Cyber Security and Risk Mitigation Go Hand in Hand

Cyber Risk means different things to different people in an organization. Deloitte distinguishes it well: A CEO might worry about the expected financial loss related to cyber risk exposure; while the CFO is challenged to show the value of security while managing the associated costs. The CMO might worry about the impact to the brand if a breach to the company occurs; while the CISO is thinking about which key initiatives to prioritize to maximize risk buy down.  But one thing that savvy executives agree on is that cyber security is a business risk that should be included in corporate risk mitigation strategy and processes.

Cyber Risk Mitigation focuses on the inevitability of disasters and applies actions and controls to reduce threats and impact to an acceptable level.

Lisa Lee, Chief Security Advisor for Financial Services in Microsoft’s Cybersecurity Solution Group,  partnered with Circadence in April 2020 to talk about this topic in a webinar.  Originally broadcast for a financial risk mitigation audience, the practical advice Lisa offers in 6 areas of cyber risk mitigation is broadly applicable.

Cyber Risk Insurance

Insurance can help to reduce the financial impact of an incident, but it does NOT mitigate the likelihood of a cyber breach happening – in the same way that having car insurance helps with the financial consequences of an accident but cannot in anyway prevent an accident from occurring.

Identity and Access Management

Microsoft recommends making “Identity” the security control plane. Employees use multiple devices (including personal devices), networks, and systems throughout their lifecycle with a company. The explosion of devices and apps and users makes security built around the physical device perimeter increasingly complex.  At the same time, access to on-premise systems and cloud systems are shifting to transform to meet business needs.  Partners, vendor/consultants, and customers might also all require varying degrees of access.  A strongly protected, single user identity at the center of business for each of these constituents can exponentially improve the efficiency and efficacy of the overall security posture of the company.

Configuration and Patch Management

This is IT or cyber security 101.  Everyone should be doing it on a consistent basis.  But  20% of all vulnerabilities from unpatched software are classified as High Risk or Critical. The Center for Internet Security  is an excellent resource for more information on best practices.

Asset Protection (devices, workload, data)

There is a massive amount and diversity of signal data coming in from the network and there are many tools on the market to help assist in the collection, management, and assessment.  Lisa advised not to spend too much time trying to evaluate and select the best of breed tool in each category.  Rather, find a suite that works well together so that you don’t have to spend time on integration. Beyond devices, also consider your security policies and practices to ensure visibility for workloads across on-prem, cloud, and hybrid cloud environments.  And finally, consider protecting the information directly so that wherever data elements go, even outside the company, they carry protection with them.  The key to this is encryption.

Monitoring and Management

These two concepts are seemingly more about  ‘risk management’ vs. ‘risk mitigation’.  But monitoring helps you to ‘know what you don’t know’ in order to adapt and improve mitigation strategies.  And today, many of the monitoring tools from Microsoft and other vendors have features that enable cyber analysts to take action, i.e analysts can use the same tool that helps identify a vulnerability to then resolve it.

Cyber Security Training

Security is an ever-changing situation because bad actors are always developing new attacks.  Therefore, training and education is an ongoing requirement for cyber professionals.  Circadence’s Project Ares is a cloud-based learning platform specifically designed for continuous cyber security training and upskilling.   IT and cyber organizations that invest in on-going training for their people are making as strong an investment in mitigation as in the tool stack that the analysts use on-the-job.

With consideration in all 6 of these areas, you will be able to architect and compose a comprehensive cyber mitigation strategy.

Here’s a link to the full webinar.  It’s only 45 minutes long and Lisa provides more detail in each of these categories.

Great Dance Partners: How Cybersecurity and Risk Mitigation Go Hand in Hand

 

Photo by Toa Heftiba on Unsplash

Why Cyber Risk Mitigation is a Priority for Finance Leaders

The role of the CFO is evolving. Whether at a bank or credit union, today’s finance leaders wear many hats. One of which is a cyber security ‘hat’. Constant breaches within financial institutions warrant such a ‘wardrobe’. Insider threats are growing, outside adversaries are multiplying at rapid pace, and attacks on financial departments and companies are ever-increasing. Unfortunately, classic security controls like firewalls and antivirus are easily compromised as attackers become more sophisticated.

