Interview With Juan Herman – Koin

PIA spoke with Juan Herman, IT Director at Koin, about the biggest cyberthreats facing the fintech industry, how companies can deal with them, how he uses machine learning to prevent fraud, and more.

Private Internet Access: Hi, it’s nice to meet you, can you tell me a little about yourself and how you got involved in Koin?

Juan Herman: Hi, nice to meet you too. I’m a software engineer from Uruguay. I’ve been with Grupo Despegar for over 10 years, working in different IT teams and different roles. After Koin’s acquisition by the group, I assumed as Koin’s CTO at the end of 2020.

PIA: Please tell me about Koin, what the company does, and it’s flagship product?

JH: Koin, Despegar’s fintech arm specializes in financial solutions for both companies and end customers, being the  pioneer in Buy Now Pay Later solutions in Brazil and expanding operation to whole Latam.

PIA: Who is your customer base? Do you work primarily with businesses or individuals?

JH: We work mainly with companies since our solutions complement each other to provide a complete solution for online payment processing, but we also have B2C credit solutions for end customers. We have within our portfolio of +400 companies in Brazil that trust our solutions and we also have clients from Argentina, Peru, Colombia, Mexico and Uruguay.

PIA: As a fintech company, what are some of the biggest cyberthreats that you encounter and how do you deal with them?

JH: The main threats that exist today are ransomware, attempted unauthorized access and theft of credentials and data, phishing attacks and social engineering. In addition, of course, to fraud attempts with identity theft for purchases and account theft for which we offer prevention solutions to other companies.

For the aforementioned threats and others, the basics are to follow the best practices of a consolidated cybersecurity framework and with risk analyzes to better guide cybersecurity actions.

Vulnerability and access management, environment and profile segregation, endpoint security, among others, are important to prevent and detect, but we cannot fail to mention people’s awareness of the issue and its importance in contributing to cybersecurity effective and also have incident response, disaster recovery and business continuity plans so that, in the event of failure of all protection measures, we can resume operations quickly, reducing the impact on the business.

PIA: I see that Koin has anti-fraud solution, can you talk about that?

JH: The technological solution was born in 2016 with the increase in travel fraud, particularly in Brazil, with the aim of having an efficient and robust solution throughout the region for the Despegar Group. Since then we have been evolving our Machine Learning models, incorporating new data from both the device and customer behavior as well as from information providers and optimizing our decision
trees.

For several years our solution has stood out with world-class performance, with levels of fraud-sales, review and reject well below the market average in the same industries.

PIA: What cybersecurity methods do you use to protect the privacy of your customers?

JH: In addition to the cybersecurity methods mentioned above, when we talk about privacy we must focus on protecting data from improper access and for this we need to know what types of data we process, its classification and where it is stored to protect it.

We can mention the use of encryption of data in transit and at rest, Data Loss Prevention (DLP) tool, monitoring and alerts of incidents and suspicious activities, segregation of access profiles, multi-factor authentication (MFA) among others as protection measures.

PIA: Why do individuals and companies need a good VPN, from an online security perspective?

JH: For people in general, it provides security and privacy when browsing the Internet since they can have their browsing encrypted with respect to their Wi-Fi provider as well as for ISPs.

Already for a company, even more so a company like Koin that promotes teleworking, the need for a good VPN and good administration of it is essential, since it is the gateway to all private resources and although it is not enough with a good VPN but must be complemented with multiple extra cybersecurity measures, having a good management of your VPN is very important to avoid external people within your network trying to violate access to internal systems, data kidnapping and all the threats that mentioned before.