Published by Gbaf News
Posted on July 21, 2017
9 min readLast updated: January 21, 2026
By Hamish Karamsadkar, digital trust and cyber security expert at PA Consulting Group
People around the world were shocked as the WannaCry and “#NotPetya” ransomware viruses exposed and exploited IT weaknesses in leading companies around the world, including the Bank of China, FedEx, DLA Piper and the UK’s National Health Service. But with cybercrime in financial services (FS) reaching staggering levels and the costs to the global economy reportedly averaging £266 billion a year for the last three years, should we really be that surprised? While everyone looks inwardly in the event of a breach, we have to learn that to deal with the combination of the increasingly sophisticated attackers and the relentless advance of technology we need to share more readily.
Emerging technologies bring new risks
An ever-more connected customer base means more focus on digitising products, services, and transactions. So FS firms are increasingly dependent on the internet and emerging technologies which increase risk in a digitally perimeter-less environment.
With each new technology on the radar, a complementary vulnerability exists. For example:
Over and above new threats on the horizon, the FS industry has existing concerns which make cyber-security doubly challenging, including extensive compliance regulations, the struggle to secure customer data, and supplier risk.
So how should firms respond?
Too many institutions rely on general IT-risk management processes in the hope they’ll be enough in the event of a major cyber-attack. But FS firms need to protect themselves by analysing data and looking for trends to pre-empt potential attackers.
A US- study highlighted that a mass spear-phishing email campaign in 2013 demonstrated that many institutions lacked the right vision and strategy to defend against evolving and persistent threats. Criminals stole almost $1billion from 100 banks in 30 countries. The malware used wasn’t detected by affected businesses for almost 300 days after the attack. In short, long-term protection which should focus on improving incidence response or enhancing cultural security behaviours is sacrificed in favour of real-time threat detection.
Firms need to remember that technology alone cannot secure your department from a crippling cyber-attack. User education needs to be integrated with robust technology into a business-wide programme for cyber security.
Assume anything is possible
The best way businesses can improve their cyber resilience is to embrace a risk-based approach to managing cyber security.A risk-based approach starts with the assumption that an unauthorised user already has the capability to gain access to a system. With this in mind, a risk-based approach undertakes a process of threat modeling where security experts look at the entire IT environment and documents threats (existing or emerging) and their potential impact on a businesses’ security posture. Ultimately, a risk-based approach needs to form part of an overall risk management strategy and should involve:
Stand together
Given the sophistication, complexity, and evolution of the techniques and technologies used by attackers, even a sizeable organisation with ample information security resources may find it difficult to plan and implement an adequate response by itself.
As cyber threats evolve, FS institutions will need to share knowledge, particularly as compliance and regulation becomes increasingly normalised. Internally, organisations can significantly strengthen their ability to protect their business as well as their customers by sharing and pooling data on attack methods, loss prevention, and information security.
By Hamish Karamsadkar, digital trust and cyber security expert at PA Consulting Group
People around the world were shocked as the WannaCry and “#NotPetya” ransomware viruses exposed and exploited IT weaknesses in leading companies around the world, including the Bank of China, FedEx, DLA Piper and the UK’s National Health Service. But with cybercrime in financial services (FS) reaching staggering levels and the costs to the global economy reportedly averaging £266 billion a year for the last three years, should we really be that surprised? While everyone looks inwardly in the event of a breach, we have to learn that to deal with the combination of the increasingly sophisticated attackers and the relentless advance of technology we need to share more readily.
Emerging technologies bring new risks
An ever-more connected customer base means more focus on digitising products, services, and transactions. So FS firms are increasingly dependent on the internet and emerging technologies which increase risk in a digitally perimeter-less environment.
With each new technology on the radar, a complementary vulnerability exists. For example:
Over and above new threats on the horizon, the FS industry has existing concerns which make cyber-security doubly challenging, including extensive compliance regulations, the struggle to secure customer data, and supplier risk.
So how should firms respond?
Too many institutions rely on general IT-risk management processes in the hope they’ll be enough in the event of a major cyber-attack. But FS firms need to protect themselves by analysing data and looking for trends to pre-empt potential attackers.
A US- study highlighted that a mass spear-phishing email campaign in 2013 demonstrated that many institutions lacked the right vision and strategy to defend against evolving and persistent threats. Criminals stole almost $1billion from 100 banks in 30 countries. The malware used wasn’t detected by affected businesses for almost 300 days after the attack. In short, long-term protection which should focus on improving incidence response or enhancing cultural security behaviours is sacrificed in favour of real-time threat detection.
Firms need to remember that technology alone cannot secure your department from a crippling cyber-attack. User education needs to be integrated with robust technology into a business-wide programme for cyber security.
Assume anything is possible
The best way businesses can improve their cyber resilience is to embrace a risk-based approach to managing cyber security.A risk-based approach starts with the assumption that an unauthorised user already has the capability to gain access to a system. With this in mind, a risk-based approach undertakes a process of threat modeling where security experts look at the entire IT environment and documents threats (existing or emerging) and their potential impact on a businesses’ security posture. Ultimately, a risk-based approach needs to form part of an overall risk management strategy and should involve:
Stand together
Given the sophistication, complexity, and evolution of the techniques and technologies used by attackers, even a sizeable organisation with ample information security resources may find it difficult to plan and implement an adequate response by itself.
As cyber threats evolve, FS institutions will need to share knowledge, particularly as compliance and regulation becomes increasingly normalised. Internally, organisations can significantly strengthen their ability to protect their business as well as their customers by sharing and pooling data on attack methods, loss prevention, and information security.
Explore more articles in the Top Stories category
