Connect with us

Technology

THE IT SECURITY COMPLEXITY GAP AND ITS CRIPPLING EFFECTS ON FINANCIAL INSTITUTIONS

Published

on

THE IT SECURITY COMPLEXITY GAP AND ITS CRIPPLING EFFECTS ON FINANCIAL INSTITUTIONS

By Michael Callahan, VP of FireMon 

Can the Finance Sector Counter and Manage the Alarming Gap Between Security and Technology? 

As the world of IT security has developed, so too have the issues plaguing the enterprises that have adopted advanced security strategies. For years, experts have been trying to resolve a security deficit with a slew of technologies that it has now exploded out of control. Almost unknowingly, gaps have formed within cybersecurity protection and infrastructure across various industries. One industry in particular is likely to suffer the most, given the sensitive nature of its infrastructure and data it needs to protect from cyber attackers – the banking sector.

As banking transitions to online, mobile and on the go, the security infrastructure to support it has also multiplied – and that means more investment in security technology in an attempt to ward off cyber threats. We are now seeing a trend where there are too few security personnel to monitor and manage the snowballing number of technologies and security risks.

The Big Issues

Financial enterprises have been taking a more traditional route to achieving a securer infrastructure by investing more in security technology to try and alleviate the tremendous pressure security teams face, but that has not solved the situation. It has become impossible to keep up with the millions of rules or potentially thousands of devices – from firewalls to routers and switches – within financial organisations. This is largely due to the shortage of resources. The low staff count plus the increase in technology has led to an imbalance that results in the inability to manage security effectively.

Exploiting the infrastructure of financial institutions has become the go-to-sport for cyber aggressors with breaches becoming frequent news. The network security systems have become overwhelmingly complex for SMBs and large enterprises as they are being insecurely integrated, making it difficult for enterprises to allocate adequate security funding to precise flaws.

A serious issue in 2016 that hampered many banks was distributed denial-of-service (DDoS) attacks. In fact, it was found that over one in four banks around the world were attacked via DDoS with the cost of damage estimated to be over $1 billion. Combine that with the evolution of IoT, and you have the perfect recipe for disaster. ForeScout Technologies reported that the average business must deal with 7,000 IoT devices in the next 18 months with smaller businesses potentially having more. Frustratingly, attackers have clocked on.

So, where are the IT professionals to prevent this?

With a global shortage of qualified security professionals, the financial sector is among the industries struggling to find skilled staff to operate their complex defence systems which have been implemented out of compliance rather than security, leaving them exposed. Recent stats also make for a frightening read. A study conducted by Forrester Consulting in 2016 found 80% of businesses are vulnerable to cyber attack with 32% of European businesses stating it’s difficult to find qualified IT security personnel, per research from Frost & Sullivan. A further 75% of organisations lacked sufficient cybersecurity expertise according to a Tripwire study and if enterprises had enough to worry about, the latest analysis from the Cost of a Data Breach report, published by Ponemon Institute, estimates the average cost of a data breach to now be $4 million, meaning businesses can no longer afford to be lackadaisical and neglect to enforce appropriate security measures.

In addition, companies are suffering from ‘alert fatigue’ with studies published by EMA and International Data Corporation claiming 92% of companies were getting up to 500 alerts a day with 88% being critical. In other words, threat detection has improved, but the number of alerts means that security professionals have become complacent as a result.

Intelligent Security Management

To rectify the Complexity Gap and reduce it, a new approach is needed that allows security teams to better manage all their investments in security, from firewalls to routers and switches. A new trend within the industry has seen management technology as a ‘workforce multiplier’ being the light going forward.

The attraction to using management technology is that it fixes some of the key issues that created the Complexity Gap by using automation and analysis that human resources cannot provide. These tools have been designed to aid organisations, like financial institutions, with their own policies, frameworks and compliance requirements to automate tasks. Some decrease time needed for cyber security investigations. Others enhance project management by decreasing time needed for security audits and facilitating better use of security already in place within monetary enterprises. This allows for better optimisation of the technology in use, uncovering the needles in the haystack by contextualising the security information as well as rationalising the information so that focus can be directed to the bigger security issues.

