Cybersecurity must become the UK finance sector’s priority

The UK finance sec­tor is on edge. Attract­ed to the lucra­tive results of a suc­cess­ful breach, cyber­crim­i­nals are per­sis­tent­ly elect­ing to tar­get busi­ness­es with­in the sec­tor. The num­bers speak for them­selves; in the last year alone, UK finance organ­i­sa­tions expe­ri­enced, on aver­age, 60 dif­fer­ent cyber­at­tacks – more than one per week.

Although the imme­di­ate con­se­quences of a cyber­at­tack are well doc­u­ment­ed, the long-term effects are even more alarm­ing. One data breach can leave busi­ness­es reel­ing for months after cost­ing an organ­i­sa­tion valu­able time and mon­ey. The HSE, Ireland’s health ser­vice, is tes­ta­ment to this; almost half a year after a crip­pling attack, it has still only man­aged to restore 95% of all servers and devices, high­light­ing the long-last­ing fall­out of these inci­dents that can crip­ple organ­i­sa­tions for many months, if not years.

A large major­i­ty of busi­ness­es with­in the finance sec­tor believe that the sit­u­a­tion will only dete­ri­o­rate with­in the next 12 months. Unfor­tu­nate­ly, no com­pa­ny will ever be entire­ly safe. How­ev­er, by putting the right mea­sures in place now, UK finance organ­i­sa­tions can at least mit­i­gate the risk of being breached and pre­vent los­ing invalu­able dig­i­tal assets.

No threat, no prob­lem?

It can often be dif­fi­cult to dis­cern where exact­ly the risk lies with­in a company’s cyber­se­cu­ri­ty defences. How­ev­er, the threat is most cer­tain­ly there, and many busi­ness­es are aware that they are under­pre­pared for the next attack. In fact, accord­ing to Keeper’s 2021 UK Cyber­se­cu­ri­ty Cen­sus report, only 42% of IT deci­sion-mak­ers in the finance indus­try actu­al­ly feel their com­pa­ny is very well pre­pared against cyber­at­tacks, while just 22% feel that UK busi­ness­es in gen­er­al are very well pre­pared.

Achiev­ing a high lev­el of pre­pared­ness can be a cost­ly affair, and with­out a tan­gi­ble threat on the hori­zon, busi­ness lead­ers are still reluc­tant to allo­cate a bud­get big enough to pro­tect their organ­i­sa­tions from com­plex, well-financed attacks. It is there­fore cru­cial that IT deci­sion-mak­ers ensure they cov­er the basics and put sim­ple, yet effec­tive cyber­se­cu­ri­ty best prac­tices in place that don’t need to cost the world.

One of the eas­i­est ways a com­pa­ny can avoid the cat­a­stroph­ic con­se­quences of a data breach is through for­mal edu­ca­tion. By train­ing employ­ees – across all lev­els of the organ­i­sa­tion – to man­age their own secu­ri­ty prac­tices, busi­ness­es can pre­vent data breach­es that affect the whole com­pa­ny. By hand­ing respon­si­bil­i­ty over to each indi­vid­ual employ­ee, IT deci­sion-mak­ers can also share the bur­den of pro­tect­ing the busi­ness, mak­ing their job that lit­tle bit less stress­ful.

Busi­ness lead­ers also often over­look the pow­er of their organisation’s first and most fun­da­men­tal line of defence: its employ­ees and their pass­words. Pass­word secu­ri­ty issues account for more than 80% of all data breach­es glob­al­ly, so good pass­word hygiene is cru­cial to ensur­ing that dig­i­tal assets are kept safe from cyber­crim­i­nals.

Busi­ness­es can facil­i­tate bet­ter pass­word hygiene with­in the organ­i­sa­tion by intro­duc­ing a cen­tralised pass­word man­age­ment plat­form that keeps cre­den­tials safe from bad actors, with­out the need for lists of unmem­o­rable pass­words. These plat­forms encrypt login details to ensure that an organisation’s dig­i­tal assets are kept safe, sig­nif­i­cant­ly reduc­ing the risk of being exposed to a pass­word-relat­ed data breach.

A call for reg­u­la­tion

In the­o­ry, it seems log­i­cal that every UK finance organ­i­sa­tion should want to put the right mea­sures in place to pro­tect them­selves against cyberthreats. How­ev­er, many CIOs and CISOs argue that unless there exists a legal incen­tive to push busi­ness lead­ers to change, they won’t.

The major­i­ty of the UK’s IT deci­sion-mak­ers there­fore agree that an offi­cial cyber­se­cu­ri­ty reg­u­la­to­ry body would keep the finance sec­tor safer from attacks by hold­ing busi­ness­es account­able for their secu­ri­ty poli­cies. Many even believe that it should be a legal require­ment for busi­ness­es to have basic cyber­se­cu­ri­ty pro­tec­tions in place before being allowed to oper­ate or trade.

Reg­u­la­tion may also help to build a cul­ture of trans­paren­cy with­in the indus­try, which has also become a preva­lent issue, even among those design­ing IT pol­i­cy. More than two in five IT deci­sion-mak­ers have kept a cyber­se­cu­ri­ty attack affect­ing their busi­ness to them­selves, which is even more con­cern­ing giv­en that four in five IT deci­sion-mak­ers have done at least one thing to com­pro­mise their own company’s secu­ri­ty in the last 12 months.

The UK’s finan­cial sec­tor must look to improve if it hopes to deal with the onslaught of attacks set to ramp up in the com­ing years. A reg­u­la­to­ry body may encour­age com­pa­nies to make impor­tant adjust­ments to their cyber­se­cu­ri­ty defens­es. How­ev­er, the respon­si­bil­i­ty ulti­mate­ly lies with busi­ness lead­ers to give UK IT deci­sion-mak­ers the free­dom and resources they need to pro­tect their organ­i­sa­tions. By react­ing now, busi­ness­es will be left in a bet­ter posi­tion to cope with mod­ern cyber­se­cu­ri­ty pres­sures in the future.

For more infor­ma­tion please vis­it keeper.io/protect

Spon­sored by

Keep­er Secu­ri­ty