Ricardo Ferreira, EMEA Field CISO, Fortinet, examines industry trends and cyber-risk management in the banking sector.
Changes in the banking sector associated with new digital initiatives have ushered in unprecedented cybersecurity risks. As highlighted in recent reports, key activities in the financial ecosystem can be disrupted by cyber incidents, so risk management and secure network protocols are paramount. With cybercriminals relentlessly pursuing financial gain, data breaches have become more frequent and sophisticated, underscoring vulnerabilities in the banking sector.
Regulatory approaches, such as EU DORA, G7 and reports from other central banks and regulators, emphasise the critical importance of cyber-resilience in the banking sector. These regulations are reactive measures to past threats and proactive strategies designed to anticipate and mitigate future risks. Characterized by continuous digitisation, increased third-party dependencies and geopolitical tensions, the evolving cyberthreat landscape demands a robust response from financial institutions.
Central Bank Digital Currencies (CBDCs) add another layer of complexity. As CBDCs gain traction, they present both opportunities for financial inclusion and challenges in terms of cybersecurity.
In this competitive landscape, where traditional banks, financial technology disruptors and digital-native challenger banks strive for market share, delivering a seamless digital experience is crucial. However, institutions must not lose sight of potential vulnerabilities as they race to innovate. Embracing digital technologies is essential, but so is ensuring that these technologies are safeguarded against ever-evolving threats.
Increasing Cyber-risks for Banks
As banks and financial services providers continue to grow and innovate, a holistic approach to cybersecurity informed by the latest regulatory insights and threat intelligence will be crucial to ensure sustainable and secure progress.
Cybersecurity in Banking
In the rapidly evolving digital landscape of banking, cybersecurity teams are at the forefront of a complex battle. The financial sector is particularly vulnerable to cyberthreats, including significant data breaches. The financial sector is a favourite target for attacks seeking financial gain, trade secrets, or service disruptions that bring publicity to social or political causes. In fact, financial and cybercrimes are now top global policy concerns, according to a new INTERPOL report.
Depending on the severity of the attack and the specific bank in question, a single successful breach can lead to serious damage to the brand. According to the European Union Agency for Cybersecurity (ENISA), more than 10 terabytes of data are stolen monthly and more than 60% of organisations may have paid ransom demands. Another report states that 2022 was the biggest year ever for crypto hacking.
As digitisation becomes an even greater necessity across the banking industry and security risks increase, executive teams need to ensure the resiliency of their business operations, compliance with government and industry regulations and the effectiveness of their cybersecurity infrastructure to protect the expanding attack surface.
Financial services providers must defend against an onslaught of data breaches, ransomware, malware, phishing and social engineering attacks growing in sophistication, frequency and intensity. The challenges of fending off threats increase as the attack surface expands in breadth and complexity. In its 2023 Global Cyber-risk Outlook, Moody’s states that regulators and insurers are taking actions to reduce financial exposure to cyberattacks and at the same time, demand for cyber insurance will outweigh supply.
The Value of Cybersecurity for the Banking Sector
To remain competitive and resilient in this environment, financial institutions must continue to innovate and ensure that those innovations are secure. This dual mandate becomes even more challenging given the expanding attack surface, driven by the rise of digital banking, FinTech disruptors and the introduction of CBDCs and the modernisation of their core systems. Key cybersecurity imperatives for banking include:
• Visibility: Maintaining comprehensive network visibility is paramount with the proliferation of mobile banking, IoT integrations and cloud deployments. As the cyberthreat landscape becomes more intricate, having clear oversight of all network activities is crucial to prevent data breaches and manage cybersecurity risks.
• Automation and operational efficiency: The era of siloed security solutions is fading. Modern cybersecurity demands integrated solutions that can automate tasks, reducing the need for manual configurations and constant monitoring. Implementing “policy as code” can further streamline this process, ensuring that security policies are consistently and automatically enforced across a secure network.
