Securing the nation: The SCA deploys latest F5 tech
With responsibility for the UAE’s financial markets on its shoulders, the Emirates Securities and Commodities Authority requires up-to-the-minute technology to ensure smooth and safe application delivery
Emirates Security and Commodities Authority (SCA) is the regulatory body that oversees the UAE’s securities and commodities markets. It was established on January 29, 2000, when a federal decree was issued to set up the authority, with financial and administrative independence and the control and executive powers needed for it to regulate the market effectively.
The aim of the organisation is to strengthen the legislative structure through issuing regulations that help to develop the framework supporting joint-stock companies and other companies operating in the securities field. On top of that, SCA offers a number of web-based services that have become invaluable to financial market players in the Middle East. For example, it hosts a website called the SCA Live Market Watch, which displays daily trading information about the Abu Dhabi Exchange and the Dubai Financial Market. And another service, called the Emirates Securities Market, provides trading-related information for the UAE’s securities markets, as well as information on public joint stock companies and brokerage companies.
There are plenty more of similar web-based services that the SCA offers, and they’re based on some of the most focused applications in the business. Naturally, the deployment of these applications needs to be smooth and, above all, secure. Downtime is not an option for any of the SCA’s services – any interruption to the Live Market Watch or the Emirates Securities Market could have disasterous consequences for the UAE’s financial markets, and repercussions could be felt across the wider Gulf region.
“The index of the UAE financial market is on our website. Most of the investors and analysts are going to our website to check what’s happening, what’s going on in the financial market,” explains Yasser Nasser Ali Al Hosani, network and security section head at the SCA’s IT Department.
This is not just mission-critical to us - because it’s the UAE’s financial market, it’s something could affect the whole UAE. Anything published by our websites is going to reflect on the UAE’s market and its economy, as well as the wider Gulf.”
According to Al Hosani, the SCA’s main business challenges revolve around high availability and security these two areas dominate most of the organisation’s purchasing decisions. Compliance is also a key issue, though achieving compliance with regulatory standards is, again, a means to ensuring that the SCA’s systems and services are up-and-running 24-7.
For its web-based applications, the SCA hosts across three sites in the UAE, using load balancers to ensure that the services are already running smoothly. In terms of its core infrastructure, the organisation has around 200 servers, 70 of which are physical servers while the rest are virtualised, and the SCA’s disaster recovery sites are much the same, so the organisation can make use of the equipment in its day-to-day operations.
While the SCA has largely addressed the key challenges associated with high availability and security, it views IT as an area that can always be improved. According to Al Hosani, the organisation’s attitude is that, particularly in the finance world, you need to be running up-to-the-minute technology solutions. Only then, he says, can the SCA feel secure in the knowledge that its services won’t suddenly be downed, either through an internal fault or an external threat.
“As we are the regulator, we have to be updated with the latest technology, always. When it comes to finance, we cannot accept any downtime for the markets. We have to be always live, and we do that by staying updated with the latest technologies,” he explains. “In the financial sector, you have to be always up-to-date with all the technologies you are going to use. If you slow down with the technology, the money will slow also! And we also have to be secure.”
The security part is particularly important these days, as cyber-criminals become more inventive and determined. The finance sector is a prime target for cyber-criminals, and, according to some reports, the Middle East takes a lot of flak from hackers looking to disrupt emerging markets, earning illicit cash in the ensuing chaos. Indeed, financial services organisations across the EMEA region are becoming increasingly concerned about web fraud threats, with which they are frequently targeted, according to a survey released last month by F5 Networks.
The survey revealed that financial service companies are face significant financial and reputational hits due to malware, phishing, credential grabbing and session hijacking attacks. It said that 48% of organisations had experienced financial losses between £50,000 (AED 284,000) and £500,000 (AED 2.84m) stemming from online fraud within the last two years. Indeed, 9% of those surveyed suffered damages of more than £500,000 and 3% over £1m (AED 5.69m). The SCA, then, takes its security very seriously.
At the end of 2014, the SCA saw an opportunity to take advantage of a new technology that would help it better secure its DNS infrastructure from high-query volumes and DDoS attacks a rising worry in the Middle East.
Since 2009, the SCA has been working with F5 Networks to help it secure its applications. Indeed, Al Hosani says that the organisation was one of the region’s early adopters of F5 technology.
“We started at the beginning just when they had established in the UAE. We were one of the first customers who had their security devices, and we’ve grown with them. Now we have around 10 devices,” he says.