Answer

Abstract— The steady growth in technological advancement and the near-universal usage of the cyber space has meant that criminal elements have diverted their attacks to the cyber space. There is a growing list of cyber-attacks and cyber-crimes that occur on the cyber space on a daily basis. Some of these include; Denial-of-Service (DOS), phishing and spear phishing attacks, Man-in-the-Middle attack, Drive-by attack, SQL injection attack, password attack, Eavesdropping attack, cross-site scripting attack (XSS), Malware attack, and Birthday attack, among others (). These attacks are not only meted on individuals, governments, and organizations in general but also on banking institutions. Modern day bank robbery mostly occurs in the cyber space. The need for a mechanism to prevent these cyber-attacks on banking institutions cannot be underestimated. Intrusion Detection System (IDS) and firewall can effectively be applied to serve the purpose of detecting and preventing cyber-attacks respectively. The aim of this paper is to espouse on the effectiveness of IDS and firewall in detecting and preventing cyber-attacks in a banking institution. This analysis will mainly be conducted by dint of a review of literature. Based on the review of literature as outlined herein, it is apparent that many scholars are in agreement about the fact that IDS and firewall is effective in detecting and preventing cyber-attacks on banking institutions. The conclusion thereto is that it is imperative that banking institutions fully utilize IDS and firewall systems such as Network Intrusion Detection Systems (NIDS) and the Host Intrusion Detection System (HIDS) to detect and prevent cyber-attacks on their networks.

Index Terms—Denial-of-service, Network Intrusion detection systems, Password attack.

INTRODUCTION

he unprecedented growth in technological development has also meant that crimes are committed in the cyber space. The US Ponemon Institute recently conducted a study of 254 companies in seven countries and the results thereto showed that financial institutions in particular are faced with an average of 125 intrusions every year [1]. This figure is three times higher than it was six years ago and it is set to continue rising if stringent measures are not taken to safeguard these networks. It is also important to note that recently, the FBI issued a 3 million dollars bounty for information on FBI’s most wanted cybercriminal who was responsible for creating a Malware known as GameOver ZeuS botnet that consequentially led to the infection of about 1 million computers and led to the theft of over $100 million from consumers and businesses in the US and worldwide [2]. Essentially, the revelation herein speaks to the fact that criminal elements in the cyber space have taken particular interest in the banking institutions. The banking institutions have, therefore, taken significant steps towards protecting their networks. IDS and firewall has been effective in detecting and preventing cyber-attacks in the banking institutions.

Related work/ Research methods

Mehra (2015) in an article dubbed “Controlling Attacks and Intrusions on Internet Banking using Intrusion Detection Systems in Banks” provides an illustration of the effectiveness of intrusion detection systems in detecting and preventing attacks on “internet banking and other e-commerce-based transactions” [3]. The two main effective modalities in this regard are the Network Intrusion Detection Systems (NIDS) and the Host Intrusion Detection System (HIDS). NIDS is placed at a particular strategic point within the network and it serves the purpose of monitoring traffic to and from all devices within that network [4]. It analyses all the traffic that passes through the entire subnet and matches the traffic that passes on the subnets to the library of known attacks [5]. Once any abnormal behavior is sensed, an alert is sent to the administrator. The HIDS, on the other hand, is installed on individual computers within the system. Traffic is then analyzed to and from the specific computers. HIDS boasts of features that are not available in the NIDS at arguably provides a near fool-proof protection against cyber-attacks. Essentially, the argument of the author is that the use of intrusion detection systems is effective in alleviating the occurrence of attacks on networks that are concerned with online banking services.

