Multi-layer security: an indispensable “shield” for the financial sector in the digital era

According to the International Monetary Fund (IMF), the global financial sector has suffered up to USD 12 billion in damages from cyberattacks over the past two decades. In Vietnam alone, 2024 saw more than 659,000 attacks, with over 46% of financial enterprises falling victim—according to the latest report from VNIS.

The 2024 VNIS DDoS attack report highlights that the financial sector leads in DDoS attack volume, accounting for 26% of incidents, underscoring the high value of data and transactions in this industry to hackers.

Common attack methods include:

• Phishing and social engineering: Fraud via email and fake messages.
• Malware and ransomware: Encrypting data and demanding ransom.
• Email attacks: Spoofed emails, malware injection.
• API attacks: Exploiting vulnerabilities in application interfaces.
• DDoS attacks: Overloading systems with massive virtual traffic.

The consequences of such attacks go far beyond financial loss. Security expert and technology advisor Mr. Nhat Phan emphasized,

A successful attack can lead to data breaches, brand reputation damage, business disruption, and even prolonged legal risks.

The financial industry and the cybersecurity battle in the digital age. Alongside Mr. Nhat Phan, experts including Mr. Tuan Ho (Cyber Security & Governance), Mr. Tho Nguyen (Head of R&D Security Compliance), and Mr. Nghia Le (Product Operations Expert) analyzed key cybersecurity challenges in the modern landscape.

According to Mr. Tuan Ho, the financial sector must pay special attention to three main risk categories:

1 Emerging technology threats

• Malicious AI capable of voice and image imitation for advanced fraud.
• Supply chain attacks such as the 2020 SolarWinds incident.
• Open-source vulnerabilities like Log4j.
• Unsecured IoT devices as potential entry points.
• Double/triple extortion ransomware combining encryption, data leaks, and DDoS attacks.

2 Risks from digital transformation

• Misconfiguration in cloud platforms.
• Poorly secured API interfaces.
• Digital investments (e.g., NFTs, smart contracts) being exploited.

3 Non-technical risks

• Insider threats from disgruntled employees.
• Weak remote access management.

To tackle these, he proposed a three-pillar strategy:

• Adopt a Zero Trust model enhanced by proactive AI defense.
• Raise awareness through training and foster an internal security culture.
• Regularly assess and conduct real-world incident response drills.

A key strategy discussed at the event was adopting the Defense in Depth (DiD) approach. According to Mr. Nhat Phan, DiD is a layered defense model where people, processes, and technology work in unison to form a robust defense system. Multi-layered security – The key to survival for the financial industry in the digital age.

This model includes:

• Physical controls: Prevent unauthorized access at the device/system level.
• Administrative controls: Internal policies, clear workflows, and security awareness training.
• Technical controls: Implement advanced technologies to monitor and protect against sophisticated attacks.

Notably, technical controls play a critical role in safeguarding access points such as web, app, API, and email—where user and organizational transactions occur. Any weakness in these gateways could become an entry point for hackers, leading to serious consequences.

Defense in depth strategy

Two standout technologies were introduced as essential shields for financial enterprises:

1 VNIS – Web/App/API security solution

VNIS acts as a “steel shield” that significantly mitigates risks to business information systems with a two-layer security approach:

• Layer 1: DDoS protection at layers 3/4 (TCP/UDP) via Multi-CDN and AI Load Balancing to distribute traffic and ease system load.
• Layer 2: Origin Shield protects application layer (Layer 7) by blocking threats like SQL Injection, XSS, and malicious bots.

A comprehensive Web/App/API security solution

2 EG-Platform – Comprehensive enterprise email security

EG-Platform serves as an email firewall solution that secures both inbound and outbound communications through three filters:

• SpamGuard: Filters spam, prevents phishing, and blocks ransomware.
• Receive Guard: Detects spoofed emails, APT, BEC attacks, and zero-day vulnerabilities.
• Send Guard: Scans outgoing emails, prevents data leaks, and blocks malicious links.

A comprehensive email security solution

Positive feedback from attendees

The practical and business-relevant content was a major reason the event received high praise:

• Mr. Minh (fintech company): “Very practical—VNIS addresses exactly the issues we’re facing.”
• Ms. Lan (bank representative):“EG-Platform truly meets our internal email control and anti-phishing needs.”
• Mr. Hung (small business owner): “The event opened my eyes to DiD—something I’ll apply right away in my system.”

VTalks attracted strong participation from financial enterprises

Conclusion: shaping a digital “shield” for the financial sector

VTalks #7 was not only a knowledge-sharing platform, but also a strategic forum to guide cybersecurity directions in a rapidly digitalizing era. Combining the Defense in Depth model with modern solutions like VNIS and EG-Platform is the key for financial institutions to:

• Protect critical assets and data.
• Maintain continuous operations amid evolving threats.
• Preserve brand reputation and customer trust in the digital age.

Contact VNETWORK for expert consultation: Hotline: +84 (028) 7306 8789 | Email: contact@vnetwork.vn