Case Study: Poštanska Štedionica PKI Implementation

The Challenge

Poštanska Štedionica was facing several challenges with its existing security system, which included outdated encryption methods and the need to manage increasing volumes of digital certificates across its services. The implementation of a robust PKI was essential to not only secure internal communications and transactions but also to manage the growing number of customers accessing online banking services. Additionally, compliance with international security standards was crucial for Poštanska Štedionica to maintain its position as a trusted financial institution.

Governing Regulations in Southeast Europe

In Serbia and the broader Southeast European region, the Digital Operational Resilience Act (DORA) is becoming a pivotal framework for financial institutions. While it’s an EU regulation, its implications resonate through non-EU countries in the region as they seek to align with European standards. DORA mandates stricter cybersecurity measures for financial institutions, requiring them to enhance their governance frameworks, risk management practices, and operational resilience against ICT-related incidents. The act aims to ensure that financial entities can protect, detect, and recover from cyber threats effectively​.

Additionally, the European Banking Authority (EBA) has published guidelines on the security of internet payments. These guidelines emphasize the importance of securing electronic retail payment services, which are increasingly critical in the digital banking landscape.

Both DORA and EBA guidelines represent the growing demand for heightened security measures in the region’s financial sector, driven by the rising risks associated with digital banking.

The Solution: Implementing PKI with Versasec

The team at Poštanska Štedionica turned to PULSEC, a technology company specialized in designing and implementing advanced cybersecurity solutions with a presence in Serbia, who guided them to a Versasec solution. With Versasec, a trusted name in identity and access management solutions, Poštanska Štedionica was able to deploy a customized PKI solution seamlessly. The implementation focused on securing digital certificates, encrypting sensitive communications, and ensuring secure user authentication.

Key components of the solution:

• Secure Certificate Management: Versasec’s vSEC:CMS enabled Poštanska Štedionica to manage, issue, and revoke digital certificates across multiple platforms seamlessly. This ensured secure communications between employees, customers, and third-party vendors.
• Smart Card Issuance: Poštanska Štedionica also deployed smart cards for secure user authentication and encryption, providing an added layer of security for internal systems and external banking services.
• User Self-Service Portal: The self-service functionality allowed employees and customers to manage their certificates, reducing the burden on IT teams and minimizing operational overhead.

PKI Implementation Process

The implementation of PKI at Poštanska Štedionica took place in a phased manner to ensure minimal disruption to daily operations. The process involved:

• Migration from Legacy Systems: Migrating existing encryption methods and certificates into the new PKI infrastructure was a critical first step. Using Versasec’s migration tools, the transition was smooth, with minimal user impact.
• Smart Card Deployment: Poštanska Štedionica issued smart cards to all key personnel and customers needing secure access. These cards were configured to store digital certificates and provide two-factor authentication for both internal and external platforms.
• Integration with Active Directory: The PKI was integrated with Poštanska Štedionica’s Microsoft Active Directory, ensuring that user credentials and permissions were tightly controlled and managed.
• Security Policy Enforcement: Comprehensive security policies were put in place to govern the issuance, use, and revocation of digital certificates, ensuring a secure environment across all digital transactions.

Benefits of the Implementation

• Enhanced Security: The new PKI and CMS drastically improved the security of Poštanska Štedionica’s communication and transactions, reducing the risk of cyber threats such as phishing and identity theft.
• Streamlined Operations: The User Self-Service applications allowed users to manage their certificates, reducing dependency on IT staff for routine tasks like certificate renewal and management.
• Compliance with International Standards: By implementing a robust PKI and CMS, Poštanska Štedionica ensured compliance with international financial and security regulations, enhancing their credibility in the market.

Conclusion

Versasec vSEC:CMS implementation at Poštanska Štedionica with PULSEC’s support, marked a significant step forward in securing the bank’s digital infrastructure. With the help of Versasec, the bank was able to migrate from legacy systems, enhance their security protocols, and streamline certificate management across multiple platforms. Today, Poštanska Štedionica is well-equipped to handle the security demands of modern banking while offering its customers and employees a safe, efficient, and compliant system for secure communications and transactions.

About Pulsec 

PULSEC is a technology company specialized in designing and implementing advanced cybersecurity solutions. We have a local presence in Serbia, Bosnia and Herzegovina, Croatia, Austria, and Switzerland.

Pulsec is focused on protecting clients, their data, and their users.

About Versasec

Versasec is the leading credential management software service provider for organizations worldwide. In an increasingly connected world with growing numbers of remote workers, cyber threats, and legacy authenticators, Versasec is a cornerstone in every enterprise security implementation to build a zero-trust architecture.

Trusted by organizations and corporations worldwide, Versasec serves the public and private sectors in government, defense, manufacturing, healthcare, financial services, and more. Versasec is headquartered in Stockholm, Sweden.

This blog post was written in collaboration with PULSEC. The customer Poštanska Štedionica has provided explicit consent for their name to be published in this content.