Finansal Hizmet Sektöründe Siber Güvenlik Riskleri ve Çözüm Yolları: Ödeme Sistemleri ve Tedarik Zinciri Bütünlüğü

Öz

Türkiye kötücül yazılım kaynaklı siber güvenlik tehditlerine maruz kalma açısından dünya sıralamalarında en üst sıralarda olmaya devam etmektedir. Türkiye’de birçok akademik çalışmada siber güvenlikle ilgili siber suçların işleniş tarzı ya da hukuki boyutu incelenmiştir. Bununla beraber, bu hususların ötesinde siber güvenlik problemlerine neden olan risk faktörleri ve bu faktörlerin nedenleri yeterince incelenmelidir. İnternet bankacılığı, banka ve kredi kartları kullanımı ve e-ticaret finansal siber güvenlik sisteminin korunması gereken en önemli bileşenleridir. Yazılım tedarik sistemi ise finansal sistem güvenliğini oluşturan en önemli teknik altyapı unsurlarındandır. Artan siber riskler tüketici güveninin azalmasına, vatandaşların finans sistemini internet aracılığıyla daha az kullanmasına ve finans sistemlerinin beklenmeyen giderlerinin artmasına neden olacaktır. Bu nedenle siber güvenlik risklerinin ulusal bazda incelenmesi ve yorumlanması ülke ekonomisi ve siber kritik altyapı güvenliği açısından hayati öneme sahiptir. Bu çalışmada Türkiye’de çevrimiçi ödeme sistemleri ve bu sistemin siber güvenliğini destekleyen yazılım tedarik zincirlerinin barındırdıkları riskler incelenmiştir. Çalışmada, bahse konu potansiyel riskler siber güvenlik normları kapsamında tanımlanmakta ve siber güvenlik önlemleri yönetimsel açıdan tartışılmaktadır.

Anahtar Kelimeler

• Siber Güvenlik, Bankacılık, Finans, İnternet

-

Öz

Turkey continues to be statistically in the forefront of the world rankings in terms of the exposure to cyber security threats. In Turkey, many academic studies related to cyber security or legal issues in regard to cybercrime have been conducted to date. Further, the risk factors that lead to cyber security problems and the causes of these factors should be examined more rigorously. Internet banking, debit and credit card uses and e-commerce are the key components of the online payment system that suffer intrusions. Software supply system is also one of the most important technical infrastructure elements of the financial system security. Increasing cyber risks diminish consumer confidence regarding online payment systems, and such risks could cause extraordinary expenditures within financial system. Therefore, a nationwide analysis and interpretation of the cyber security risks is vital for national economy and cyber critical infrastructure security. In this study, online payment systems in Turkey and the appertaining cyber security systems that are supported by software supply chains are examined in terms of the associated risks. The study addresses the aforementioned potential cyber security risks in the context of cyber security norms and cyber security measures are discussed from an administrative perspective

Anahtar Kelimeler

• National Cyber Security, Banking, Finance, Internet

Kaynakça

1. ASSAF, Dan (2008), "Models of Critical İnformation İnfrastructure Protection", International Journal of Critical Infrastructure http://www.researchgate.net/profile/Dan_Assaf/ Protection, 19.05.2014. Sayı: 1, ss. erişim tarihi:
2. ALBERTS, Christopher, J., & DOROFEE, Audrey, J, (2009, Nisan), A Framework for Categorizing Key Drivers of Risk (No. CMU/SEI-2009-TR-007 Pittsburgh, PA: Software Engineering Institute, http://repository.cmu.edu/cgi/viewcontent.cgi?article=1045&conte xt=sei, erişim tarihi: 08.05.2014 Mellon University,
3. ANDRIJCIC, Eva ve HOROWITZ, Barry (2006), “A Macro‐ Economic Framework for Evaluation of Cyber Security Risks Related to Protection of Intellectual Property”, Risk Analysis, Sayı: 26(4), ss. 907-923. erişim tarihi: 20.05.2014
4. BANKALARARASI KART MERKEZİ (BKM), 2014. Dönemsel Bilgiler, http://www.bkm.com.tr/donemsel-bilgiler.aspx 08.05.2014 İstanbul, tarihi: erişim
5. BELLA, Giampaolo, MASSACCI, Fabio ve PAULSON, Lawrence, C. (2005), “An Overview of the Verification of SET”, International Journal doi:10.1007/s10207-004-0047-7. Security, of Information Sayı:4(1/2), 17-28.
6. DZEMYDIENĖ, D., NAUJIKIENĖ, R., KALINAUSKAS, M., & JASIUNAS, E. (2010). “Evaluation of Securıty Disturbance Risks in Electronic Economics, Sayı:2(8), ss.21-29. Payment Financial Systems”, Intellectual
7. ELLISON, Robert. J., ALBERTS, Christopher, CREEL, Rita., DOROFEE, Audrey ve WOODY. Carrol (2010), Software supply chain risk management: From products to systems of systems, Software Engineering http://www.sei.cmu.edu/reports/10tn026.pdf, 02.05.2014. Institute, Pittsburgh. erişim tarihi:
8. FILSINGER, Jarrellann, FAST, Barbara, WOLF, Danial.G., PAYNE, James, F.X. (2012), Supply chain risk management awareness ,Armed Forces Communication and Electronics Association, Cyber Committee. http://www.afcea.org/committees/cyber/documents/Supplychain.p df, erişim tarihi: 08.05.2014