Adopting this kind of approach may well be the answer in helping restore balance and close the Complexity Gap. It is ideal for delivering a rapid response for automating security policy configuration in line with laid down compliance practises and improving the organisation’s security posture.  It also dramatically reduces the operational expense through detailed analysis and risk simulation so that people can focus on areas that are higher value and remove the very time consuming aspects of security management.

Nevertheless, the problem will get worse before it improves. With industries adopting more devices and looking to automation, and with no immediate response to the cyber security skill shortage, the Complexity Gap is likely to widen. Thankfully, there are solutions to the problem. For the banks, numerous C-level execs have identified cyber-threats as their top concern, it is just whether the sector is quick enough to act before it’s too late and make better, more intelligent security device management a priority.

Technology

‘Spooky’ AI tool brings dead relatives’ photos to life

Published

on

'Spooky' AI tool brings dead relatives' photos to life 1

By Umberto Bacchi

(Thomson Reuters Foundation) – Like the animated paintings that adorn the walls of Harry Potter’s school, a new online tool promises to bring portraits of dead relatives to life, stirring debate about the use of technology to impersonate people.

Genealogy company MyHeritage launched its “Deep Nostalgia” feature earlier this week, allowing users to turn stills into short videos showing the person in the photograph smiling, winking and nodding.

“Seeing our beloved ancestors’ faces come to life … lets us imagine how they might have been in reality, and provides a profound new way of connecting to our family history,” MyHeritage founder Gilad Japhet said in a statement.

Developed with Israeli computer vision firm D-ID, Deep Nostalgia uses deep learning algorithms to animate images with facial expressions that were based on those of MyHeritage employees.

Some of the company’s users took to Twitter on Friday to share the animated images of their deceased relatives, as well as moving depictions of historical figures, including Albert Einstein and Ancient Egypt’s lost Queen Nefertiti.

“Takes my breath away. This is my grandfather who died when I was eight. @MyHeritage brought him back to life. Absolutely crazy,” wrote Twitter user Jenny Hawran.

While most expressed amazement, others described the feature as “spooky” and said it raised ethical questions. “The photos are enough. The dead have no say in this,” tweeted user Erica Cervini.

From chatbots to virtual reality, the tool is the latest innovation seeking to bring the dead to life through technology.

Last year U.S. rapper Kanye West famously gifted his wife Kim Kardashian a hologram of her late father congratulating her on her birthday and on marrying “the most, most, most, most, most genius man in the whole world”.

‘ANIMATING THE PAST’

The trend has opened up all sorts of ethical and legal questions, particularly around consent and the opportunity to blur reality by recreating a virtual doppelganger of the living.

Elaine Kasket a psychology professor at the University of Wolverhampton in Britain who authored a book on the “digital afterlife”, said that while Deep Nostalgia was not necessarily “problematic”, it sat “at the top of a slippery slope”.

“When people start overwriting history or sort of animating the past … You wonder where that ends up,” she said.

MyHeritage acknowledges on its website that the technology can be “a bit uncanny” and its use “controversial”, but said steps have been taken to prevent abuses.

“The Deep Nostalgia feature includes hard-coded animations that are intentionally without any speech and therefore cannot be used to fake any content or deliver any message,” MyHeritage public relations director Rafi Mendelsohn said in a statement.

Yet, images alone can convey meaning, said Faheem Hussain, a clinical assistant professor at Arizona State University’s School for the Future of Innovation in Society.

“Imagine somebody took a picture of the Last Supper and Judas is now winking at Mary Magdalene – what kind of implications that can have,” Hussain told the Thomson Reuters Foundation by phone.

Similarly, Artificial Intelligence (AI) animations could be use to make someone appear as though they were doing things they might not be happy about, such as rolling their eyes or smiling at a funeral, he added.