As threats increase, risks to businesses increase—and for CFOs and VPs of Finance, defining an adequate budget to account for those cyber risks and allocating proper resources is of the utmost importance to protect companies and its clients. Finance leaders are no longer siloed to reviewing financial statements and spreadsheets—their role extends far beyond the numbers to include cyber security.

Some CFOs may not be comfortable with this change but the reality of cyber security today mandates involvement from the CFO/VP of Finance to develop a cyber readiness strategy. Why are finance leaders critical to the cyber security conversation? Because many CFOs need to address and mitigate the business risk concerns of the C-suite , board , and investors (not to mention continuing to improve the ‘financial health’ of the company).

Any sort of digital compromise to a financial services company, results in damaging monetary and reputational outcomes that directly impact the financial function of the organization.

Hence why cyber risk mitigation is and should continue to be a critical priority for CFOs today. And for many, it already is: According to a 2019 study from Protiviti, 84% of global CFOs and VPs of Finance cited security and data privacy as a high priority[1] for them. Many CFOs are already taking the reins of the cyber security challenges to get ahead of looming risks and imminent vulnerabilities. How? By taking a more active role in defining cyber security strategy in a way that effectively hardens posture while ensuring company growth.

As such, the typical CFO responsibilities listed below, are only a part of many to come:

  1. identifying and monitoring risks of critical assets to protect company/client data
  2. ensuring critical infrastructure operations meet regulatory requirements
  3. contributing to the optimization of digital asset access and utilization to safeguard against attackers

That third responsibility may seem a tad ‘out of the norm’ for a CFO. Typically a CIO or CISO might be in charge of that objective. But as more financial services companies respond to digital transformation demands, data becomes a critical asset to protect. Much of that data “lives” on the devices that company employees use every day. CFOs should have a general awareness of who has access to what, where, and when and be aware of the policies in place that enforce security at all levels.

Since data is a valuable company asset, the CFO’s responsibility to ensure the financial ‘health’ of the company becomes much more complex as cyber security asset and risk management becomes a top priority. Security Boulevard writes “A modern CFO will have an excellent grasp on how an organization manages cyber security and will be able to ask the right questions.”[2] We agree!

For CFOs to make cyber security a priority, they are having to work across many lines of business within their organizations to contribute to the construction of a holistic cyber security program that has full buy-in from all employees (leadership/C-Suite included).

Further, CFOs bring a unique perspective to the ‘building a culture of cyber security’ conversations as they are extremely committed to helping the company grow. While CFOs may not be cyber security experts, they do have a unique take on how and what solutions to invest in that will maximize the potential for company growth over time.

By working hand-in-hand across departments like IT and legal, CFOs and finance leaders can develop a holistic cyber security plan that goes beyond merely ‘evaluating cyber insurance coverage’. A huge part of strategic cyber planning includes understanding what current companies are doing to mitigate cyber risk. Foundational elements need to be established first.

While cyber insurance is a good start, other measures need to be taken to ensure that companies are not just reacting when threats occur, but instead, are taking proactive measures to get ahead of threats before they hit. A proactive approach should also include the adoption of a persistent cyber security training program to support frontline defenders who are doing the day-to-day defense against ambitious yet malicious adversaries.

With the right cyber security training in place, teams can be assessed on their abilities to identify and mitigate risks before they happen, while supervisors (e.g. CISOs) can glean insight into how teams are responding and areas for improvement. This intel can translate upward to the CFO who will need to know the risks associated with gaps in cyber security response.

 

Check out our webinar:
Great Dance Partners: How Cyber Security and Risk Mitigation Go Hand-in-Hand.

