Banks' Concerns About Cyberthreats GrowSurvey: Cyber-Attacks, Geopolitical Threats Among Top 5 Worries
Banking leaders say they're substantially more concerned today than they were just six months ago about cyber-attacks and geopolitical threats aimed at the global financial system.
That's according to a report covering results of a survey conducted during the third quarter and published last week by the Depository Trust & Clearing Corp. The DTCC provides clearing and settlement services for banking institutions. Participants in the survey included financial stakeholders from throughout the world.
Since March, when the DTCC last conducted its Systemic Risk Barometer survey, more global banking leaders say they see ongoing cyber-risks as posing increasing concern. They rate cyberthreats as the No. 1 systemic risk facing the global economy today.
Banking institutions and other financial services firms surveyed by the DTCC say that in the past 12 months, they have increased their investments in systems and technologies designed to monitor and mitigate systemic risks, such as cyber-attacks and economic recessions that could collapse the global financial system.
Still, banking institutions, by their own admission, have a long way to go. Some 67 percent of the DTCC survey's respondents say their institutions are still developing strategies and investing in technologies that are sufficient to identify and mitigate systemic risks such as emerging cyberthreats.
Catalyst for Concern
In the wake of the September breach at U.S. banking leader JPMorgan Chase, which exposed personally identifiable information about 76 million U.S. households and 7 million small businesses, concerns about attacks waged against the financial infrastructure have obviously risen.
Tom Kellermann, the chief cybersecurity officer of cyberthreat intelligence firm Trend Micro who recently blogged about the growing global network of white-collar cybercriminals, says the DTCC's survey report highlights key issues.
"Due to the increased organization and sophistication of cybercrime crews, cooperation with law enforcement has become an imperative," he writes. "It is my hope that the entire financial sector will awaken and modernize risk management accordingly."
"The interconnectedness of the financial sector is unprecedented," Kellermann says. "As a result, these interdependencies are being exploited by cyber-savvy white-collar criminals. The elite modern day Dillinger gangs, who reside in Brazil and Russia, have developed a true acumen for finance."
The DTCC also notes the need for more global collaboration among financial services companies and law enforcement in a white paper issued in conjunction with the survey report.
"Building information partnerships among key stakeholders is critical to developing the most comprehensive and effective tools for promoting cybersecurity across the financial system and in our critical infrastructures," says Michael Leibrock, DTCC's chief systemic risk officer. "The best way to achieve these alliances is through a truly coordinated and open approach across industries and national borders.
Financial fraud consultant Shirley Inscoe, an analyst at Aite, says it's no surprise that geopolitical threats ranked among the top five systemic risks banking institutions identified in the DTCC survey.
"Cyberthreats originate in many different countries; governments in some nations fund or silently support economic threats against other nations," Inscoe says. "With geopolitical threats increasing, with little to no risk to cybercriminals for their activities, we know these threats will continue to grow in both numbers and complexity. International law enforcement agencies may work together for years to bring down one kingpin, while others can launch cyberthreats in a matter of days. These conditions will not improve, so banks must react by making additional investments in security."
But the DTCC's Mark Clancy says banking institutions should not be too focused on cyber-attack attribution. Rather, he notes in an Oct. 13 interview, they should be more focused on defenses and information sharing.
Details surrounding network attacks are often difficult to decipher, Clancy says. By continually sharing threat intelligence, banking institutions can help each other develop meaningful data about attack trends, he contends.
Among the key recommendations for banking institutions included in DTCC's survey report and whitepaper:
- Rely more strongly on the recommendations of the National Institute of Standards and Technology's cybersecurity framework, which was issued in February;
- Establish global industry working groups, which are designed to work with regulators to develop cybersecurity regulations designed to address evolving cyberthreats;
- Increase collaboration with policymakers to identify who is responsible for large-scale cyber-attacks. "In the age of increasing APT [advanced persistent threat] attacks from nation-state actors with much greater resources than their targets, private-sector institutions cannot be expected to independently respond to or recover from all levels of cyber-attack.