Mendelsohn of MyHeritage said using photos of a living person without their consent was a breach of the company’s terms and conditions, adding that videos were clearly marked with AI symbols to differentiate them from authentic recordings.

“It is our ethical responsibility to mark such synthetic videos clearly and differentiate them from real videos,” he said.

(Reporting by Umberto Bacchi @UmbertoBacchi in Milan; Editing by Helen Popper. Please credit the Thomson Reuters Foundation, the charitable arm of Thomson Reuters, that covers the lives of people around the world who struggle to live freely or fairly. Visit http://news.trust.org)

 

Continue Reading

Technology

Does your institution have operational resilience? Testing cyber resilience may be a good way to find out

Published

on

REMOTE WORKING STRATEGY REQUIRED TO STRENGTHEN CYBER RESILIENCE

By Callum Roxan, Head of Threat Intelligence, F-Secure

If ever 2020 had a lesson, it was that no organization can possibly prepare for every conceivable outcome. Yet building one particular skill will make any crisis easier to handle: operational resilience.

Many financial institutions have already devoted resources to building operational resilience. Unfortunately, this often takes what Miles Celic, Chief Executive Officer of TheCityUK, calls a “near death” experience for this conversion to occur. “Recent years have seen a number of cases of loss of reputation, reduced enterprise value and senior executive casualties from operational incidents that have been badly handled,” he wrote.

But it need not take a disaster to learn this vital lesson.

“Operational resilience means not only planning around specific, identified risks,” Charlotte Gerken, the executive director of the Bank of England, said in a 2017 speech on operational resilience. “We want firms to plan on the assumption that any part of their infrastructure could be impacted, whatever the reason.” Gerken noted that firms that had successfully achieved a level of resilience that survives a crisis had established the necessary mechanisms to bring the business together to respond where and when risks materialised, no matter why or how.

We’ll talk about the bit we know best here; by testing for cyber resilience, a company can do more than prepare for the worst sort of attacks it may face. This process can help any business get a clearer view of how it operates, and how well it is prepared for all kinds of surprises.

Assumptions and the mechanisms they should produce are the best way to prepare for the unknown. But, as the boxer Mike Tyson once said, “Everyone has a plan until they get punched in the mouth.” The aim of cyber resilience is to build an effective security posture that survives that first punch, and the several that are likely to follow. So how can an institution be confident that they’ve achieved genuine operational resilience?

This requires an organization to honestly assess itself through the motto inscribed at the front of the Temple of Delphi: “Know thyself.” And when it comes to cyber security, there is a way for an organization to test just how thoroughly it comprehends its own strengths and weaknesses.

Callum Roxan

Callum Roxan

The Bank of England was the first central bank to help develop the framework for institutions to test the integrity of their systems. CBEST is made up of controlled, bespoke, intelligence-led cyber security tests that replicate behaviours of those threat actors, and often have unforeseen or secondary benefits. Gerken notes that the “firms that did best in the testing tended to be those that really understood their organisations. They understood their own needs, strengths and weaknesses, and reflected this in the way they built resilience.”

In short, testing cyber resilience can provide clear insight into an institution’s operational resilience in general.

Gaining that specific knowledge without a “near-death” experience is obviously a significant win for any establishment. And testing for operational resilience throughout the industry can provide some reminders of the steps every organization should take so that testing provides unique insists about their institution, and not just a checklist of cyber defence basics.

The IIF/McKinsey Cyber Resilience Survey of the financial services industry released in March lasy year provided six sets of immediate actions that institutions could take to improve their cyber security posture. The toplines of these recommendations were:

  1. Do the basics, patch your vulnerabilities.
  2. Review your cloud architecture and security capabilities.
  3. Reduce your supply chain risk.
  4. Practice your incident response and recovery capabilities.
  5. Set aside a specific cyber security budget and prioritise it
  6. Build a skilled talent pool and optimize resources through automation.