[1] https://www.cfodive.com/news/cybersecurity-is-latest-cfo-domain-study-finds/567056/

[2] https://securityboulevard.com/2019/08/is-it-critical-for-cfos-to-understand-cybersecurity-2/

Photo by Carlos Muza on Unsplash

CISOs, Strengthen Your Cybersecurity Posture with These Resources

There is a hacker attack every 39 seconds. The average cost of a data breach in 2020 is expected to exceed $150 million. And by 2021, there will be more than 3.5 million unfilled cybersecurity jobs worldwide. No enterprise is safe from an attack.  

Because of that, CISOs realize as they evolve business operations to better serve customers, such progression has unintended security consequences and compromises. With strapped resources (both human and financial), how can CISOs in commercial sectors DO MORE to up their cybersecurity posture WITH LESS? The answer lies in the human-power to control systems, processes, and technologies.   

CISOs in every industry realize technologies and “one-and-done traditional training” cannot keep companies safe—but with the properly skilled individuals taking the reins to leverage those technologies optimally, the human-side of cybersecurity can minimize the skills gap and frequent attacks.  

Resource Roundup 

We’ve taken the liberty of publishing several articles to help CISOs “do more with less” to strengthen their cybersecurity posture. We understand you’ve spent lots of time and resources developing your teams. And they’re doing the best they can with the resources they have. Still, to amplify their success, ongoing training can help—and we hope these articles help, too.   

  1. Help wanted: Combatting the Cybersecurity Skills Shortage 
  2. Modernizing Cyber Ranges for Professional Learning 
  3. How to Tell if your Cyber Posture is Prone to an Attack
  4. Cybercrime Incidents in the Financial Services Sector 
  5. Why We Can’t Keep Ignoring Cyber Fatigue 
  6. How Continuous Learning Can Help Upskill Cyber Teams 
  7. Why Gamification is the Answer You’ve Been Looking For 
  8. The Benefits of Active Learning in Cyber Training  

Growing Cybersecurity Challenges  

CISOs and their teams are challenged to keep pace with evolving cyber threats due to staffing shortages, resource constraints, strategy misalignment. Not to mention the continuous threat of attacks on industries with interconnected technologies. In fact, 70% of cybersecurity professionals claim their organization is impacted by the skills shortage; With spending expected to exceed $1 trillion between 2017 and 2021 and 74% of C-suite executives failing to involve CISOs the leadership table, this makes the job of the CISO incredibly difficult. That is why Circadence is dedicated to helping CISOs DO MORE WITH LESS—because we understand the arduous uphill climb they face (and will continue to face) if something is not done.   

 

Hungry for more help? Download our 3 A’s INFOGRAPHIC to learn more ways to support your cyber team against imminent threats.

 

There’s Still Time to Up Your Cybersecurity Posture 

If cyber teams cannot upskill and keep pace with evolving threats, commercial sectors will continue to be hacked. Customers will not only lose trust in these institutions that aim to protect them and make their daily lives functional, but they simply won’t be able to operate efficiently, economies will suffer, and more.   

However, for enterprises that have experienced an attack, it’s not too late to invest in cyber training to prevent another. Doing nothing after an attack is the worst possible response. With failure comes opportunity to enhance resiliency on both a company-wide level, as well as at an employee-specific level. Investing in training tells hackers the attack attempt stops at its people first.  

For enterprises that have not experienced an attack, it’s not a matter of “if” but “when” it will occur. Digitalization and limited human resources make company’s front lines vulnerable and appealing to hackers. Now is the time to be proactive and empower cyber teams to train against hackers in a way that doesn’t require time-consuming travel, expenses, and other resources—simply a willingness to learn, grow, and upskill to better the company and themselves.   

Circadence wants to change how cyber professionals prepare for, protect, and defend against evolving cyber threats. We hope these, and future resources will help CISOs and cybersecurity leaders take proactive steps to strengthen their cybersecurity posture by training their teams and their entire organization, without the costly burden of traditional training courses.   

Learning from the Top 5 Financial Cybersecurity Incidents

Banks, credit unions, credit card companies, investment firms, and insurance companies are all under cyberattacks—making financial cyber security a hot topic of discussion. For years, the finance industry has been one of the hardest hit with cybercrime according to Deloitte. And it continues to rank in the top five most vulnerable industries. In 2017, 69 material cyber incidents were reported to the Financial Conduct Authority, an increase from the 38 incidents in 2016, according to Information Age. Financial cyber security regulations are keeping companies in check but the pace at which threats evolve in sophistication requires a persistent approach to stay ahead of hackers.

