[Technical Research] Bank of China Software Center (Xi'an) Li Ruisheng: The exploration and practice of commercial banks' safety vertical defense system

In recent years, in the context of the rapid development of Internet finance, attacks on financial business have gradually evolved from traditional means to high concealment and high complexity intelligent network attacks. There are many conditions such as detecting sample limitations and incomplete disposal mechanisms. It cannot effectively respond to various types of attacks, and it cannot meet increasing security needs. At the same time, with the vigorous implementation of the Internet finance ecology, various financial institutions have realized business interconnection, technological interoperability, and scenario interoperability. The impact of security issues of a single financial system often leads to the relevant joint systems. Therefore, the traditional safety protection model of traditional war is no longer applicable.

The characteristics of financial transactions are complex business, diverse data, sensitive information, and involving user funds, so it has become the main goal of various types of network attacks. At the same time, the financial business has some commonality. Attackers often use the same attack methods through apps such as APP, applets, etc. to launch an attack on different financial systems. Can you recognize such attacks in time, whether you can realize the sharing of real -time attack information and protection strategies, whether it can achieve common defense through the application side, network side, and service side. The problem in front of us. Therefore, it is imperative to build a financial system security depth defense system.

Explore and practice

1. Data sharing is the basis. Because data is the carrier of online financial transactions, malicious attack loads are often injected into the system by data, so data is the basis for achieving attack prevention and traceability.

(1) Data sharing synthesis. Financial data is special, and most of the transactions include user personal information, transaction amount, behavioral information, etc., involving the confidentiality of customer privacy data. Therefore, under the premise of ensuring the information confidentiality of the legal compliance, it is necessary The pre -processing method of the original data sets a reasonable and compliance scope to achieve data sharing.

(2) Data scenario platform. Different systems carry different business transactions, and different business transactions involve different internal systems. The business flow of different systems needs to be integrated in order to achieve scene -based financial business data recognition. Provide strong data support through business data capture, filtering, and analysis. First of all, the ability to screen financial business data from massive network data, followed by different business scenarios between various systems (such as: online account opening, transfer remittance remittance remittance remittances , Payment and recharge, investment and wealth management, etc.) to classify the data data. Different business scenarios in different systems are gathered and stored in different data clusters. The cluster is managed through federal management to build a fusion financial business data platform (see picture).

Figure data scenario platform

2. Business scenarios are the focus. Different from traditional attack methods, the new types of attacks on financial business systems are mostly attacks on the business logic layer. Such attack methods are often hidden into normal business traffic. Therefore, there is no obvious data characteristics, and financial institutions cannot find it through traditional big data matching. In response to this phenomenon, attack monitoring methods for business scenarios will be able to achieve security protection more effectively. The core drive should be based on the "scene+definition attack". Based on the analysis of data sources such as terminal systems, data resources, application services, hosting systems, network platforms, and physical environments, it takes the actual needs of users as the starting point. Multiple dimensions such as security provides users with comprehensive financial business security trend perception. Establish a logical attack model based on a single business scenario, uniformly monitor the conditions required for business transactions, map it to the corresponding security early warning level, and use the strong binding between business logic and security protection to achieve the financial business logic attacks. Effective protection.

3. Defending defense is the key. Endonal defense — constitutes a multi -line defense by setting up a multi -layer overlap safety protection system, so that even a certain line of defense can be made up or corrected by other lines, that is, to prevent security attacks by increasing the system's defense barrier.

The common defense strategy of multi -stage and multi -nodes is the basis of responding to the current new type of network attack. Establish a multi -link defense level covering the front desk, middle platform, background, application, network, system, interface service, etc. The multi -level integration of security defense is achieved through the way of full -process intervention, full role participation, and full tool support. For example: the application side security protection is achieved through the APP security shell to solve application -side problems such as malicious jumping, page advertising implantation, and third -party user information leakage; through the scene -based situation perception, to solve the logical attack side of financial business scenarios to solve the side of financial business scenarios Question; multi -level emergency monitoring and early warning disposal through network layers to solve various types of attacks based on the network side.

By "atomic" security capabilities, the existing security mechanism is continuously arranged and combined, and security capabilities are emphasized to the financial system to defensive all levels to cope with various diverse attacks, providing a full -technical architecture for the financial system to provide a full -technology architecture of the financial system Covering the security ability, thereby forming a closed loop of common defense, and consolidating the foundation of the financial system to resist the overall ability of security risks from technical strategy.

4. Reasonable disposal is the goal. Strong security protection methods must be equipped with a flexible and controllable disposal mechanism. The attack methods of financial business usually have the characteristics of strong and concealed, multi -stages. Real attackers and users of misunderstandings are difficult to distinguish, resulting in attack disposal efforts. Excessive defense may cause normal users to be blocked, which affects normal user business handling and user experience; excessive light defense may not effectively prevent the real attacker. Therefore, at the moment when user experience and security demand coexist, it is particularly important to build precise emergency response measures. Regulatory requirements are more critical, refer to the "Guidelines for Emergency Disposal Work" (CBRC [2008] No. 50), and "Emergency Management Specifications for Emergency Emergency Management" (CBRC "(CBRC [2008] No. 50) Regulatory requirements for supervision of [2008] No. 53), through data quantification, comprehensive consideration of various risk indicators of threats, vulnerability, scope, and important levels, combined with the standardized emergency response mechanism of various security levels of the financial business system to establish risks to establish risks Calculate and dispose of the model to achieve the rapid and accurate response of security attacks in financial business scenarios.

5. Organizational practice is fundamental. With the advancement of the China Banking enterprise -level architecture construction project, the Bank of China Software Center has built a set of deep defense systems of "four -in -one" defense system around data sharing platformization, security attack sceneization, defense capacity atomicization, and standardization of emergency response, covering the "four -in -one" defense system, covering the coverage OWASP TOP10, Certificate Protection, Face recognition, Trojan Prevention, malicious advertising implantation, malicious page jumping, 0DAY vulnerability defense and other types of attack scenarios have been included in the 1.2 batches of corporate architecture as an enterprise -level architecture.

At the same time, organizational practice is inseparable from the support of talents, and people are the core of security. Strengthen the construction of organizational teams, strengthen the safety intervention in the field of engineering, eliminate risks from the source of software development, and establish a security talent evaluation and training system covering 14 engineering technology fields. All safety position personnel must hold a certificate, and the security holders have steadily increased at an average annual rate of 150%.

Look forward to

With the iterative update of information technology, the security situation faced by commercial banks will become more complicated, which means that security protection methods will not be a single model. Financial practitioners need to break the inherent thinking of their respective war, drive the financial business scenario as the core, promote resource sharing, business cross -system integration, and cover comprehensive financial business transactions to achieve simultaneous monitoring, simultaneous early warning, synchronous disposal to create enterprise -level disposal to create enterprise -level levels The community of security defense is based on deep defense thoughts, breaking the barriers and gaps between different systems, and using financial business scenarios as the contact to build a new model of information security defense for commercial banks.

(Source: Financial electronic)

- END -