CSE2SIA Assignment 2: Cryptographic Data Protection for Mortgage Brokers

Introduction

A mortgage broker serves as a professional advisor for households and frequently earns commission fees from lenders (Robles-Garcia 2019). The independent brokers are subjected to financial regulatory oversight by implementing stricter screening procedures in their brokerage activities, resulting in improved loan performance. The quality of loans that are issued by independent brokers shows higher quality across various credit-related characteristics, both reported and unreported to prospective investors (Agarwal et al. 2021). Mortgage brokers collect and process highly sensitive data to perform their operations, including personal identification details such as names, addresses, and detailed financial records (Shende et al. 2022).

In this scenario, it is assumed that a mid-sized mortgage brokerage firm handles 200–300 client applications monthly. The broker maintains an internal customer management system (CMS) where the data of clients is stored and shared digitally with multiple lending institutions. These communications usually occur via email, secure portals, and cloud-based document repositories.Given the sensitivity of the data, its integrity and authenticity are important.Compromised, tampered, or unauthorized disclosure of sensitive information can lead to financial loss, legal penalties, or reputational damage for both the broker and clients (Kafi & Akter 2023).

In this scenario, the focus will be on data in transit, specifically the sensitive documents and the application forms that are exchanged electronically between the mortgage broker, clients, and lenders. Data in transit is particularly vulnerable to eavesdropping, interception, and tampering, making it essential to implement cryptographic controls to secure data confidentiality, integrity, and authenticity (Mahawar n.d.).

Data Threats and Attacks

Mortgage brokers face a variety of cybersecurity threats that target the integrity and authenticity of client data:

Phishing Attacks

Phishing is a cybercrime where attackers impersonate the trusted organizations to deceive individuals into disclosing confidential information such as their personal data, passwords, and banking or credit card details (Katkuri, 2018). These fraudsters usually reach victims through emails, calls, or text messages. The information that is obtained is then exploited to gain unauthorized access to accounts, causing severe financial losses and identity theft (Ali & Mohd Zaharon 2024).

Man-in-the-Middle (MITM) attack

In a Man-in-the-Middle (MITM) attack, two parties have their communication intercepted by the attacker, who assumes the role of a proxy. The attacker may substitute the public keys, manipulate messages, or data eavesdropping. In credential phishing targeting platforms like Office 365, the MITM server presents fake login or multi-factor authentication pages, capturing usernames, passwords, and session cookies. This enables intruders to decrypt, steal, and re-encrypt confidential data without being detected (Cekerevac et al. 2025).

Insider threats

Employees or contractors with access to the Customer Management System (CMS) may misuse their rights. Insider threats represent as one of the most difficult challenges in cyberspace, often resulting in considerable harm to the organizations. Such threats originate from the individuals within the organization and typically involve deliberate actions, such as committing fraud or stealing confidential and commercially sensitive information (Yuan & Wu 2021).

Cryptographic Controls to Ensure Data Integrity and Authenticity

The following cryptographic controls are recommended to mitigate the aforementioned threats:

Transport Layer Security (TLS)

All communications between clients, brokers, and lenders should be protected using Transport Layer Security (TLS). Transport Layer Security (TLS) is a protocol that provides safe communication channels within the Internet between applications. It can be embedded into other systems, providing a protective layer that allows client-server communication to take place without the threat of eavesdropping, tampering, and forging of messages, thereby protecting the privacy and maintaining the integrity and authenticity of data (Garcia et al. 2024).

Hash Functions for Authentication and Integrity

The hash functions form the basis of blockchain and are widely used in cryptographic protocols such as digital signatures and message authentication codes. The most typical ones are MD and SHA, though SHA-256 is used more because of its faster speed and higher level of security. Being one-way functions, cryptographic hashes take inputs of any size and produce fixed-size outputs, which allow them to be used to ensure user authentication without the need to store passwords locally (Anwar et al. 2021).