Banking on security in an environment of threats

Srinivasan C.R. 

The global financial crisis of 2008 was a piercing wake-up call for the financial industries of the world. It brought several regulatory and legislative changes in its wake, all aimed at preventing the recurrence of such an event. But the years since then have seen a different kind of threat emerging. The warning sirens are more frequent than before and more insistent.

Banks and financial institutions seek to stay relevant and competitive with providing convenient, personalized services to their customers. For this, they collect and analyze huge volumes of sensitive customer data. All this information is stored and accessed online. And this makes them prone to cyber attacks. Cybercriminals exploit vulnerabilities in digital systems to perpetrate attacks of different natures and complexities. Incidences of such attacks have been increasing over the years, and unless we take great care, cyber attacks could easily be the cause of the next global financial crisis.

Only recently, US credit reporting bureau Equifax suffered a huge data breach, resulting in significant loss of data, which included the personal details of over 145 million people across the US, UK, and Canada. This event triggered a rethink of data protection laws in the US. Earlier in 2017, the Llyods Banking Group was hit by a major DDoS (Distributed Denial of Service) attack over the course of 48 hours, as cybercriminals attempted to block access to 20 million UK accounts. Later in the year, several South Korean Banks were threatened with a DDoS attack if they did not pay a $315,000 bitcoin ransom.

Equally worrying, and just as dangerous, are attacks that gradually siphon off data over an extended period of time. Such attacks are generally perpetrated through malware, such as the TrickBot Trojan, which made an appearance in Latin America and targeted banks in over 40 countries.

Recent trends like P2P (peer-to-peer) banking, directives like PSD2 (Revised Payment Service Directive), and initiatives like the Open API Standards for banking in the UK, while they all have their positives, have also inadvertently made the threat landscape riskier by providing more channels through which hackers can target systems. National and global authorities have introduced regulations to ensure that the financial industry takes the cybersecurity aspect of their business very, very seriously.

Under the EU General Data Protection Regulation, which will be enforced from May 25, 2018, organizations that are breached could attract a penalty of up to 20 million Euros or 4 percent of their annual global turnover, whichever is higher. India is in the process of instituting a Computer Emergency Response Team in Financial Sector (CERT-Fin), which will work closely with all financial-sector regulators and stakeholders on issues of cybersecurity.

Cyber threats are evolving as fast as the counter-measures being adopted to combat them. It is therefore essential for banks and financial institutions to be armed with agile cybersecurity strategies that identify potential threats, prevent attacks, and enable fast recovery. The banking industry should continue to invest significantly in cybersecurity – as they traditionally have – because their business is heavily dependent on customer trust.

As the open banking phenomenon grows, and different sets of data become digitally interconnected, the industry needs to protect customer data more fiercely than ever. A security breach can damage not just the company’s revenues, but also its reputation. A recent consumer study revealed that 50 percent respondents would consider switching banks if they suffered a cyber attack, while 47 percent said they would “lose complete trust” in their bank if such an event occurred.

The BFSI industry needs to look at adaptive, round-the-clock methods of detection, defense, and counter-attacks against cyber threats. Help is readily available in the form of third-party security service providers, who have the requisite expertise to offer comprehensive, assured protection. It is also an encouraging sign that investments in security operation centers (SOCs) are on the rise.

The 2008 financial crisis taught the financial industry that it needed to adopt a more responsible approach towards risk management. The years since have delivered a recurring lesson – the pertinence of keeping abreast of the latest in security threats and solutions and investing in security applications that can adapt to the current and future changes in one of our most important and vulnerable industries. Let’s act as we learn.

The author is Senior Vice President, Global Product Management & Data Centre Services at Tata Communications