• Flexibility: The diverse IT architectures, spanning multi-cloud and on-premises deployments, necessitate agile security controls and policies. As financial institutions navigate the complexities of Digital Transformation, their security solutions, including policy as code practices, must be adaptable, ensuring that security policies align seamlessly with infrastructure changes.
• Compliance reporting: Regulatory compliance is not just a checkbox exercise. With central banks and other supervising authorities emphasising cyber-resilience regulations, security teams must strike a balance between adhering to these regulations and proactively defending against cyberthreats. Utilising policy as code can also aid in ensuring compliance by codifying and automating policy checks.
Lastly, the human element cannot be overlooked. Beyond state-of-the-art technology, financial institutions need skilled professionals who can harness the potential of new platforms and systems. The limited availability of specialists in niche areas and a potential knowledge gap in understanding intricate products, processes and systems pose additional challenges.
To that end, Fortinet maintains one of the largest and broadest training programs in the industry and made the public pledge to train 1 million people by 2026 to help close the cybersecurity skills gap. To reach this goal, Fortinet is increasing access to cybersecurity training for security professionals, students, women and veterans. The Fortinet Training Institute has engaged with more than 549 academic partners with 38 education outreach partners composed of organisations and nonprofits focused on women, veterans and underserved populations. Other strategic partnerships include working with the World Economic Forum to deliver our training curriculum through the Cybersecurity Learning Hub.
As the banking sector continues its digital journey, a holistic, informed and agile approach to cybersecurity, adopting and succeeding at digital initiatives to converge network and security, reskilling the workforce and driving automation will be the linchpins of success. Ensuring a secure network and effective risk management in the face of potential data breaches and evolving threats is paramount.
Cybersecurity Regulatory Impacts
Although the banking sector is a beacon of financial stability, it is increasingly grappling with dual challenges: ensuring robust cybersecurity and adhering to evolving regulations. As financial institutions strive to meet customer demands and counteract cybersecurity risks, they are simultaneously navigating a labyrinth of stringent data privacy and security regulations. These regulatory measures, coupled with the expanding digital landscape, have inevitably escalated operating costs, particularly in the realms of compliance for both retail and corporate banks.
The imperative for heightened security and compliance in banking is underscored by the need to protect sensitive personal data, maintain transactional integrity and safeguard the health of national and global economies. Yet, a recent International Monetary Fund (IMF) survey paints a concerning picture of the regulatory landscape. Covering 51 countries, the survey revealed:
• 56% of central banks or supervisory authorities lack a dedicated national cyber strategy for the financial sector.
• 42% lack specific cybersecurity or technology risk-management regulation and a staggering 68% do not have a specialised risk unit within their supervisory department.
• 64% have not mandated testing or provided guidance on cybersecurity measures.
• 54% do not possess a dedicated regime for reporting cyber incidents.
• 48% are without specific regulations addressing cybercrime.
While these statistics might paint a bleak picture, it’s essential to view regulatory and security requirements not as hindrances but as catalysts for innovation and risk management. For example, McKinsey highlights the potential of data analytics in banking, suggesting that it can lead to risk-reduction savings valued at up to $1 billion annually for some large banks. These savings encompass reduced fines, enhanced compliance reporting accuracy, improved management of sensitive data and the mitigation of various other risks.
As the banking sector continues its digital evolution, striking a balance between innovation, cybersecurity risks and regulatory compliance will be pivotal. Embracing this triad can unlock unprecedented opportunities, ensuring a secure, compliant and forward-looking financial landscape.
Cybersecurity Risk Management for Banks
Cyber-risk management in today’s banking landscape extends beyond technical measures to encompass a holistic, organisationwide approach. However, many institutions grapple with limited tools to gauge cybersecurity risks, especially when integrating new digital partners and technologies.
Recent regulations emphasise operational resilience, advocating for a globally aligned risk management framework. This international convergence seeks to standardise practices, reducing fragmentation. A notable aspect of these regulations is the scrutiny of third-party providers, given their growing significance in the financial ecosystem.
