Financial services need to get back to cyber-security basics
Financial services need to get back to cyber-security basics

Cyber-security was definitely a hot topic in 2017, as numerous global cyber-attacks dominated the news particularly weaponised malware in the form of WannaCry and NotPetya. And still, at the start of 2018, this topic remains securely in the spotlight. 

This comes as no surprise as the cost of last year's global cyber-attacks cost organisations an average US$11.7 million (£8.3 millon), according to research from Accenture, so at this rate businesses can't afford to be lax with their cyber-security measures. If organisations don't take action, cyber-criminals will continue to line their pockets. 

Financial companies in particular are increasingly targeted by cyber-criminals due to the greater financial reward. For example, according to the BBC one's WatchDog, over £300 million is stolen through bank account fraud each year, affecting numerous customers worldwide. As well as this according to the Ponemon Institute, the cost per capita of a data breach in the financial industry is the second highest after the healthcare industry. These threats haven't gone unnoticed by Financial Services organisations themselves – according to new research from Invotra, sophisticated cyber-threats are the biggest technology-based fear for the financial sector in 2018. So, as the new year begins, what steps should organisations take now to protect their businesses and customers? 

Take a layered approach 

Due to the new and innovative ways in which cyber-criminals work there is never going to be a blanket approach to cyber-security. Cyber-crime is an ever-evolving threat; the availability of easy-to-use exploit kits online, which come with pre-written code and regular updates, means even the most inexperienced hackers can plan a cyber-attack. To tackle this, organisations need to employ a layered cyber-security approach – this includes the typical implementation of defensive and preventative technology combined with an educational programme targeting your employees in order to reduce the impact of attacks which specifically target users.   

Patching up the holes 

Even with a layered approach in place, organisations need to make sure that “the basics” are covered and this largely comes down to regular patching. Software is inherently vulnerable; thousands of lines of code are all written by humans, so human error is going to occasionally cause security issues.  Patching software fixes or improves holes within computer programs by updating software and its supporting data. Patching is not just a requirement for physical devices but also virtual devices, such as data which is held on the cloud.

To help ensure safe processes, businesses need to be running the latest updates and automated patch management is the ultimate insurance, and a crucial part of a layered defence against security. Furthermore, organisations need to create baselines bespoke to their needs - these tested baselines provide reassurance that a rogue patch can't inadvertently break the system, and they retain the power to detect and plug vulnerabilities. Unpatched programs are like an unlocked door to cyber-criminals, allowing them to easily break in and cause chaos inside the network itself, so it's important that they are securely patched up.

Delegation through automation 

Unfortunately, the issue with manual patching is that it is very time consuming and vulnerabilities can be missed due to human error. Organisations can combat these issues by delegating the task to technology. Automated solutions scan systems for missing patches and deploy patches all without the need for human interference. They then provide cyber-security teams with full visibility through real-time reporting - this feature is particularly valuable for adhering to the upcoming General Data Protection Regulation (GDPR), which requires in-depth reporting. Automation allows staff to more strategically utilise their time on business issues, while the organisation remains protected against the exploitation of vulnerabilities.  

ICE: case study 

The International Currency Exchange (ICE) is one of the largest retail currency exchange operators in the world, with 400 offices globally. For ICE, regulatory compliance and security are absolutely critical to continued, successful business operations. 

ICE has previously relied on multiple technologies for cyber-security, including Microsoft Windows Server Update Services (WSUS) for automatic patching of updates, hotfixes and service packs. However, when ICE began working towards the Payment Card Industry Data Security Standard (PCI-DSS) accreditation in 2012, they needed to prove observance to secure systems through vulnerability management processes. Adherence was essential not only for regulatory processes but also because it would assist the security of processing card payments and reduce occurrences of card fraud in currency transactions, while still protecting cardholder data.  

A more granulated and automated method for operating system software and third-party applications, combined with a higher-grade reporting on patch deployment was required. Furthermore, because they have such a small IT team, ICE needed to reduce the time dedicated to patch management so the team could spend more time proactively working. By employing a single automated platform, which offered multiple benefits – such as easy deployment and detailed reporting – ICE have reduced the time taken to fully patch systems by around 90 percent.

Getting back to the basics and delegating by automation can improve an organisations' cyber-security, ensuring that the financial services sector has a fighting chance against the cyber-criminal army coming their way this year. 

Contributed by Simon Townsend, CTO, EMEA, Ivanti.

*Note: The views expressed in this blog are those of the author and do not necessarily reflect the views of SC Media UK or Haymarket Media.