AGORA International Journal of Economical Sciences, http://univagora.ro/jour/index.php/aijes ISSN 2067-3310, E-ISSN 2067-7669 Vol. 17, No. 2 (2023), pp. 27-33 27 POLICIES AND STRATEGIES AIMED AT ENSURING THE SECURITY OF BANKING INSTITUTIONS AND THEIR IT SYSTEMS M.A. BUTCOVAN, R. IVAN Marinela Adriana Butcovan1, Rica Ivan2 1 Romanian Court of Auditors – Bihor Branch, Romania E-mail: adriana.butcovan@rcc.ro 2 Faculty of Electrical Engineering & Information Technology, University of Oradea, Romania E-mail: rika_ivan2005@yahoo.com Abstract: With the development of the banking system, its security and, implicitly, security policies emerged as critical factors in the entire banking sector. In the context of the current technologicaldevelopment, the vulnerability of banking institutions has increased dramatically. For both bank employees and customers, cybersecurity, operational security and data privacy have become top priorities. Therefore, a central concern for banks is the prompt detection of threats and the development of measures aimed at eliminatingsuchdangers, which might both considerably increase the level of security in the banking sector. Keywords: banking security, banking strategy, fraud, cyber-terrorism, banking system, international transactions, IT security. 1. INTRODUCTION In time, the concept of security and its component elements have undergone essential changes, along with the attitude of the states towards the means whereby this notion can be transposed into life, in relation to the changes that occur at the global level. The term "security", derived from the Latin words securitas-securitatis, represents "the state of beingprotected against danger; the feeling of security that one associates with the absence of any type ofrisk''. Security also means "protection, defence". In principle, security represents “that state of affairs that protects any community or country from any external and internal danger, following specific measures, which are adopted and can ensure the existence, independence, sovereignty, territorial integrity of the state and the respect for fundamental interests''. (Mica enciclopedie de politologie- The Little Encyclopaedia of Politics, 1977) Starting from the general understanding of security as the absence of physical violence, while progress is seen as material development related to the standard of living in a continuous process of improvement, Mary Kaldor observes that "both concepts encompass the idea ofexemption from fear and the absence of needs" (Marty Kaldor, 2010) The concept of security applies to all levels in the organization of a society, from the individual to the state andto the international system. Security is based onboth economic and political stability. Thus, a viable security system can only be built if the two components are strengthened. Certainty, trust, and tranquillityare associated not only with the absence of dangers, but also with the idea of keeping them under control. mailto:adriana.butcovan@rcc.ro mailto:rika_ivan2005@yahoo.com POLICIES AND STRATEGIES AIMED AT ENSURING THE SECURITY OF BANKING INSTITUTIONS AND THEIR IT SYSTEMS 28 The banking sector operates in an environment characterized by instability and uncertainty, and losses can generate significant disturbances within the banking sector. The reputation and stability of banks depend on their ability to cope with the unstable economic environment, whether such instability is associated with money laundering, terrorist financing, corruption or fraud, or if it is generated by globalization or economic crises. In the case of banks, security is an essential issue, being characterised by a state when even the smallest dangers might be anticipated. With the development of the banking system, security and, implicitly, the security policy was categorically imposed in the entire banking system. Although a remarkable subject, bank security continues to be an impenetrable area, associated particularly with the idea of securing the banking system, but also with other issues. The economic environment is constantly evolving while also being subject to a state of perpetual uncertainty. The economic and banking events of the last period brought to the fore the fact that the accentuation of specific risks generate the problems experienced by the entire banking system. Consequently, credit institutions must comply with legislative acts, norms and regulations that include provisions regarding the security of information. The need to ensure security at the level of the system involves ensuring minimum security requirements for each participant, since the security problems of a participant can affect the functioning of the entire system. As a result, cyber security is not only a protection factor, but also an element of trust and stability for financial institutions. 2. Policies and strategies regarding the security of banking systems Any financial-banking operation involves a series of risk factors. Exposure to risk is inherent tothe banking system; therefore, the objective of risk management is to mitigate risk. Only the banks that succeed in accepting and managing risks have the possibility to anticipate the evolution of future events. The bank security policy is an essential document regarding the security of banking institutions and includes considerable aspects, guidelines, as well as requirements that the management considers appreciable in order to maintain its security. At the same time, it includes a set of rules, norms and procedures that regulate the manner of managing, using, protecting and distributing resources in the banking institution. This policy applies to all activities, processes, procedures, directives, regulations, products, assets and decisions associated with the institution, since they may all influence the secure way in which a bank operates. When it comes to operations and security, financial organizations should use a multi- level, layered approach, which nevertheless involvesseveral challenges. The pressure to improve and secure IT systems in financial institutions is enormous, since