But let’s be honest: If simply reading a solid list of recommendations created cyber resilience, cyber criminals would be out of business. Unfortunately, cyber crime as a business is booming and threat actors targeting essential financial institutions through cyber attacks are likely earning billions in the trillion dollar industry of financial crime.A list can’t reveal an institution’s unique weaknesses, those security failings and chokepoints that could shudder operations, not just during a successful cyber attack but during various other crises that challenge their operations. And the failings that lead to flaws in an institution’s cyber defence likely reverberate throughout the organization as liabilities that other crises would likely expose.

The best way to get a sense of operational resilience will always be to simulate the worst that attackers can summon. That’s why the time to test yourself is now, before someone else does.

Continue Reading

Technology

Thomson Reuters to stress AI, machine learning in a post-pandemic world

Published

on

gbaf1news

By Kenneth Li and Nick Zieminski

NEW YORK (Reuters) – Thomson Reuters Corp will streamline technology, close offices and rely more on machines to prepare for a post-pandemic world, the news and information group said on Tuesday, as it reported higher sales and operating profit.

The Toronto-headquartered company will spend $500 million to $600 million over two years to burnish its technology credentials, investing in AI and machine learning to get data faster to professional customers increasingly working from home during the coronavirus crisis.

It will transition from a content provider to a content-driven technology company, and from a holding company to an operational structure.

Thomson Reuters’ New York- and Toronto-listed shares each gained more than 8%.

It aims to cut annual operating expenses by $600 million through eliminating duplicate functions, modernizing and consolidating technology, as well as through attrition and shrinking its real estate footprint. Layoffs are not a focus of the cost cuts and there are no current plans to divest assets as part of this plan, the company said.

“We look at the changing behaviors as a result of COVID … on professionals working from home working remotely being much more reliant on 24-7, digital always-on, sort of real-time always available information, served through software and powered by AI and ML (machine learning),” Chief Executive Steve Hasker said in an interview.

Sales growth is forecast to accelerate in each of the next three years compared with 1.3% reported sales growth for 2020, the company said in its earnings release.

Thomson Reuters, which owns Reuters News, said revenues rose 2% to $1.62 billion, while its operating profit jumped more than 300% to $956 million, reflecting the sale of an investment and other items.

Its three main divisions, Legal Professionals, Tax & Accounting Professionals, and Corporates, all showed higher organic quarterly sales and adjusted profit. As part of the two-year change program, the corporate, legal and tax side will operate more as one customer-facing entity.

Adjusted earnings per share of 54 cents were ahead of the 46 cents expected, based on data from Refinitiv.

The company raised its annual dividend by 10 cents to $1.62 per share.

The Reuters News business showed lower revenue in the fourth quarter. In January, Stephen J. Adler, Reuters’ editor-in-chief for the past decade, said he would retire in April from the world’s largest international news provider.

Thomson Reuters also said its stake in The London Stock Exchange is now worth about $11.2 billion.

The LSE last month completed its $27-billion takeover of data and analytics business Refinitiv, 45%-owned by Thomson Reuters.

(Reporting by Ken Li, writing by Nick Zieminski in New York, editing by Louise Heavens and Jane Merriman)

 

Continue Reading
Editorial & Advertiser disclosureOur website provides you with information, news, press releases, Opinion and advertorials on various financial products and services. This is not to be considered as financial advice and should be considered only for information purposes. We cannot guarantee the accuracy or applicability of any information provided with respect to your individual or personal circumstances. Please seek Professional advice from a qualified professional before making any financial decisions. We link to various third party websites, affiliate sales networks, and may link to our advertising partners websites. Though we are tied up with various advertising and affiliate networks, this does not affect our analysis or opinion. When you view or click on certain links available on our articles, our partners may compensate us for displaying the content to you, or make a purchase or fill a form. This will not incur any additional charges to you. To make things simpler for you to identity or distinguish sponsored articles or links, you may consider all articles or links hosted on our site as a partner endorsed link.

Call For Entries

Global Banking and Finance Review Awards Nominations 2021
2021 Awards now open. Click Here to Nominate

Latest Articles

Newsletters with Secrets & Analysis. Subscribe Now