If you bank online or have an insurance policy, you likely understand the convenience of single keystroke access to financial information. It’s easy, convenient and useful to transfer funds from mobile device to mobile device; electronically sign a form; or get a quote for a mortgage company just by entering in new financial details. Unfortunately, the rapid pace of adoption of new technologies that make these everyday transactions convenient is widening the attack surface for hackers and prompting security professionals to consider even stronger finance cyber security risk management processes.

Financial Cyber Security Incidents

Below are some of the most notable cybercrime attacks on financial services firms that we can learn from in order to take a more proactive approach to cyber security readiness.

Equifax 

The consumer credit reporting agency was breached in 2017, exposing the sensitive personal information of more than 147 million Americans. Partial driver’s license data was the primary data leaked. Equifax representatives said the vulnerability that allowed for the attack to occur was the failure to keep its computer systems adequately up to date.

Bank of Chile

State-backed hackers infiltrated the Bank of Chile’s ATM system in January 2019 and stole $10 million. The cyber heist was deployed via hackers initiating a virus as a “distraction” then prompting banks to disconnect 9,000 computers to “protect customer accounts.” Meanwhile, hackers sneaked in and used the global SWIFT bank messaging service to deploy fraudulent transactions.

India’s Cosmos Bank

Unauthorized users accessed their system and siphoned nearly $13.5 million through withdrawals across 28 countries. Unidentified hackers created a proxy switch that approved all the fraudulent payments.

Lazarus group

North Korea’s hacking operations are targeting financial institutions nationwide—completely indiscriminate of a brand or geographic location. The country is linked to attacks in 18 countries, according to a report from Russian cyber security firm Kaspersky Lab. The hacking operation known as “Lazarus” targeted employees at banks who visited the hackers’ list of 150 specified internet addresses. Experts say the attacks are at a “level of sophistication not generally found in the cybercriminal world,” and companies should take proactive measures to carefully scan their networks for the presence of Lazarus malware samples, disinfect their systems and report the intrusion.

Bangladesh Bank 

Bangladesh Bank experienced a hack in February 2016 that drained $81 million from accounts in a few short hours. Attackers subverted the bank’s SWIFT accounts, the international money transfer system, to get what they wanted, reports Wired magazine. Hackers sent more than three dozen fraudulent money transfer requests to the Federal Reserve Bank of New York asking the bank to transfer millions of Bangladesh Bank’s funds to accounts in the Philippines, Sri Lanka, etc. Reports indicate lax computer security practices were to blame (e.g. lack of firewalls installed on the networks), allowing hackers to easily infiltrate the network and find the credentials needed to proceed. The concept of attacking systems on the weekend isn’t a new approach either—other banks like Tesco experienced the same timing in November 2016 when thousands of current account customers were hit with fraudulent transactions by hackers.

Learning from Financial Cyber Security Incidents

Outdated systems, employee exploitation, weakened network security, and a poor ratio of defenders to hackers all contribute to the severity of these financial cyber security incidents.

These attacks tell us a lot about what preventative steps can be taken. To ensure financial services firms have the latest systems updated and in place requires an experienced cybersecurity team to perform regular system checks and updates.

Financial cyber security compliance leaders need to empower their teams with the right tools and persistent learning opportunities so they can be prepared for any malware infection or system overwrite that occurs.

The increase in reported attacks reflects a greater need for accountability across all financial institutions. As the attack frequency grows, so must our cybersecurity vigilance. Cyberattacks will adapt to defense strategies so financial firms need to ensure they are always one step ahead. The best way to achieve this goes beyond hiring our way out of the issue. Training your cyber workforce proactively using gamified cyber range training to combat the latest threats is the key to sustained success.

For more information on how financial firms can upskill their security workforce
download Project Ares subscription brochure.

Photo by Alexander Mils on Unsplash