Figure 1[6]

Just as is the case with many financial institutions around the world, banks in Nigeria have digitalized most of their operations. This then means that the need to put up formidable computer strategies has been self-evident. Ogunwobi, Folorunso, and Alebiosu (2016) conducted a study on the effectiveness of computer security strategies that have been utilized by banks in Nigeria. The study revealed that Nigerian Banks are implementing at least five computer security strategies and to that extent, they rarely experience any malicious attacks on their networks [7]. Nigerian banks are particularly keen on the utilization of IDS and firewall. 50% of the financial institutions are implementing Intrusion Detection and Prevention whereas 76.6% are implementing firewall [8]. A major IDS mechanism utilized is the Antivirus software. The financial institutions predominantly use Avast and MacAfee. They are useful in detecting and preventing the entry of malicious software in the system such as Trojan horses, computer viruses, and spyware. 100% of the financial institutions are particularly using the antivirus software. The result is that the banking institutions experience very minimal cyber-attacks.

In an article dubbed “Mitigating Cyber Threats to Banking Industry” Bhasin (2007) lays emphasis on the fact that in the advent of technological advancement, attacks on banking institutions have been on the rise and steps need to be taken to prevent the continuance of such attacks [9]. He indicates that banks need to conduct a risk assessment and consequentially, steps ought to be taken to detect and prevent the cyber-attacks. Some of the detection and prevention systems as outlined herein include firewalls, anti-virus software, and HIDS, and NIDS. Essentially, these mechanisms are useful in mitigating cyber threats to banking institutions.

It is also important to take notice of the fact that institutions such as banks have the primary interest of actualizing profit while incurring minimal expenses. Banking institutions have come to the realization of the fact that profits always hang in a balance when the network security resources of the company are not protected from the internal and external security threats to the networks. In this regard, for a long time; banking institutions have sought to invest heavily on information security resources. This is in recognition of the fact that in the present times, the financial sector has more to lose in the advent of heightened insecurity in the cyber space. In an article dubbed, “Institutional pressure in security management: direct and indirect influences on organizational investment in information security,” Cavusoglu et al (2015) acknowledge the fact that even a minute security breach can result in irreparable damage to banking institutions which may resultantly lead to significant corporate liability, reduced revenues, and lost credibility [10]. As a result of this, many financial institutions have rated information security investment and IT infrastructure as the forefront priority. This article provides an illustration of the extent to which the prevailing financial base of a company has a significant bearing on the information security investment made by the organization. The resources thereto have a substantial effect on the preventive and detective solutions adopted in response to any internal and external threats that the organization may be faced with at one time or the other [11]. This essentially speaks to the fact that the more the organization has a strong financial base the more likely it is to experience sophisticated attacks from criminal elements in the cyber space. This then means that such organizations have the strong incentive of using sophisticated information security control resources (ISCR) so as to ensure that their networks are secured from both internal and external threats.

Zahoor, Ud-din, and Sunami (2016) provide a detailed

exposition on the inherent threat to cyber security especially with respect to banking institutions and the apparent need for the utility of the most novelty cyber infrastructure towards ensuring that the cyber security threats towards banking institutions are mitigated. The authors specifically make reference to IDS and firewall and they illustrate that these two mechanisms are effective in detecting and preventing cyber-attacks. Firewalls in particular serve the purpose of reducing attack vectors “by limiting inbound and outbound communications” (26) [9]. The four primary firewall types that are effective for banking institutions include; Stateful Inspection, Packet Filtering, application level firewalls, and proxy servers [12]. Any of these products may have features of one or more firewall types [13]. IDS, on the other hand, serve the purpose of detecting and preventing any inherent intrusions, as well as, detecting any misuse of information (internal attacks) [14]. The implementation herein is through the use of NIDS detection methods. Effective implementation of IDS and firewall serves the purpose of mitigating the cyber threats that are faced by banking institutions. As alluded to in figure 2 below, NIDS serves the crucial purpose of alerting the administrator in case there is an abnormal activity going on in the network. The administrator then plays the role of applying any of the above stated firewall types to prevent any inherent attack.

Figure 2 [15]

Result and analysis

The continuous growth in technological advancement has meant that banks are placed at a disadvantages position because criminal elements are particularly targeting them. There is a growing list of cyber-attacks that have been made against banking institutions around the world. Banks have, therefore, been required to take action towards protecting their cyber networks. IDS and firewall are effective modalities in detecting and preventing network intrusions.

