Earlier this week, it was announced that the number of cyber-attacks against financial services companies reported to the Financial Conduct Authority (FCA) has risen by more than 80% in the last year. Responding to this news, Justin Coker, VP EMEA at Skybox highlights why this has happened, and how financial organisations can improve their cyber resilience.
Justin Coker, VP EMEA at Skybox:
“Financial services have invested heavily in cybersecurity but, as the FCA figures suggest, that’s not deterring attacks or successful breaches. Furthermore, with the FCA calling for financial organisations to have a better understanding of their key assets and be constantly assessing where they are vulnerable, it seems that businesses in this sector do have the necessary building blocks – the required security and asset data, toolsets and people but are struggling to amalgamate these into a slick solution that spits out the correct answers. Often, they are still operating in silos and largely ineffective in joining up this mass of disparate data and analysing it in order to pinpoint exactly where their real exposures lie. Without this valuable insight, it is no surprise they are struggling to prevent breaches from happening.
“The practice of cyber resilience is all well and good, however, if a business doesn’t have a true understanding of their ‘attack surface’, then it becomes an impossible task. IT network visibility (particularly as more organisations are making the transition into virtual and multi-cloud environments and growing their networks) is a basic fundamental task that, worryingly, companies simply don’t have. The bigger issue is that there are known unknowns but also unknown unknowns, and hackers are in the position to exploit both.
“This weakness might be explained by the fact that cybersecurity teams in financial services businesses are struggling to work out how they can best use their limited resources to make sense of the complexity and vast amount of information generated by their security tools. It’s impossible to fix everything, so there is a need to prioritise remediation activities to close down those vulnerabilities and open access paths that pose the greatest risk to ensure that data breaches and attacks are prevented. The real challenge is for financial services firms to completely understand the attack path and fixing it before the bad guy “exploits it”. Ultimately it is a race against time and the slow and steady tactic just won’t work anymore.”