cyber-attacks on banks are on the rise. The policy of the authorities and the obligation of the banks is to disclose and prevent the trafficking of illegally obtained funds. The threat of terrorism is a problem for all of humanity. This phenomenon is hard to detect because the sources of funding can be both illegal and legal. Those who intend to prepare various terrorist attacks seek to find new Marinela Adriana BUTCOVAN, Rica IVAN 29 sources, relying on the vulnerability of the financial and banking system, but also that of the legal system. In most cases, financial transactions are neutral; they come to the attention of specialized institutions only when suspicious persons are involved. As far as money laundering is concerned, this phenomenon, which has already acquired an international character, leaves even deeper traces not only in the activities of banking institutions, but also in their image, which represents a crucial factor. Criminals, in their attempt to hide values gained from illegal acts, make use of banking institutions, by means of bank transactions. Thus, illegally obtained profits are "laundered" much more easily. However, the damages resulting from the crime of money laundering affect the economy worldwide. With the development of organized crime, the profits obtained also increased, and the banking circuit has become involved into the transfer of illegally acquired funds; for those involved in money laundering, technological progress has been a means whereby financial advantage can be obtained. The banking system is, without a doubt, one of the economic systems dramatically affected by financial globalization. In their attempt to cope with all the changes in the economic environment, banks sought to implement new strategies and policies; their purpose was to protect themselves from criminals and the risks associated with the activities carried out, but also to survive the competition. Crises, along with other social phenomena, become problematic only when they affect the social order, and their effects can no longer be controlled. These crises negatively affect the entire economic system. Along with it, the banking system has also suffered from desecurization and destabilization caused by these crises. Most banking institutions, as well as other types of institutions, have recently operated in an environment characterized by uncertainty and instability, and the destruction or losses can cause serious disturbances to the activities of the institutions concerned. Considering the crime situation at global level, which has accentuated dramatically, while also taking into accountthe IT system, geographical location, and the community of employees and customers, the banking system is more exposed and vulnerable than other economic systems. The banking institution, as actor on the capital market and credit institution, is exposed to vulnerabilities. Therefore, a significant part of its activity requires special security measures. In order to solve security- related problems, many innovative schemes have been developed (Singh & Malhotra, 2004; Rombel, 2003). Some authors have proposed the inclusion of biometric features in authentication schemes (Arumuga, 2006). Maintaining banking stability and security is a fundamental requirement for the successful conduct of banking operations, but also a requirement that must be treated with particular care. The consequencesgenerated by either natural disasters or the human factor have shown that it is hard to anticipate the totality of the potential causesthat might generate an undesirable event. Instead, it should be pointed out here that the damage caused by these disasters can be compared in terms of value to the destructive effects of cyber-attacks. Banking institutions that do not have a well-developed security policy, according to the standards in force, may face situations that negatively influence their existence and reputation, and the resulting effects also impact their financial situation. The security policy must provide support, inspire credibility, but also demonstrate efficiency in the efforts that banking institutions make with the view of protecting their POLICIES AND STRATEGIES AIMED AT ENSURING THE SECURITY OF BANKING INSTITUTIONS AND THEIR IT SYSTEMS 30 resources. Maintaining the security of a banking institution is the daily task of every bank employeewho holds a position of either executor or bank manager, in conformity with the duties of their specific position and related skills. In order to ensure its security, the banking institution in question will proceed in accordance with the legal regulatory framework in force. Every standard, recommendation, and good practice, experience and information that can contribute to improving security will be evaluated and appreciated. 3. IT security in banking institutions In the current global business environment, where information systems have effectively penetrated all organizations, the importance of information technology is widely accepted and recognized. The increasing dependence of most organizations on information systems, in conjunction with the risks, benefits and opportunities they bring, make information security control a critical component for the general administration of the organization. Information is a vital resource of any organization and must be protected accordingly, by ensuring confidentiality, integrity, and availability. In the interconnected business environment, information is currently exposed to an increasing number and a much wider variety of threats and vulnerabilities. Nowadays, information security is a fundamental pillar in the banking environment. Banks face various and multiple threats, caused by internal or external factors. Financial institutions must ensure the protection of data relating to corporate customers, clients' personal information and their financial resources. In the absence of security, the trust of customers and business partners can be easily compromised or lost. In addition, risk management and compliance requirements must be assessed constantly. The