The Need for Enhancing Cyber Preparedness in Financial Institutions

Cybersecurity threats have been a grim reality for the financial sector for a long time now. According to a recent report from the IMF, the industry has been hit by over 20,000 attacks, resulting in a $12bn loss over the last 20 years.

Moreover, digitalisation has introduced new vulnerabilities and cyber risks to an already vulnerable sector. While risky, harnessing a sophisticated and diverse range of technologies brings countless benefits and opportunities to financial institutions, from allowing industry players to enhance their services to gaining differentiation advantages in the market.

Through innovative use of technology, banks can provide a highly personalised experience to their customers, enabling them to complete numerous actions with a single click. Integrating advanced digital capabilities also allows institutions to tackle complex organisational challenges effectively.

Financial institutions are obliged to utilise big data, a collection of microservices and application programming interfaces (APIs) to make this high level of customisation possible for customers. However, increasing reliance on data and third-party apps creates an extensive ecosystem with multiple players involved in daily transactions and increases the surface area for cybercriminals to target.

It presents huge opportunities for malicious actors to access a lucrative store of customer data and monetary assets. A recent attack on the Bank of America is a stark reminder of the third-party risks and the complex web of vulnerabilities in an increasingly interconnected digital ecosystem.

Financial institutions can't turn their backs on data or refuse to use advanced technological solutions in this age and day. Thus, finding ways to effectively defend against cyber attacks and mitigate the risk associated with excessive technology and data use is imperative. Prioritising cybersecurity preparedness, implementing robust cybersecurity measures, and adopting proactive strategies and approaches across the sector is the only way to go.

What is to be 'well-prepared' for cyber attacks?

Since cyber attacks have increased in sophistication and frequency, it is getting more challenging for financial institutions to protect themselves. Indeed, the reality is startling; with a recent KPMG Banking CEO Outlook survey revealing that only 54% of banking CEOs feel well-prepared for a cyber attack.

The key here is to understand what being prepared stands for; considering the ever-evolving nature of cyber threats, being 'well-prepared' cannot be a static state. Cyber preparedness and resilience refer to a continuous effort, not a one-time action. Overall, it's about having an agile plan and strategy to quickly equip security teams to tackle any cyber threat.

Fostering a holistic security culture is a necessity to achieve cyber preparedness as being prepared against cyber attacks is not only about the deployment of security tools and technologies, but also the development of a cybersecurity culture at every level of an organisation. 

In every organisation, systems, technology, and people should work together to strengthen security posture and provide continuous protection across all attack surfaces. Tackling cyber attacks effectively is impossible without educating all stakeholders and cultivating a culture of continuous learning and development, including continuous training and upskilling.

To ensure cyber readiness in the banking and financial services sector, organisations should consider their infrastructure as a whole. Investing in the right tools and appointing an experienced, fully dedicated team is the first step, but offering organisation-wide, broad-based educational and awareness programmes and developing home-grown cybersecurity talent are also necessary to mitigate incoming threats.

Read team approach: Fire drill for cyber preparedness

Another forward-thinking approach for financial institutions to adopt is the red team approach. This goes beyond surface-level testing and creates a genuine cyber attack environment. By targeting weak and vulnerable spots that malicious actors could exploit, red teaming provides a deeper, more comprehensive insight into the institution’s cybersecurity preparedness.

Integrating red teaming into financial institutions’ security strategies is a strategic move. It serves as a powerful tool for objectively assessing security capabilities, enabling informed decisions about defining priorities and security strategies. 

Financial institutions should invest in cyber attack simulations, stress testing, contingency planning, and crisis response to stay ahead of the game and provide a sense of security in the face of ever-evolving cyber threats as they strive to digitalise their service and offerings.