Payments Systems and Security

At PaySec2004 we brought together payment systems developers, security architects, operational risk practitioners and academics to address all aspects of technology, security and operation in the payment systems domain, both present and future state.

The best of the Internet versus the best of the City. Short key technical demonstrations will be interspersed to bring context to the challenges and the solutions. Rump sessions would have allowed you to contribute your experiences for the benefit of others.

The conference would have covered many crucial topics in the Payment Systems field:

• Payment Transformations and integration: a revolutionary code generation approach
• Settlement to T+0 and RTGS
• Programmatic electronic contract negotiation
• Systems Performance Monitoring: Service Level Compliance
• Extensible Electronic Currency Frameworks
• SSL/SSH based infrastructure to enhance federated security
• Payment Systems as Critical National Infrastructure
• Automated System Risk Audits for Operational Risk Compliance
• Strategies for Defending against Infrastructure Attacks
• Reusable Security Architecture via pre-risk assessed patterns

Security of payments is more than the application of cryptography over the the Internet, and more than a secured private network between banks: it is the application of all of the disciplines - technology, a legal framework, risk analysis and mitigation, insurance, good management practice and strong accounting.

Our desire was to bring the following four streams together in one conference in the context of applied security:

Applications, Infrastructure, Risk and Research.

Blending today's payment systems providers with state-of-the-art payment technology developers combines experience with innovative technology.

• An Escape From Hard-Coded Application Integration: Demonstration and discussion of a highly scalable message format definition, transformation and transport modelling toolset which solves data integration issues for legacy systems, message-orientated middleware and XML based messaging systems.

• Electronic Payments and Contracts: Live demonstration and discussion of several payments frameworks and electronic contract mechanisms. Discussion of operational aspects and how new financial instruments can be supported.

Computer infrastructure is changing from service-based to web service delivery. To deliver these services, Grid Infrastructures offer enhanced platform utilistation and massive scalability.

• From Client/Server to Grid-based Web Services: Government see grid computing as the powerhouse behind a new economy. We meet the Director of the UK Government's initiative.

• Application Security and Risk Assessment: Security is no longer that last final step before production. Threat analysis must be considered on all levels, not just any single one. Risk assessment is no longer a subjective, paper based exercise. Many organisations face the challenge of measuring their level of security, their level of risk and their progress in securing their IT resources. We present a framework for the reuse of security architecture patterns which streamlines the whole development process and greatly enhances application security and awareness.

  Automated risk assessment techniques would have been demonstrated showing a revolutionary approach to network vulnerability.

The 21st century has brought risks and attacks never previously thought realistic outside a Hollywood movie, but now have to be analysed, quantified, and prepared for.

• Payment Systems as Critical National Infrastructure: Discussion of the threats posed by CNBR

Regulatory and billing systems that assume one simple security model are already under strain, and will need to accomodate the new efficient security models of micropayments. The entry of the mobile phone into the payments platform will lead to increasing convergance pressures on Banks and Telcos.