deterioration of the economic situation, together with the inefficient activity of the institutions responsible for the financial security of the country, will affect the quality of assets in the banking sector and generate new challenges for financial institutions. At the same time, the volatility of the foreign exchange market and the low trust in public and financial institutions represent a risk for the stability of the banking sector. Risks can have an obvious impact on the value ofboth financial and banking institutions, dueto its effects on staff, partners, clients, or the banking authority, or because it might take the form of direct losses. In the banking sector, risk should be understood as a conglomerate of threats, which are often interdependent and might have common causes. At the same time, the emergence of one type of risk can generate the appearance of a succession of other risks. (Gheorghe Manolescu, Adriana Sîrbea Diaconescu, 2001) When it comes to operations and security, financial organizations should use a multi- level, layered approach that presents a number of challenges. The pressure to improve and secure IT systems in financial institutions is enormous, with cyber-attacks on banks being on the rise.” Both financial institutions and consumers agree upon the fact that financial fraud and attacks are becoming more complex, since they are perpetrated by a different class of criminals, who use increasingly sophisticated methods, where technology is part of their Marinela Adriana BUTCOVAN, Rica IVAN 31 strategy. Moreover, experts predict that the current global crisis is likely to increase the frequency of internal fraud and security breaches. Banking institutions must focus on preventing security events as the best means of ensuring security. In order to establish security, a bank must develop a clear and consistent regulatory environment, but also avoid exceptional procedures. When customers are inquired about their expectations in relation to the banking institution they work with, two aspects are generally mentioned: security of operations and cyber security, as well as confidentiality of information. The need for the cyber-security of banking institutions has increased simultaneously with the total computerization of banking activity. The implementation of an IT security policy gives the management of a banking institution the security of a quantifiable and controllable system. Computer system vulnerabilities are basically weaknesses that can be exploited by a possible threat at any time. Thus, we can say that information security is not only a technical problem, but also a managerial problem. Following the emergence of situations related to criminality in the banking cyber system, as well as customer panic, banking institutions have increased their measures and efforts to protect the IT infrastructure. Maintaining IT security has never been more important than now. There are more sophisticated and lethal cybercrime trends that the banking sector should pay attention to. Internet fraud is currently the most practiced type of fraud at international level. The phenomenon is booming, correlated with the increase in the number of users and, at the same time, in electronic transactions. These events can cause financial damage, IT infrastructure damage, but most importantly, reputation damage. In such cases, banking institutions should not wait for legislation or government decisions to find solutions to suchproblems but reactpromptly instead. (Cindy Collins-Taylor, 2013) Investments in software and hardware solutions, however, remain a necessity, as by such means institutionsare ablerespond quickly to IT threats. And the training and testing of both employees and customersmay contribute to reducing computer fraud. Concerns for IT security increased in direct proportion to the increase in the number of users, but also in the value of transactions made by banking institutions. Along with technological development, the security of information systems has also developed. At the same time, attackers managed to develop their skills and opportunities to penetrate deeper and faster into information systems, the effects of their actions being most often particularly serious. Thus, it can be stated that computer security is a constant and continuous process, because in order to increase security, one should always return to the starting point. Innovative technologies and ideas constantly require an update of the IT security policy. Once connected to the Internet, banking institutions become more accessible to the public, but also vulnerable, in the face of unforeseen attacks, caused by unauthorized penetration into the IT system. In order to achieve the protection objectives of the IT system, banking institutions must hire reliable personnel, who have the necessary skills and qualifications, while also being prepared for critical events. The continuous training of employees who use the POLICIES AND STRATEGIES AIMED AT ENSURING THE SECURITY OF BANKING INSTITUTIONS AND THEIR IT SYSTEMS 32 computer system is also of significant importance, so as they might constantly update their knowledge and reaction skills. The employees should also receive information about new methods used by cybercriminals with the view of penetrating the banks’ IT system. Each user of the IT system is responsible, in one way or another, for ensuring the security of the data. A well-implemented and selected IT security strategy can help the institution avoid undesirable events, with impact upon the information resources of a banking institution. The security requirements are constantly changing due to the developments of the banking system in recent years. Such prerequisites include the expansion of electronic communication channels with customers and partners, the electronic payment system, the reporting systems to the National Bank of Romania, the development and integration of payment systems, etc. In this context, in addition to the individual demands that relate toensuring information security, there is also the issue of the risks that a