Committed to connecting the world

SDG DIGITAL

Security Clinic on Security of Digital Financial Services

​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​ 27- 29 October 2021


The main objectives of the Security Clinics on DFS security were to share findings and lessons learned from the FIGI Security Infrastructure and Trust working group.  The findings assisted the regulators and providers to:
  • learn about the different vulnerabilities within the DFS ecosystem
  • how to mitigate these threats and perform continuous assessments on the security of DFS
  • how to build confidence and trust in the use of digital financial services, provide a framework to manage security risks in the DFS ecosystem.​
​ The security clinics were  intended for IT security professionals and policymakers from the telecom/ICT regulator, DFS provider and Central Bank.

The sessions addressed the following areas of focus: 
  • DFS security vulnerabilities: Insights into the security vulnerabilities of DFS applications and infrastructure
    • USSD, STK and Android platform vulnerabilities and how these can be mitigated.
    • SS7 vulnerabilities and their mitigation measures.
    • Security tests that can be undertaken at the DFS Security Lab at ITU.
  • Implementing the DFS security framework
  • DFS security assessment: Performing a DFS security assessment.
​Target audience: This event was for DFS and Telco regulators in Zimbabwe
​
​​

Programme

​​​

 ​​Day 1:  27 October 2021

​​10:00 - 10:15
CEST​		Welcome Address
  • POTRAZ​
  • Reserve Bank of  Zimbabwe (RBZ)
  • ITU​
​​​10:15 -11:15
CEST
​DFS security vulnerabilities: Infrastructure vulnerabilities and mitigation measures (Mobile Infrastructure vulnerabilities)

Telecom infrastructure vulnerabilities such as SS7 can be exploited by an intruder to intercept calls and SMSs, bypass billing, steal money from mobile money accounts, or affect mobile network operations.  This session  presented the main findings of the Security, Infrastructure and Trust Working Group on securing the infrastructure against SS7 vulnerabilities and threats. 

Panellists:
Related Report

​​ ​​Day 2: 28 October 2021

10:00 - 11:15
CEST​
​​DFS Security Assurance Framework 

This session discussed the DFS security assurance framework that can be implemented by DFS providers to better manage the risks and mitigate their impact.

Panellists:
​Related Reports:
​​​11:15- 12:30
CEST
​DFS Security Vulnerabilities: USSD, STK and Android Platform Vulnerabilities

This session introduced the ITU DFS security lab and highlighted the vulnerabilities to USSD and STK and Android based applications. Threats like Man in the middle attacks that could impact digital financial services and the SIM jacker vulnerability in SIM Cards would be discussed. The session also provided and an overview of the security tests that can be undertaken in the DFS Security Lab at ITU. 

  • "Introduction to the ITU DFS Security Lab" : Vijay Mauree, Programme Coordinator, TSB, ITU​ [ Presentation ]
  •  "Android, USSD and STK Tests" : Arnold Kibuuka, Project Officer, TSB, ITU
    [ Presentation ​]
​Related Reports:

​Day 3: 29 October 2021​

​​​10:00 - 11:00
CEST​​
​Implementing the DFS security assurance framework and security audit for DFS.

This was a hands-on session focusing on initiating the process to implement the DFS security assurance framework in Zimbabwe and identify the DFS Mobile Money applications that could be tested in the ITU DFS security lab. POTRAZ and RBZ team should familiarize themselves with the DFS security assurance framework prior to the session. A follow-up session was held afterwards to assess the implementation.
​
​

© ITU All Rights Reserved

Back to top