Editorial & Advertiser Disclosure Global Banking And Finance Review is an independent publisher which offers News, information, Analysis, Opinion, Press Releases, Reviews, Research reports covering various economies, industries, products, services and companies. The content available on globalbankingandfinance.com is sourced by a mixture of different methods which is not limited to content produced and supplied by various staff writers, journalists, freelancers, individuals, organizations, companies, PR agencies etc. The information available on this website is purely for educational and informational purposes only. We cannot guarantee the accuracy or applicability of any of the information provided at globalbankingandfinance.com with respect to your individual or personal circumstances. Please seek professional advice from a qualified professional before making any financial decisions. Globalbankingandfinance.com also links to various third party websites and we cannot guarantee the accuracy or applicability of the information provided by third party websites.
Links from various articles on our site to third party websites are a mixture of non-sponsored links and sponsored links. Only a very small fraction of the links which point to external websites are affiliate links. Some of the links which you may click on our website may link to various products and services from our partners who may compensate us if you buy a service or product or fill a form or install an app. This will not incur additional cost to you. For avoidance of any doubts and to make it easier, you may consider any links to external websites as sponsored links. Please note that some of the services or products which we talk about carry a high level of risk and may not be suitable for everyone. These may be complex services or products and we request the readers to consider this purely from an educational standpoint. The information provided on this website is general in nature. Global Banking & Finance Review expressly disclaims any liability without any limitation which may arise directly or indirectly from the use of such information.

Cyber security lessons for financial firms

By Andy Barratt, managing director at international cybersecurity consultancy Coalfire, explains how the financial services sector can improve when it comes to managing cybersecurity. 

The mishaps of multi-national banks and businesses seem to have dominated headlines in recent years. And, in the wake of another 12 months of IT malfunctions and cybersecurity incidents, it’s clear that the financial services sector finds itself struggling to build trust with customers.

Despite the high stakes and evident risk to brand perception, banks and financial services institutions continue to fall short when it comes to cyber.

Indeed, we know from our own research that not only is the financial services sector the most vulnerable to cyber attacks, but its cyber defenses are actually deteriorating.

Andy Barratt
Andy Barratt

Coalfire’s second annual penetration risk report details the cybersecurity credentials of more than 500 businesses of all sizes across five high-risk sectors: technology, retail, healthcare, education and financial services.

The report found that since the previous year’s report, the number of financial services firms at high risk of attack had increased by more than two fifths (41%), the only sector to have suffered an increase in risk.

It’s not surprising that financial institutions are attractive targets for cybercriminals. By their very nature, banks contain massive amounts of valuable and sensitive information.

The question instead, is why these firms continue to fall foul of proper cyber protocol.

Legacy issues

The banking industry has seen more fundamental change in the last two decades than ever before and at a pace that outstrips most other industries.

Agile new entrants to the sector are offering customers convenient new ways of banking – often using technology to provide an efficient service with minimal resources.

At the same time, with interest rates at historic lows, banks are also being forced to find new ways to generate profits and reduce costs.

With all these distractions, it wouldn’t be a surprise if cyber risk management fell down the agenda, leaving banks more susceptible to a major IT failure or malicious attack – a worrying prospect when you consider that the rapid pace of digitalization in the sector is creating more opportunities for cybercriminals all the time.

Understanding risk

The sheer size and complexity of most banks’ IT infrastructure makes it almost impossible to cover all bases when it comes to cybersecurity.

Instead, firms must endeavor to fully understand the nature of threats, both internal and external, to ensure resource is being put to the best possible use.

One of the most common risks faced by large businesses is through its supply chain. In the financial services industry, where there is constant interaction between numerous third parties and their affiliated platforms, this risk is multiplied.

For businesses of this size, resilience in the face of an attack is key. By always assuming that an attacker will find its way in, businesses can be prepared to quickly respond to threats and help minimize losses.

Human error

But internal vulnerabilities are just as much of a threat as external actors. As in all industries, people are one of a bank’s biggest security weaknesses – and this risk is amplified as the size of the workforce increases.

Our own findings highlighted that at almost three-quarters (71%) of the businesses tested, employees willingly gave up access credentials when targeted with phishing scams – when a hacker poses as a reputable contact via email.

Through firm-wide training and encouraging awareness, businesses can begin to significantly mitigate these risks, however. By fostering a culture where staff feel confident in reporting issues, organizations will also create an environment where solutions to otherwise avoidable issues will be found.

Ultimately, firms must incorporate a suite of strategies that include more progressive ways of thinking alongside operational and technological solutions in order to reduce their exposure to threats.

Making improvements to cybersecurity can be a difficult task for any business, let alone those that reach the scale of most banking institutions.

That being said, it’s clear the sector must improve its security outlook if it is to build trust with customers.