5 Cybersecurity Challenges That Banks Have to Overcome

The banking and finance sector is a top target for cybercriminals. What will happen if a bank or other crucial platform is attacked and shut down, preventing consumers from accessing their accounts?

Extensive technological and financial connections throughout the financial sector can speed up an attack’s ability to propagate throughout the entire system, potentially leading to widespread disruption and loss of confidence. Financial stability is clearly threatened by cybersecurity.

The banking cybersecurity environment

According to Verizon Data Breach Investigations Report 2022, external threat actors account for 73% of the data breaches, while internal actors are responsible for the remaining 27%. The IBM Cost of Data Breach 2022 report indicates that the financial and banking sector was the second most impacted sector, only second to healthcare, with the average data breach cost rising to $5.97 million.

Despite the expanding threat environment, a recent IMF survey of 51 countries found that most financial supervisors among emerging and developing economies still need to introduce cybersecurity regulations or build resources to enforce them. 42% lack dedicated cybersecurity or technology risk management policy, and 68% need a specialized cyber risk team in their supervision department.

Governments and transnational institutions rush to develop and enforce regulations and directives to safeguard financial and banking organizations from mounting cyber threats. For example, the EU recently enacted the Digital Operational Resilience Act (DORA), which requires banks to include cyber risk management processes within their business risk management policies. The framework shifts the focus from guaranteeing financial soundness to ensuring banks can maintain resilient operations through severe operational disruption deriving from cyber security and IT issues.

Banks and financial institutions face five critical cybersecurity challenges to remain resilient.

1. Evolving and proliferating threats

As the world becomes more digital, banks should anticipate more significant vulnerabilities. As more systems and devices are connected, targets expand. Fintech businesses that rely extensively on new digital technology can increase the financial sector’s efficiency and inclusiveness while also making it more susceptible to security dangers.

Cyberattacks have become more frequent as geopolitical tensions have increased. There are risks everywhere, and the perpetrators’ intentions are frequently ambiguous. The spread of disruptive malware has been shown to have adverse global effects.

Finally, attacks are more likely to have systemic effects when users rely on typical service providers. The concentration of threats for frequently used services, such as network operators, cloud computing, and managed security services, could affect entire industries. Losses may be severe and even fatal.

2. Consumer expectations and compliance requirements

Financial institutions face strict expectations from regulators and consumers alike.

Regulators require that financial institutions meet a patchwork of compliance regulations and standards around security and privacy. The financial sector is a heavily regulated industry; GDPR, PCI DSS, PSD2, DORA, and SOX are some regulations banks must comply with. Unfortunately, this array of regulations adds complexity and friction since conflicting requirements make it more difficult for financial institutions to chart a clear course.

On the consumer side, customers expect omnichannel experiences and more outstanding capabilities from their online accounts. Experience must balance with security since customers expect their banks to safeguard their personal and financial data. Lack of data protection and poor user experience sets companies up for serious reputation consequences if they disappoint consumers by suffering a data breach or failing to innovate service offerings.

3. Outsourcing technology increases liability

Many financial institutions rely on partnerships to reduce costs and comply with regulations. They tend to outsource IT infrastructure and partner with managed service providers to get security services. However, although you can outsource services, you cannot outsource risks and liabilities (at least not all).

Security is as strong as the weakest chain in a densely interconnected and dispersed business landscape. What happens if that weakest point is your partner? Often, these partners have access to critical systems and data. If your partner is attacked, their vulnerabilities become your risks and liability. Banks must focus their efforts on having visibility of their partners’ posture to limit the possibility and the impact of a data breach.

4. The human element

The biggest threat to a banking institution might be already inside the organization. Security firm Cyberhaven defines “insider threats arise when an organization’s trusted users abuse or misuse their access to sensitive information and assets.”

According to the Ponemon Cost of Insider Threats 2022 report, 56% of insider incidents relate to negligence, 26% of incidents were because of a malicious insider, and 18% were attributed to credential theft due to a phishing campaign. Financial services mostly suffered from insider threats, followed by services and manufacturing.

Insider threats are pernicious because they come from the inside, where threat mitigation tools aren’t usually searching. Insider threats go undetected for a long time, causing significant harm. Attempts to monitor behaviors related to insider threats through stricter security policies can backfire by decreasing employee satisfaction and productivity, while these policies may also violate privacy and civil rights.

5. Digital currency and crypto-threats

A recent survey by IMF and Atlantic Council highlights the emerging threats resulting from the idea of a central bank digital currency (CBDC). According to Atlantic Council GeoEconomics Center research, 105 nations and currency unions are actively considering setting up a CBDC.

But cybersecurity and privacy concerns loom as more countries launch CBDC pilot projects. Federal Reserve Chair Jerome Powell highlighted “cyber risk” as his first worry about financial stability. A recent UK House of Lords report described cybersecurity and privacy risks as potential reasons for not developing a CBDC.

Criminals could compromise a country’s financial system by exploiting CBDC weaknesses. CBDCs may amass sensitive user and payment information in previously unheard-of quantities. In the wrong hands, this information could be used to steal money, gather information about people and organizations critical to security, and monitor citizens’ private transactions. A CBDC might significantly increase the breadth and size of many security and privacy issues currently in the financial system if deployed without the proper security standards.

Financial institutions and regulators must prepare for heightened cyber threats and potential successful breaches by prioritizing their actions, including developing a cybersecurity strategy, focusing on business resilience, ensuring that regulations and supervision can effectively promote resilience, following cyber hygiene established best practices, and sharing information among stakeholders to a better response against attacks.