Cyber Security Lessons for Financial Firms

By Andy Barratt, managing director at international cybersecurity consultancy Coalfire, explains how the financial services sector can improve when it comes to managing cybersecurity. 

The mishaps of multi-national banks and businesses seem to have dominated headlines in recent years. And, in the wake of another 12 months of IT malfunctions and cybersecurity incidents, it’s clear that the financial services sector finds itself struggling to build trust with customers.

Despite the high stakes and evident risk to brand perception, banks and financial services institutions continue to fall short when it comes to cyber.

Indeed, we know from our own research that not only is the financial services sector the most vulnerable to cyber attacks, but its cyber defenses are actually deteriorating.

Andy Barratt

Coalfire’s second annual penetration risk report details the cybersecurity credentials of more than 500 businesses of all sizes across five high-risk sectors: technology, retail, healthcare, education and financial services.

The report found that since the previous year’s report, the number of financial services firms at high risk of attack had increased by more than two fifths (41%), the only sector to have suffered an increase in risk.

It’s not surprising that financial institutions are attractive targets for cybercriminals. By their very nature, banks contain massive amounts of valuable and sensitive information.

The question instead, is why these firms continue to fall foul of proper cyber protocol.

Legacy issues

The banking industry has seen more fundamental change in the last two decades than ever before and at a pace that outstrips most other industries.

Agile new entrants to the sector are offering customers convenient new ways of banking – often using technology to provide an efficient service with minimal resources.

At the same time, with interest rates at historic lows, banks are also being forced to find new ways to generate profits and reduce costs.

With all these distractions, it wouldn’t be a surprise if cyber risk management fell down the agenda, leaving banks more susceptible to a major IT failure or malicious attack – a worrying prospect when you consider that the rapid pace of digitalization in the sector is creating more opportunities for cybercriminals all the time.

Understanding risk

The sheer size and complexity of most banks’ IT infrastructure makes it almost impossible to cover all bases when it comes to cybersecurity.

Instead, firms must endeavor to fully understand the nature of threats, both internal and external, to ensure resource is being put to the best possible use.

One of the most common risks faced by large businesses is through its supply chain. In the financial services industry, where there is constant interaction between numerous third parties and their affiliated platforms, this risk is multiplied.

For businesses of this size, resilience in the face of an attack is key. By always assuming that an attacker will find its way in, businesses can be prepared to quickly respond to threats and help minimize losses.

Human error

But internal vulnerabilities are just as much of a threat as external actors. As in all industries, people are one of a bank’s biggest security weaknesses – and this risk is amplified as the size of the workforce increases.

Our own findings highlighted that at almost three-quarters (71%) of the businesses tested, employees willingly gave up access credentials when targeted with phishing scams – when a hacker poses as a reputable contact via email.

Through firm-wide training and encouraging awareness, businesses can begin to significantly mitigate these risks, however. By fostering a culture where staff feel confident in reporting issues, organizations will also create an environment where solutions to otherwise avoidable issues will be found.

Ultimately, firms must incorporate a suite of strategies that include more progressive ways of thinking alongside operational and technological solutions in order to reduce their exposure to threats.

Making improvements to cybersecurity can be a difficult task for any business, let alone those that reach the scale of most banking institutions.

That being said, it’s clear the sector must improve its security outlook if it is to build trust with customers.