9. GOERTZEL, Karen Mercedes (2010) "Supply Chain Risk Management and the Software Supply Chain", OWASP AppSec DC, erişim https://www.owasp.org/images/7/77/BoozAllen- AppSecDC2010-sw_scrm.pdf, erişim tarihi:15.05.2015.
10. GRAUMAN, Brigid (2012), Cyber-security: The Vexed Question of http://www.isssource.com/wp- content/uploads/2012/02/020212rp-sda-cyber-security.pdf, erişim tarihi: 23.05.2014 Security and Defence Agenda,
11. HILTGEN, Alain, KRAMP, Thorsten ve WEIGOLD, Thomas (2006), “Secure Internet Banking Authentication”, Security & Privacy, IEEE, Sayı:4(2), ss.21-29, erişim tarihi: 08.05.2014
12. HUTCHINSON, Damien, & WARREN, Matthew (2003), “Security for internet banking: a framework”, Logistics Information Management, 16(1), 64-73, erişim tarihi: 08.05.2014
13. Internet World Stats (2012). Internet Usage Statistics, http://www.internetworldstats.com/stats.htm. 08.05.2014. erişim tarihi:
14. INSA (2009), Addressing cyber security through public - private partnership - an analysis of existing models, Arlington, VA, http://www.insaonline.org/, erişim tarihi: 08.05.2014
15. JARUPUNPHOL, Pita ve MITCHELL, Chris (2003, June), Measuring 3-D Secure and 3D SET against e-commerce end-user requirements. İçinde 8th Collaborative Electronic Commerce Technology and Research Conference, CollECTeR, Europe, Galway, Ireland, ss. 51-64.
16. KHAROUNI, Loucif (2012), Automatic transfer system: The latest cybercrime toolkit feature. trend micro ıncorporated research paper. content/us/pdfs/security-intelligence/white- Micro,
17. http://www.trendmicro.com/cloud- papers/wp_automating_online_banking_fraud.pdf, 08.05.2014 erişim tarihi:
18. KIM, Changsu, TAO, Wang, SHIN, Namchul ve KIM, Ki-Soo (2010). “An Empirical Study of Consumers’ Perceptions of Security and Trust in e-Payment Systems.” Journal of Electronic Commerce Research and Applications, Cilt No: 9, Sayı: 1, ss. 84-95.
19. KOM Daire Başkanlığı (2012), Kaçakçılık ve Organize Suçlarla Mücadele, 2011 raporu, KOM Yayınları: Ankara, erişim www.kom.gov.tr, erişim tarihi: 21.08.2014
20. KUMAR, Muneesh, SAREEN, Mamta ve BARQUISSAU, Eric (2012), “Relationship between types of trust and level of adoption of Internet banking”, Problems and perspectives in management : PPM.., Sayı:10 http://businessperspectives.org/journals_free/ppm/2012/PPM_201 2_01_Kumar.pdf, erişim tarihi: 08.05.2014 ss. 82-92.
21. LI, Yang ve WANG, Yun (2001), Secure Electronic Transaction (SET protocol), http://ccc.cs.lakeheadu.ca/set/set-lw.pdf, erişim tarihi 15.05.2014
22. LU, S., & SMOLKA, S. A. (1999), Model Checking the Secure Electronic Transaction (SET) Protocol. In Modeling, Analysis and Simulation of Computer and Telecommunication Systems, 1999. Proceedings. 7th International Symposium on, ss. 358-364, IEEE.
23. MITRE(t.y.), Supply Chain Risk Management. MITRE: http://www.mitre.org/publications/systems-engineering- guide/enterprise erişim tarihi: 08.05.2014
24. MICROSOFT (2014), Toward a Trusted Supply Chain: A Risk Based http://www.microsoft.com/en-us/download/details.aspx?id=26828, erişim tarihi: 08.05.2014 Managing Software Integrity,
25. MICROSOFT (t.y.), TLS vs. SSL, http://msdn.microsoft.com/en- us/library/windows/desktop/aa380515(v=vs.85).aspx, erişim tarihi: 08.05.2014
26. NASHERI, Hedieh (2005), Economic espionage and industrial spying, New York: Cambridge University Press.
27. NSOULI, Saleh, M. ve SCHAECHTER, Andrea (2002), “Challenges of the E-Banking Revolution", Finance and Development, Cilt: https://www.imf.org/external/pubs/ft/fandd/2002/09/nsouli.htm, erişim tarihi: 08.05.2014 Sayı: 3
28. OOI, Keng-Boon, LIN, Binshan, TAN, Boon-In, ve YEE-LOONG CHONG Alain (2011), “Online Banking Adoption: An Empirical Analysis”, International Journal of Bank Marketing, Sayı: 28(4), ss.267- 287.
