiently secure for the fintech ecosystem to flourish. Although API security is a complex topic that overlaps with other technology domains, the TRM Guidelines 2021 sufficiently expounds on key points. For example, the governance of third-party API access, security standards for API development and design, strong encryption, API security testing during pre-production, real-time monitoring of API calls and availability. A new requirement has been introduced that requires FIs to vet customers who want to consume their APIs.

4. Remote Access Management

The MAS TRM Guidelines 2021 provides foundational regulations for remote access management that focus on secure authentication, as well as the security of the devices that are used to remotely access a FI's information assets.

Strong authentication refers to the use of multi-factor authentication (MFA) to add on another layer of protection to ensure the identity of the entity requesting access to the FI's IT environment.

Industry-accepted encryption algorithms should be used to secure communication channels, safeguarding the integrity of any data or API calls. The Guidelines has an entire chapter outlining security practices on cryptography.

FIs should also ensure that the devices used to access their information assets have been hardened and adequately protected before access is granted. For example, devices should have endpoint protection solutions installed as well as be securely configured. Such practices allow secure remote connections by protecting physical and network infrastructure supporting the remote connections.

5. Bring Your Own Device (BYOD)

Bring Your Own Device (BYOD) refers to employees using personal devices to access business information and systems. BYOD is a double-edged sword. It permits a mobile and dynamic workforce but also introduces security risks that should be addressed by FIs.

Therefore, the Guidelines recommend that FIs revise their BYOD policies and procedures with security controls such as Mobile Device Management (MDM) or virtualisation solutions.

Mobile Device Management (MDM) solutions can be used to manage and control mobile devices and have features such as storage encryption, remote wipe, and baseline security monitoring. Virtualisation solutions allow end-users to remotely access the FI's IT systems and applications via mobile devices through a virtual environment or sandbox. We will explain more about Virtualisation in the next section.

6. Data and Infrastructure Security

The new Guidelines emphasise endpoint protection, with MAS recommending hardening of endpoints in line with industry best practices, such as Center for Internet Security (CIS) Benchmarks.

This includes secure configurations as well as the implementation and maintenance of endpoint protection solutions.

The network security section recommends the use of Network Intrusion Protection Systems and Network Access Control (NACs) to detect and block malicious traffic along with more traditional network security devices like firewalls. These devices should constantly be kept updated.

Like BYOD, the MAS TRM Guidelines 2021 introduced Virtualisation Technology for the first time. Appropriate policies and procedures to manage virtual machines and snapshots should be implemented. Access to hypervisors and system hosting hypervisors should be restricted.

The Guidelines also brought up sandboxed browsing and IoT Security. Sandboxed browsing means “isolating internet web browsing activities from its endpoint devices”. In short, it protects your computer from the harmful effects of browsing.

As for IoT Security, IoT devices need to be hardened, and IoT networks need to be segregated from networks that host the FI's data and systems.

7. Cybersecurity Operations

FIs are highly encouraged to procure cyber intelligence monitoring services and participate in cyber threat information-sharing arrangements.

Threat intelligence includes, but is not limited to, services that keep the FIs updated on the latest malware, system vulnerabilities as well as Tactics, Techniques and Procedures (TTPs) used by Advanced Persistent Threat (APT) groups targeting FIs.

FIs should also participate in or subscribe to cyber intelligence sharing platforms like FS-ISAC, IT-SAC, SingCert, or CVE. Such activities help to improve the resilience of FIs against cyberattacks.

Other recommendations include the capability to detect and respond to misinformation propagated via the internet as well as establishing cyber incident response capabilities.

8. Cyber Exercises

Another area to explore is to participate in scenario-based cyber exercises based on threat intelligence, including social engineering, table-top exercises, and adversarial attack simulation exercises. Such exercises allow FIs to test their detection and response capabilities as well as their decision-making during a real crisis.

9. Penetration Testing

MAS TRM Guidelines 2021 calls for penetration testing (PT) of internet-facing systems to be conducted at least annually or after a major change. Additionally, it recommends that penetration testing be conducted in production environments.

More notably, as a sign of changing times, the Guidelines endorse bug bounty programs as an acceptable method to complement an FI's vulnerability and penetration testing program.