How can cybersecurity support innovation in the financial services sector?

Round­table atten­dees
Dar­ren Guc­cione, chief exec­u­tive offi­cer
and co-founder, Keep­er Secu­ri­ty
Jason Mallinder, group chief infor­ma­tion secu­ri­ty offi­cer (CISO), man­ag­ing direc­tor, Cred­it Suisse
Jon Pum­fleet, group CISO, Close Broth­ers
John Skip­per, CISO, Metro Bank

What does the cyber­se­cu­ri­ty land­scape look like for the finan­cial ser­vices sec­tor in 2021?
DG: Every­one trans­acts with the finan­cial sec­tor. Covid-19 has been a cat­alyt­ic event with migra­tion to dis­trib­uted remote work and it has trig­gered an expo­nen­tial increase in the num­ber of end­points to pro­tect. As a result, CISOs have to put con­trols and safe­guards out­side the nor­mal perime­ter and think dif­fer­ent­ly.

JM: The cyber­crim­i­nals don’t stand still and the threats are evolv­ing. It’s crit­i­cal to address this oper­a­tional risk, which has grown because of remote work­ing induced by the pan­dem­ic. As an ecosys­tem, the finan­cial ser­vices sec­tor needs to work togeth­er and keep re-eval­u­at­ing threats. It’s often hard to explain the chal­lenge to var­i­ous parts of the busi­ness, so I like to use the anal­o­gy of build­ing a house from scratch and for­get­ting the elec­tric­i­ty. We must embed secu­ri­ty from the out­set. Of course, it’s more expen­sive to knock the house around after it is built to make fix­es, but this is the issue organ­i­sa­tions with lega­cy chal­lenges face.

JS: When I joined Metro Bank as CISO in 2019, I had two key areas of focus: ensur­ing our sys­tems and plat­forms were in a defend­able state, through patch­ing and con­trols; and improv­ing the vis­i­bil­i­ty of the net­work. A new secu­ri­ty oper­a­tions cen­tre pro­vides vis­i­bil­i­ty in one place of our end­points, our net­work and on our bound­ary points. We’re grad­u­al­ly lay­er­ing into this appli­ca­tion-lev­el feeds so we can see the busi­ness results. That gives us a much bet­ter abil­i­ty to spot and react cor­rect­ly to sus­pect­ed cyber events.

JP: There is no doubt the cyber arms race is accel­er­at­ing. Cyber­se­cu­ri­ty has moved from a very opaque top­ic to a con­ven­tion­al busi­ness chal­lenge for boards now. There is a tri­par­tite nego­ti­a­tion between con­sumers, firms, and reg­u­la­tors and the gov­ern­ment sec­tor to under­stand what’s accept­able. Giv­en the tsuna­mi of recent head­lines, peo­ple are becom­ing accus­tomed to it, but we have to work out togeth­er what “good” cyber­se­cu­ri­ty looks like. I sense we have start­ed a more mature con­ver­sa­tion about breach­es and that’s an encour­ag­ing sign.

What are the lead­ing cyber threats for the finan­cial ser­vices sec­tor and the best tools to com­bat cyber­crime?
DG: It’s worth bear­ing in mind 80% of breach­es are a result of weak pass­words or stolen cre­den­tials. So it is cru­cial to improve cyber hygiene, secrets man­age­ment and vis­i­bil­i­ty over the end­points. Also if you’re using an iden­ti­ty plat­form, which every bank does, cyber­se­cu­ri­ty defence is not a sil­ver bul­let. It requires a com­pre­hen­sive strat­e­gy. It’s like hav­ing spokes on a bike wheel, things like two-fac­tor authen­ti­ca­tion, enter­prise pass­word man­age­ment, sin­gle sign-on solu­tions and end­point secu­ri­ty all must fea­ture. The key to bet­ter pro­tect­ing the organ­i­sa­tion is to link all these prod­ucts.

