NOA Labs
🏦 Cybersecurity · Corporate training

Banking & Fintech Cybersecurity

Defend core banking, digital channels and payment rails against fraud, account takeover and nation-state threats — aligned with SBP, PCI DSS v4.0 and SWIFT CSP.

Register your company → See the full outline ↓
$99 per employee · complete course
🗓️
4 weekends
Sat & Sun
⏱️
32 hours
8 live sessions
🎯
Advanced
Level
🧪
8 labs
Hands-on

Default hours 10:00 AM–2:00 PM (Asia/Karachi). Company pays — employees never pay individually.

About this training

An intensive four-weekend programme for security, IT and engineering teams at banks, microfinance banks, EMIs and fintechs. Participants map the threat landscape of the Pakistani financial sector, secure mobile and internet banking, harden payment systems (cards, Raast, IBFT, SWIFT) and build fraud-detection and incident-response capability. Every day ends with a hands-on lab in an isolated banking simulation.

Who it's for: Information security teams, IT operations, digital banking engineers, fraud & risk analysts and technology auditors at banks, MFBs, EMIs and fintechs.

What your team will be able to do

  • ✔Threat-model a digital banking product end to end using STRIDE and MITRE ATT&CK
  • ✔Apply SBP ETGRMF, PCI DSS v4.0 and SWIFT Customer Security Programme controls in practice
  • ✔Secure mobile banking apps, APIs and customer authentication (MFA, device binding, transaction signing)
  • ✔Detect and respond to account takeover, SIM-swap and payment fraud patterns
  • ✔Run a tabletop exercise for a ransomware or payment-system compromise

Advanced course outline

🔒 Session notes & lab guides unlock for enrolled employees
Weekend 1
Weekend 1 · Saturday

Threat landscape of the financial sector

Who attacks banks, why, and how real heists unfolded.

  • ▸Threat actors: organised fraud rings, APT groups (Lazarus), insiders
  • ▸Anatomy of the 2016 Bangladesh Bank SWIFT heist
  • ▸Card fraud, ATM jackpotting and skimming
  • ▸Pakistan-specific fraud trends: SIM-swap, vishing, fake banking apps
  • ▸MITRE ATT&CK for financial services
🧪 Lab: Map a bank heist to MITRE ATT&CK 🔒 Session notes 🔒 Lab guide
Weekend 1 · Sunday

Regulation & control frameworks

Turning SBP, PCI DSS and SWIFT CSP requirements into engineering work.

  • ▸SBP Enterprise Technology Governance & Risk Management Framework
  • ▸PCI DSS v4.0: scope, segmentation and customised approach
  • ▸SWIFT Customer Security Controls Framework (mandatory vs advisory)
  • ▸Third-party and outsourcing risk
  • ▸Evidence collection for audits
🧪 Lab: Build a control-mapping matrix 🔒 Session notes 🔒 Lab guide
Weekend 2
Weekend 2 · Saturday

Securing digital banking channels

Internet banking, mobile apps and customer authentication.

  • ▸Mobile banking app threats: overlays, rooted devices, repackaging
  • ▸Device binding, app attestation and certificate pinning
  • ▸Strong customer authentication and transaction signing
  • ▸Session management for internet banking
  • ▸Secure OTP delivery and its limits
🧪 Lab: Assess a mobile banking APK 🔒 Session notes 🔒 Lab guide
Weekend 2 · Sunday

Payment systems security

Cards, Raast, IBFT and SWIFT from an attacker's view.

  • ▸Card data flows, tokenisation and HSMs
  • ▸EMV, 3-D Secure 2 and card-not-present fraud
  • ▸Instant payments (Raast) and IBFT risk controls
  • ▸SWIFT interface hardening and message reconciliation
  • ▸Velocity limits and beneficiary risk scoring
🧪 Lab: Design controls for an instant-payment service 🔒 Session notes 🔒 Lab guide
Weekend 3
Weekend 3 · Saturday

Fraud detection & account takeover

Signals, rules and analytics that catch fraud early.

  • ▸Account takeover kill chain
  • ▸Behavioural and device signals
  • ▸Rule-based vs machine-learning detection
  • ▸Reducing false positives without missing fraud
  • ▸Case management and customer communication
🧪 Lab: Write fraud detection rules on transaction logs 🔒 Session notes 🔒 Lab guide
Weekend 3 · Sunday

Securing core banking & infrastructure

Privileged access, segmentation and resilience for core systems.

  • ▸Network segmentation for core banking and the CDE
  • ▸Privileged access management and jump servers
  • ▸Database activity monitoring
  • ▸Backup immutability and recovery testing
  • ▸Patch and vulnerability management at scale
🧪 Lab: Segment a simulated bank network 🔒 Session notes 🔒 Lab guide
Weekend 4
Weekend 4 · Saturday

Security operations for banks

Detection engineering and monitoring tuned for financial institutions.

  • ▸Log sources that matter: core, channels, payment interfaces
  • ▸SIEM use cases for financial fraud and intrusion
  • ▸Threat intelligence sharing (FS-ISAC style)
  • ▸Insider threat monitoring
  • ▸Metrics: MTTD, MTTR and coverage
🧪 Lab: Build SIEM detections in Wazuh 🔒 Session notes 🔒 Lab guide
Weekend 4 · Sunday

Incident response & crisis tabletop

Responding to a live compromise with regulators, customers and media watching.

  • ▸Incident response lifecycle and playbooks
  • ▸Regulatory reporting and customer notification
  • ▸Forensic preservation of payment evidence
  • ▸Ransomware decision-making
  • ▸Tabletop exercise design
🧪 Lab: Ransomware-on-payments tabletop exercise 🔒 Session notes 🔒 Lab guide
📝
Final assessment & certificate
Multiple-choice assessment plus attendance requirement → verifiable QR certificate.

Enrol your team in Banking & Fintech Cybersecurity

One invoice for the whole team, volume discounts applied automatically.

Register your company → All corporate courses