Finance
How financial services can secure data and build trust in today’s modern environment
Home > Finance > How financial services can secure data and build trust in today’s modern environment
Global Banking and Finance Review
Company
By Martin Riley, Director of Managed Security Services at Bridewell Consulting
As finance undergoes major digital and infrastructure transformation, and technologies like blockchain and cloud become commonplace, no other sector is more data-driven, digitised and ultimately more attractive to cyber criminals. Unsurprisingly, banking and financial institutes are 300 times more at risk of cyber attacks than other companies.
Martin Riley, Director of Managed Security Services at Bridewell Consulting
Today, with the UK’s financial regulator warning banks of the growing threat of Russian-sponsored cyber attacks, the industry needs to protect itself against a diverse and escalating range of threats. Standard cyber security measures and tools are no longer sufficient: organisations must adopt a proactive and intelligent approach to cyber security that is underpinned by managed detection and response.
Unique risks facing the finance sector
Cyber criminals know that finance companies use and store a treasure-trove of confidential customer data. The sector is vast and interconnected to many other industries, distinguishing it further as a lucrative target for threat actors. And although financial services firms already spend three times the amount that non-financial organisations do on cyber security, criminals are becoming increasingly sophisticated in finding and targeting weak points across the finance community.
Ransomware is very much on the rise: according to Sophos, 34% of mid-sized financial services organisations worldwide were hit by ransomware in 2020, and the trend continues to climb upwards. This type of attack, which involves hackers seizing control of data systems before demanding money to give back access, has rapidly evolved from being a malware issue to a highly nuanced and profitable human endeavour. Harnessing the efficiency of automation and wormable ransomware, ransomware gangs can disrupt and damage almost all the components in the financial services ecosystem.
The finance sector is also becoming increasingly exposed to phishing scams. According to the APWG, financial services organisations are the target of around 41% of all such attacks, leaving them vulnerable to data breaches and severe reputational damage. And scams are no longer limited to email: last year saw Barclays account holders fall victim to a series of orchestrated social engineering attacks through text messaging and SMS (known as ‘smishing’), resulting in millions of pounds being stolen.
Insider threats are another, often overlooked, risk within organisations. Whether malicious or accidental, these internal risks are particularly worrisome for the financial services sector due to the easy monetisation of the personal and financial data they hold. The remote working revolution has created further challenges when attempting to detect such attacks. Therefore, organisations are a key target for cyber criminals who can either make fraudulent transactions with the sensitive data obtained or sell the information on the black market.
Digital transformation: a challenge and opportunity
Covid-19 has accelerated digital transformation across UK industry, and the finance sector has understood the urgent need to invest in technology to meet customer demands, enhance operational agility, and manage risks and costs.
However, this process inevitably introduces more security risks for financial services organisations as their attack surface broadens. It is even argued that new and innovative methods of cyber attack are significantly outpacing current regulations, organisational strategies, and governmental policies.
Despite recent digital advances, many banks are still reliant on traditional systems and legacy infrastructure that lack the functionality needed for modern risk and compliance management. Some digitised functions, such as contactless payment and online banking, have had applications built and developed on top of outdated systems, thereby inadvertently exposing large amounts of the infrastructure. Technical debt and disjointed systems severely compromise both the overall security of an IT estate and the organisation’s ability to respond swiftly to any threats.
Aligning cyber and digital security strategies
Cyber crime is quickly displacing conventional crime. Therefore, cyber and digital security strategies should be thought of as inseparable, allowing organisations to plan and integrate both into their transformation projects from the very beginning.
Traditionally, senior managers have considered digital transformation and cyber security to be two separate strategies with independent objectives and goals. However, this siloed approach often causes financial services organisations to overlook the security flaws and system weaknesses that come with rapid technological change. Threat actors are poised to take advantage of those companies quickly deploying new tools and completing fast upgrades without properly securing systems and defences.
Organisations must therefore take steps to ensure they have a strong cyber security strategy that matches their digital transformation strategy. By identifying any areas where vulnerabilities exist within legacy IT infrastructure, they can introduce a robust security transformation plan that ultimately drives the wider digital transformation of the business. Cyber security must never be approached reactively or as an afterthought: keeping a proactive mindset throughout the digital transformation process is a key part of building and maintaining cyber resilience.
Shifting from prevention to response
To counter the growing cyber crime threat, financial institutions need to find ways to alleviate new risks without increasing cost. Therefore, they should start to move their cyber security focus from prevention to detection, containment, and response, underpinned by the right services such as Managed Detection and Response (MDR) and validating recovery.
IBM’s Cost of a Data Breach Report highlights the significance of being able to effectively detect how and when a cyber breach has taken place and respond accordingly. Companies that take a short-sighted preventative approach and fail to invest in a MDR strategy are typically those that take the longest to discover an attack has taken place.
An effective MDR strategy consists of threat intelligence, threat hunting and penetration testing, in addition to deployment and management of security monitoring and incident response. By combining artificial intelligence, automation, and human analysis, MDR can provide enhanced visibility over networks and systems, enabling organisations to detect and prevent cyber attacks, whether internal or external.
Implementing a robust MDR strategy
The nerve centre of a MDR service is the Security Operations Centre (SOC). However, gleaning true value from a SOC can be complicated with a variety of different approaches at hand, including in-house, fully outsourced and hybrid options. While each has benefits, in today’s evolving threat landscape arguably it is only the hybrid model that can offer the right combination of expertise, responsiveness, flexibility, and cost-effectiveness.
A hybrid SOC approach can help develop a reference security architecture that enables organisations to safeguard on-premises systems, cloud-based applications, and SaaS solutions. Most importantly, it helps security become an enabler for the business rather than just a reactive response to the damaging impacts of a breach.
The most effective methods of MDR utilise Extended Detection and Response (XDR) technology to enable detection and response capabilities across network, web and email, cloud, endpoint and – most crucially – identity. This ensures that wherever the cyber-attack comes from, users, assets and data remain safeguarded, adding a protective layer to the zero-trust environment and guaranteeing proactive action against threats. At the same time, choosing a solution that leverages existing investments in Microsoft 365 licensing can enable consolidation and reduce security spend, while also increasing coverage and visibility.
By combining MDR with ethical hacking techniques, such as red teaming, to simulate attacks, financial sector organisations can develop deep insights into any gaps in cyber security strategy. The collaborative process of identifying and closing the gap – which is then validated through retesting – not only removes the risk but also educates teams on a range of cyber security best practice.
Road to cyber resilience
Cyber attack methods and motives will continue to evolve, so the finance sector will need to stay one step ahead without compromising the digital agility that customers and partners expect. The only way to improve cyber resilience is to implement a well-considered cyber security strategy centred around MDR. This approach will not only adhere to the strict compliant and regulatory requirements of the industry but will also improve an organisation’s overall security posture.
However, success depends on ensuring organisations have the right processes and people in place to manage new technologies. With many companies lacking security professionals with the depth of security knowledge and technical capability required for running effective MDR or cloud native modern SOCs, working with a security partner will be essential.
By partnering with a trusted and experienced team of experts, organisations will benefit from an agile end-to-end solution to secure data and build all-important consumer trust. In today’s shifting and increasingly volatile cyber landscape, it will be those organisations that adopt a proactive approach to security operations and implement a robust cyber security transformation process that will reap the benefits of a stronger, more structured IT estate.
Explore more articles in the Finance category