JM: We have to deal with third-par­ty and sup­ply chain cyber risks and as a sec­tor this is prob­a­bly one of the least mature areas and where inno­va­tion is need­ed. The crim­i­nals are smart and they will go for your weak­est point. How­ev­er, work­ing with small­er busi­ness ven­dors, who might not have sig­nif­i­cant cyber­se­cu­ri­ty, is essen­tial. We must be proac­tive and work to pro­tect the whole ecosys­tem. We should move away from the term cyber “basics”; I pre­fer to call them “fun­da­men­tals” because they are not easy but crit­i­cal. You have to have a lay­ered approach to the con­trols and work with oth­er CISOs in the sec­tor to keep pace with the threat land­scape in which we oper­ate.

JS: We are mov­ing to a cloud-first pol­i­cy because it pro­vides flex­i­bil­i­ty, enables us to inno­vate at speed and has greater scal­a­bil­i­ty, while offer­ing good secu­ri­ty. More than that, it is pos­si­ble to tap into anony­mous­ly shared cyber threat data in the cloud, which is mas­sive­ly pow­er­ful. Com­par­ing our envi­ron­ment with what is going on in oth­er banks is a step-change for cyber­se­cu­ri­ty.

JP: The under­ly­ing ques­tion is: does the busi­ness have the capa­bil­i­ty to spot threats, pre­vent them where we can, and detect and respond to every­thing else? The response piece has come to the fore recent­ly and here cri­sis exer­cis­es are game-chang­ing. They can help bring to life the cyber threats for busi­ness­es. With eth­i­cal hack­ing tests, you see vis­cer­al respons­es from non-tech­ni­cal employ­ees. As a CISO, I have to help peo­ple join togeth­er all the dots to form a pat­tern that boosts cyber­se­cu­ri­ty.

What should finan­cial ser­vices do to inno­vate and digi­tise secure­ly?
JM: As a sec­tor, we need to elim­i­nate the idea that the IT depart­ment is full of secu­ri­ty dinosaurs who say “no” to every­thing. We are enablers, not block­ers. The role of the CISO isn’t just to find secu­ri­ty loop­holes; it’s about how you can man­age risk to an accept­able lev­el.

JP: To reduce infor­ma­tion asym­me­try and make our cus­tomers bet­ter under­stand the risk, I would love to see us all work more with the cyber-rat­ing agen­cies that make cyber threats vis­i­ble and under­stand­able. There is an oblig­a­tion to con­tin­ue work­ing towards that and find­ing ways to artic­u­late an organisation’s risk appetite as a sec­tor. We have to gov­ern the gap between where we want to be in terms of secu­ri­ty and where we are. Bridg­ing this with reli­able and trans­par­ent infor­ma­tion will help me sleep bet­ter.

JS: I think there needs to be inno­va­tion around API secu­ri­ty. Finan­cial ser­vices is def­i­nite­ly one of the sec­tors where that bal­ance between secu­ri­ty and open­ing up data is vital. Those of us in retail bank­ing or wealth man­age­ment deal with areas of people’s lives that are intense­ly pri­vate for them and we need to respect this in the way we look after their data. But equal­ly, we can make people’s lives eas­i­er if we’re shar­ing infor­ma­tion between one prod­uct line and anoth­er, and we can offer them prod­ucts and ser­vices that bet­ter suit their require­ments. So again, we can man­age risk and fraud across the sec­tor bet­ter if we share that kind of infor­ma­tion.

DG: It’s imper­a­tive to make sure you under­stand how your ven­dors are trans­act­ing with your sys­tems and the libraries that are includ­ed when you talk about tech­nol­o­gy and firmware updates. Because we’ve seen a lot more in terms of sup­ply chain attacks and accessed library files. When I speak with CISOs in the finan­cial ser­vices sec­tor, a com­mon thread is around iden­ti­ty and access man­age­ment. Now CISOs in this sec­tor and oth­ers are deal­ing with a lot of threats and dis­parate solu­tions. For those look­ing to improve cyber­se­cu­ri­ty, one word com­mon­ly comes up and it’s “vis­i­bil­i­ty”.

For more infor­ma­tion please vis­it keeper.io/protect

Spon­sored by

Keep­er Secu­ri­ty