properly unsecured component induces in the system and the need to ensure the safety of the entire banking system.Each banking institution, in part, must implement its own information security system. Its management can be achieved by implementing practices, tools, procedures, policies, organizational structures, or software functions. Following the emergence of situations related to criminality in the banking cyber system, which generate panic among customers, banking institutions have intensified their measures and efforts to protect the IT infrastructure. Maintaining IT security has never been more important than now. Sometimes, the banking system might encounter difficulties in controlling the increasingly sophisticated and lethal cybercrime trends. These events can cause financial damage, IT infrastructure damage, but most importantly, reputation damage. In such cases, banking institutions should not wait for legislation or government decisions to find solutions to these problems, but to react immediately. Investments in software and hardware solutions, however, remain a necessity, so as banks might be ready to respond to cyber threats. And the training and testing of employees, but also the instruction of customers, is a solution to reduce computer fraud. 4. CONCLUSIONS In the current climate, banks are called upon to implement strategies and business models that make them stronger and more competitive in a market heavily involved in innovation. At the same time, they must strengthen customer trust and loyalty. Most often, companies avoid sufficient investment in IT security because their perception is that the threats do not justify a very high level of expenses. However, the costs of a computer breach and the loss of confidential data, as a result of large-scale cyber-attacks, arevery important issues. The creation of a security culture is essential to any organization. This can be achieved by the continuous instruction and training of the staff, through permanent collaboration with partners for a common approach to security issues, and by constantly making customers aware of the risks regarding information security. The security of the computer system can be increased by building and improving collaborations between banking institutions, governments and institutions specialized in combating computer crime. It is also important to adapt the national security strategy to these cyber issues, as well as to expand IT security in order to support both banking and national or global security. Marinela Adriana BUTCOVAN, Rica IVAN 33 Banking institutions must determine and develop IT tolerance, in a context where protection will never be enough and tolerance should be high. Depending on the level of risk and protection, the level of investment necessary to reach the comfortable level of protection is determined. But no one knows the cost associated with the aim to reduce the risk. According to the commitments assumed, Romania has undertaken measures to develop the national normative framework in the field of cyber security, harmonized with the provisions of EU legislation, which will meet international requirements, facilitate bilateral cooperation and the exchange of information among the competent authorities. To fully ensure the safety and security of critical data and systems, financial institutions should use a robust privileged access management solution in order to protect both themselves and their customers against attacks. Since it is necessary to comply with this large number of regulations, standards and requirements, information security must be considered a crucial concern for the organization, which requires the involvement of the management at the highest level and the active engagement of all the structureswithin the organization, from professionals in the domain to the final users of data. REFERENCES 1. Arumuga, S., 2006. Effective method of security measures in virtual banking. Journal of Internet Banking and Commerce [online], Available at: http://www.arraydev.com/commerce/JIBC/2006-04/VB.asp 2. Cindy Collins-Taylor, New Cyber Security “Rules of the Road” for the Financial Services Industry, Television, April 2013, p. 2, www.aspenpublishers.com 3. Dumbrava, Dumitru, Agresiunile în spațiul cibernetic (Aggressions in cyberspace), in Revista Română de Studii Intelligence (Romanian Journal of Intelligence Studies), No. 06, 2011; 4. Gheorghe Manolescu, Adriana Sîrbea Diaconescu, Management bancar (Banking Management), Bucharest, The Publishing House of the Foundation “România de Mâine”, 2001, p. 123 5. Lică-Banu, Laura-Susana, Apariția și Proliferarea finanțării terorismului (Emergence and Proliferation of Terrorism Financing), Bucharest, Universul Juridic Publishing House, 2010; 6. Marty Kaldor, Securitatea umană (Human Security), Editura CA Publishing, 2010, p. 39; 7. Mica enciclopedie de politologie (The Little Encyclopedia of Political Science), Enciclopedic Publishing House, Bucharest, 1977, page 402; 8.Nagy, Agnes, Benyovszki, Annamaria, Provocările crizei asupra sistemului bancar (Challenges of the Crisis on the Banking System), Theoretical and Applied Economics, Vol. 20, No. 4 (581), 2013; 9. *** Manual de management al fraudelor în activitatea de creditare (Handbook on the Management of Fraud in Crediting Activity), 2012; 10. Rombel, A., 2003. Next step for Internet Banking. [online]. Available at: http://www.gfmag.com/archives/87-87-february-2003/2176-features--next-step-forinternet- banking.html#axzz0IhUm79xl; 11.Singh, B. & Malhotra, P., 2004. Adoption of Internet banking: an empirical investigation of Indian Banking sector. Journal of Internet Banking and Commerce, [Online]). Available at: http://www.arraydev.com/commerce/JIBC/9909-05.htm http://www.arraydev.com/commerce/JIBC/2006-04/VB.asp http://www.aspenpublishers.com/ http://www.gfmag.com/archives/87-87-february-2003/2176-features--next-step-forinternet-banking.html#axzz0IhUm79xl http://www.gfmag.com/archives/87-87-february-2003/2176-features--next-step-forinternet-banking.html#axzz0IhUm79xl http://www.arraydev.com/commerce/JIBC/9909-05.htm