The likelihood and potential damage of a data breach is now a reality for pretty much all industries, but whilst the changing threat landscape means every organization – large or small, public or private – could be a potential victim of an attack, those in the finance sector still remain the most likely to be targeted by cyber-criminals.
Daniel Dahinden is head innovation & digital at SIX, which operates an infrastructure for the Swiss financial center providing services relating to securities transactions, the provision of financial information and cashless payment transactions.
Dahinden recently spoke to Infosecurity about the current threats affecting the finance industry, strategies for defense and the role of AI in the future.
What are the biggest challenges of protecting data in the finance sector?
The financial services industry is faced with a growing number of ever-evolving cybersecurity challenges. Within the industry – from banks to capital management funds – data is fluid, and often always moving, which makes it a difficult problem to tackle, particularly as threats are everywhere and the nature of them is always changing.
A number of high-profile breaches have taken place in the past year, and the volume of these types of attacks is constantly increasing. In order to overcome this challenge – whether it is tackling simple personal online fraud, or large-scale corporate ransomware attacks – companies need to be deploying effective, large scale cybersecurity programs to protect both internal and customer data.
“Criminals want to go where the money is, making the financial sector one of the largest targets”
How big a target is the finance sector for cyber-criminals?
Cybercrime is at an all-time high, with attacks exponentially on the rise, becoming more sophisticated and commonplace across all industries. However, criminals want to go where the money is, making the financial sector one of the largest targets, being left vulnerable to savvy cyber-criminals.
In fact, according to a study published by the International Organization of Securities Commissions’ (IOSCO) research department and the World Federation of Exchanges, around half of the world’s securities exchanges were the subject of cyber-attacks last year. In 2015, hackers targeted the Banque Cantonale de Genève, then last summer Bosnian cyber-criminals attacked a ‘big bank’ in Zurich.
As it stands, the most common method for cyber-attacks is Denial of Service, which seeks to disrupt websites and other computer systems by overwhelming the targeted organizations’ networks with a significant amount of computer traffic and viruses. However, other forms of theft reported by the group's study were website scanning, data theft and insider information theft.
Interestingly, none of the exchanges reported financial theft as part of the attacks, however, this, and the threat of large-scale systemic damage, is becoming an increasing possibility, as cyber-criminals adopt more complex and sophisticated methods of attack.
What is your advice for defending against cyber-criminals in the finance sector?
Organizations need to be aware of the consequences should a cyber-attack occur. Cyber-criminals are often one step ahead, with attack techniques evolving more quickly than security solutions, so a fast, dedicated approach to securing networks is essential for the financial sector. Cyber-defense systems should regularly be reviewed and updated, swapping old technology for new innovative solutions (such as AI) is a critical step.
In order to prevent data loss, the finance sector needs to be proactively, and aggressively, pursuing a watertight security program. As cyber-criminals get smarter, the cost of attack is expected to grow; whilst there is currently limited data on the costs of cybercrime to securities markets, the estimation ranges between $388bn to $1tn.
“The finance sector needs to be proactively, and aggressively, pursuing a watertight security program”
What role can AI play in the future of securing the finance industry?
Large financial institutions are already heavily investing in cybersecurity defenses and are secure – but are they secure enough? Innovative technology and machine-based learning, such as AI, can help safeguard financial institutions against cyber-threats even further. Intelligent systems can do everything from monitoring all network activity, to analyzing raw data to identifying patterns – all in much quicker time than a human could, if they were processing the information manually.
As an example, SIX opened Switzerland’s first security operations center for the Swiss Financial Market but also for SIX itself, earlier this year. It is built on IBM’s cognitive computing platform and has a goal of helping banks tackle cybersecurity issues, whilst also complying with Switzerland’s strict financial regulations. Logging all network activity, it notifies security analysts at SIX if any suspicious activity occurs – the team then determines how to treat this issue.
In fact, powerful AI engines – such as IBM Watson – can go as far as detecting and flagging suspicious activity and in the near future may also devise defense recommendations too. Financial institutions need to deploy these first-class technologies in order to stay on top of, and ahead of, the changing threats within the cybersecurity landscape. Proactive prevention is essential if finance organizations want to protect their data.