29. PCI GÜVENLİK KONSÜLÜ (2013), Ödeme Kartları Endüstrisi Veri https://www.pcisecuritystandards.org/security_standards/, tarihi: 08.05.2014 Güvenliği Standardı, erişim
30. PAGANIN, Pierluigi (2013), Modern Online Banking Cyber Crime, erişim http://resources.infosecinstitute.com/modern-online- banking-cyber-crime/, erişim tarihi: 08.05.2014
31. PAVLOU, Paul. A, (2003), “Consumer Acceptance of Electronic Commerce: Integrating Trust And Risk With The Technology Acceptance Model”, International journal of electronic commerce, Sayı:7(3), ss.101-134.
32. RANDAZZO, Marisa R, KEENEY, M., KOWALSKI, E., CAPPELLI, D., & MOORE, A. (2005), Insider Threat Study: Illicit Cyber Activity in The Banking And Finance Sector , Carnegıe-Mellon Unıv, Pıttsburgh, Software Engıneerıng Inst.
33. REKABET KURUMU (2013), Ticari Sırların Korunması, http://www.rekabet.gov.tr/default.aspx?,erişim tarihi: 08.05.2014
34. RADACK, SHIRLEY (2010), Secure Management of Keys in Guidance Cryptographic http://csrc.nist.gov/publications/nistbul/february2010_key- management-part3.pdf, erişim tarihi: 08.05.2014 Organizations,
35. RAJA, J. ve VELMURGAN, Senthil, M. (2008), E-payments: Problems and Prospects, Journal of Internet Banking & Commerce, Sayı:13(1), ss.1-17, erişim tarihi: 08.05.2014
36. REEVES, Jeff (2013), Cybersecurity – 5 security companies for uncertain cybersecurity-5-security-companies-uncertain-times/view- all/#.Ux7I5T9_tGQ, erişim tarihi: 09.05.2014
37. SABAH (2014), Türkiye Kartta Avrupa liderliğine Soyundu. http://www.sabah.com.tr/Ekonomi/2014/05/12/turkiye-kartta- avrupa-liderligine-soyundu, erişim tarihi: 08.05.2014
38. SCHNEIDER, Gary P. (2010), Electronic Commerce 2010, Boston, Massachusetts: Prentice Hall Press.
39. SHARMA, Surinder ve RAMANDEEP, Singh (2011), Factors Influencing Internet Banking: An Empirical Investigation. IUP Journal Of Bank Management, Sayı:10(4), ss.71-80.
40. ŞIKER, Perihan (2011), Müşterilerin İnternet Bankacılığını Benimsemelerine Yönelik Keşifsel Bir Araştırma. Uygulamaları ve Yönetimi, Sayı: 35.
41. SIMPSON, Stacy (2009), The software supply chain integrity framework. http://www.safecode.org/publications/SAFECode_Supply_Chain070 9.pdf, erişim tarihi: 08.05.2014
42. SUH, Bomil ve HAN, Ingoo (2003), “The İmpact Of Customer Trust And Perception Of Security Control On The Acceptance Of Electronic Commerce”, International Journal of electronic commerce, Sayı:7, ss.135-161.
43. TÜİK (2011), Bilgi Toplumu İstatistikleri, Ankara: TÜİK İstatistik Konseyi, www.tuik.gov.tr
44. TÜİK(2013), Hane Halkı BT Kullanım Araştırması, Ankara: TÜİK http://www.tuik.gov.tr/PreHaberBultenleri.do?id=13569, erişim tarihi: 01.05.2014 İstatistik Konseyi,
45. TSIAKIS, Theodosios ve George STHEPHANIDES (2005), The Concept of Security and Trust İn Electronic Payments. Computers & Security, Sayı:24(1), ss.10-15.
46. YESİLYURT, Hamdi, (2011), “The Response of American Police Agencies to Digital Evidence” University of Central Florida Doktora Tezi, Orlando, ABD.
47. YESİLYURT, H. (2015). Siber Suçlar: Tehditler, Farkındalık ve Mücadele, İçinde F. Tombul, M. Gunestas, O. Basibuyuk (Eds.), Global Press, ss. 169- 195.
48. White House (2013), National Strategy for Global Supply Chain Security http://www.whitehouse.gov/sites/default/files/docs/national_strat Implementation
49. egy_for_global_supply_chain_security_implementation_update_public
50. _version_final2-26-131.pdf erişim tarihi: 12.05.2014 Update.
51. US-CERT(2009). “Software Supply Chain Risk Management & Due-Diligence”. cert.gov/sites/default/files/DueDiligenceMWV12_01AM090909.pdf Cilt:2
52. https://buildsecurityin.us