While banks are traditionally cautious in IT vendor selection, the rise of innovative start-ups offers a number of promising solutions. Yet, this openness must be balanced with due diligence, especially when third-party relationships can introduce cybersecurity vulnerabilities. As banks evolve digitally, a harmonized approach to risk management that considers global regulations and third-party integrations is essential for a secure and progressive banking sector.
Banking Cybersecurity Challenges
Historically, banks have operated as siloed entities. Distinct departments, each with unique objectives, often rely on separate systems. This fragmented approach has inhibited growth, restricted scalability and diminished customer satisfaction. Traditional banks, particularly, have garnered a reputation for cumbersome processes, especially when customers seek new services or support. Implementing a unified platform that centralises data and bridges the gap among various systems can effectively counteract the challenges posed by these silos. However, information silos also amplify cybersecurity risks, data breaches and compliance concerns beyond operational inefficiencies, which are all pressing issues in today’s banking landscape.
The integrity of the IT infrastructure and the vast amount of data it houses remain a paramount concern in banks’ Digital Transformation journey. Addressing technical debt is crucial. This debt is often a byproduct of historical underspending and the juxtaposition of modern technologies atop outdated infrastructure. To navigate these challenges, banks should establish dedicated units or expert teams focused on innovating and ensuring that their offerings remain competitive. Assigning clear responsibilities for these innovation projects is pivotal.
Gone are the days when IT security in banking was a linear affair. Today’s banking ecosystem comprises tens or even hundreds of thousands of interconnected devices ranging from computers to Internet-of-Things (IoT) integrations. And when the proliferation of social, cloud and mobile channels is factored in, the potential attack surface for data breaches and cybersecurity risks magnifies exponentially. The pressing question remains. How can banks ensure a secure network amid such vast complexity?
Although the need for financial organisations to embark on digital initiatives is essential, it accentuates the need for scalable security and compliance solutions. As banks evolve, the scalability offered by Software- As-a-Service (SaaS) solutions becomes indispensable, especially in the retail banking sector. Organisations must ensure that risk management remains agile and responsive to the ever-expanding digital landscape.
Fortinet Secure Networking Solutions for Financial Organisations
Whether an organisation has cutting-edge or legacy technology, infrastructure vulnerabilities can become prime targets for cybercriminals. As these adversaries relentlessly exploit weaknesses, financial institutions face the potential for significant financial losses, operational downtime, brand damage and regulatory fines. Financial leaders must prioritise the resilience and overall health of their institutions.
Financial institutions should consider converging networking and security into a single secure networking solution to address these challenges. They can apply consistent threat intelligence and security services by consolidating disparate point products into an integrated cybersecurity platform. Key features of an ideal security solution include:
• Visibility: Comprehensive oversight across the entire digital attack surface
• Advanced protection: Defence mechanisms against threats that are growing in volume and sophistication
• Intelligent integration: Seamless integration within a smart IT architecture
• Automation: Leveraging technology to address the shortage of skilled human talent
• Simplified compliance: Streamlined processes to ensure adherence to data privacy regulations
• Fortinet Secure SD-WAN ensures network traffic is securely transmitted across multiple connections, bridging branches and headquarters. Eliminating the need to route all traffic through a central data centre for inspection it prevents bottlenecks and latency, crucial for Business Continuity. This approach enhances network performance and reduces risks, especially in dispersed environments like cloud and on-premises setups.
Fortinet SD-Branch: Security and Performance Combined
Fortinet SD-Branch offers a unified solution for remote locations, combining networking and security capabilities. Administered from a single FortiGate Next-Generation Firewall, this solution integrates FortiSwitch switches, FortiAP wireless access points and the FortiExtender LTE WAN extender. The FortiNAC network access control solution further ensures full visibility and control over IoT devices at the network edge.
Fortinet Secure SD-WAN and SD-Branch fortify branch network security, making it challenging for adversaries to exploit vulnerabilities. By integrating networking and security into a centralised system, they offer a robust defence mechanism, ensuring Business Continuity and risk reduction across diverse environments.
