Strategy Selection Against Cyber and Phishing Attacks in the Financial Sector Using MCDM Methods

The financial sector constitutes a prime target for cyber attackers owing to its high volume of transactions and the sensitive nature of its data. The most critical cyber-attacks pertinent to this sector have been identified, with the most prevalent type, the phishing attack, being examined in detail. Phishing attacks, in particular, can lead to severe data breaches and financial losses at both individual and institutional levels. In this context, the selection of the appropriate security strategy to prioritize against this type of attack is of paramount importance. Following expert consultation, six criteria were established and subsequently prioritized: effectiveness, cost, implementation difficulty, sustainability, user acceptance, and scope. Consequently, a priority ranking was assigned to various strategies, including Employee Training, E-mail Filtering Systems, Multi-Factor Authentication (MFA), Zero Trust Architecture, Segregation of Duties, DNS Filtering and Web Security, and Endpoint Security. The criteria weights used to establish this priority ranking were derived using Multi-Criteria Decision-Making (MCDM) methods, namely Pythagorean Fuzzy AHP (PFAHP) and Neutrosophic Fuzzy AHP (NFAHP). The final prioritized strategy or strategies were then determined using the TOPSIS and PROMETHEE methods.