IDS serve the purpose of monitoring the events that occur in a computer network so as to detect any possible incidents before they happen. If there is a sign of a possible incident, notification is sent to the administrator. IDS serve the defensive-aggressive role of protecting client information, as well as, the network of the organization. There are instances when IDS serve the purpose of disconnecting malicious connections, as well as, blocking malicious traffic. It is, therefore, apparent that IDS serve the three-fold purpose of monitoring, analyzing, and reporting. IDS are effectively implemented through Network Intrusion Detection Systems (NIDS) and Host Intrusion Detection System (HIDS). NIDS protects the entire network as a whole by monitoring traffic to and from devices within that network. Any irregularities or suspicious activities are reported to the administrator. HIDS, on the other hand, monitors activities from particular computers within the network. The HIDS software is placed in every individual computer. Apart from monitoring, HIDS serves the purpose of blocking the users of the computer from making certain actions. This means that those respective actions can only be implemented by the administrator.

Firewall, on the other hand, prevents the entry or completion of the attacks. Essentially, once an attack has been detected and a notification or warning has been sent to the admin, firewall serves the purpose of helping the admin to act on the threat by placing hindrances to the completion of the threat.

Essentially, when there is a threat, the firewall is activated so as to act on that threat and consequentially protecting the network. The image below is an illustration of the important role played by firewall and IDS in mitigating cyber-attacks that are targeted on a financial institution.

Figure 3 [16]

It is also important to take notice of the fact that the information security control resources incorporated by banking institutions depends on the overall financial base of the institution. This essentially means that institutions that have more resources and a wider financial base invest in sophisticated IT security resources since they are more susceptible to sophisticated attacks and have significantly more to lose when such attacks are actualized. The heavy investment is also because of the fact that the institutions ideally have more resources to spend on the IT infrastructure. Whereas Nigerian banks utilized the readily available IDS mechanisms such as Avast and MacAfee with great success, the same may not be successfully used in the American banks since more resources are at stake and the institutions are in danger of more sophisticated attacks. In recent times, for instance, American banks have fallen prey to Russian hackers and millions of dollars have been lost as a direct result. It is, therefore, prudent that detective and preventive mechanisms be utilized in due recognition of the respective financial base of the banking institutions and the respective prevailing circumstances thereto. Ultimately, the more a banking institution grows, the more it needs to invest in formidable IT infrastructure.

Similarly, one of the standard procedures that must be complied with by all banking institutions is the through auditing of the potential external and internal risks that an institution faces. This will inform the degree of detection and prevention measures put in place to prevent the occurrence of cyber-attacks. It will also inform the institution regarding the amount of resources that will need to be allocated towards IT infrastructure.

Based on the foregoing, it is apparent that every banking institutions should take critical steps towards implementing the most novelty IDS and firewall types. The review of literature speaks to the fact that banking institutions that fully implement the IDS and firewall software significantly minimize the chances of cyber-attacks. With respect to the utility of the HIDS and NIDS; it is imperative that banking institutions ensure that both versions of IDS are implemented in the organization’s network. This is in recognition of the fact that both IDS types have unique features that cannot be replicated by either side. Essentially, whereas the NIDS serves the purpose of protecting the network against external cyber criminals, HIDS particularly serves to protect against any internal attackers. For instance, when HIDS is installed in the individual computers within the organization, certain applications that would potentially lead to phishing of client information is blocked since the admin is able to keep watch of all traffic to and from the individual computers.

Conclusions

The advent of technological advancement has meant that criminal elements are now using the cyber space to perpetrate harm on various computer networks. Particular focus in this regard has been on banking institutions. They have been subject to various attacks which have resulted in the loss of large sums of money. In a latest attack, a Russian hacker attacked about 1 million computers in the US and stole over $100 million from various organizations in the US and in various other part of the world. The need for a detective and preventative mechanism is, therefore, self-evident. IDS and firewall play a crucial role in detecting and preventing the cyber-attacks. It is imperative that banking institutions fully utilize IDS and firewall systems such as Network Intrusion Detection Systems (NIDS) and the Host Intrusion Detection System (HIDS) to detect and prevent cyber-attacks on their networks.