BizInsight

CYBER-RISK and resilience breaches are on the rise and, with a corresponding increase in regulation, the threats to an organisation extend well beyond the particulars of any one incident.
Executives and boards have a compelling need to understand and reduce their security and privacy exposure. The greatest assurance a business can have is to know that its information is secure and under control.
Speed of attack increasing, response times lagging: Threat actors are increasingly deploying a wider array of attack methods to keep one step ahead of financial-services firms. As reported in Deloitte Touche Tohmatsu’s 2012 “Global Financial Services Industry Security Study”, many financial-services companies are struggling to achieve a level of cyber-risk maturity required to counter the evolving threats.
Although 75 per cent of global financial-services firms believed that their information security programme was at Level 3 or higher, only 40 per cent of the executive respondents were very confident that their organisation’s information assets were protected from an external attack.
These inadequacies become more apparent when we look at the data. The Deloitte Centre for Financial Services has analysed data from an annual investigative report on data security by Verizon and found that in 2013, 88 per cent of the attacks initiated against financial-services companies were successful in less than a day.
However, only 21 per cent of these were discovered within a day, and even worse, in the post-discovery period, only 40 per cent of them were restored within that one-day time frame.
The speed of attack, significant lag in discovery rates, and longer restoration time highlight the challenges that financial-services firms can face in both detection and response capabilities.
Imperative to be secure, vigilant and resilient:Financial-services firms have traditionally focused their investments on becoming secure. However, this approach is no longer adequate in the face of the rapidly changing threat landscape.
Put simply, financial-services companies should consider building cyber-risk-management programmes to achieve three essential capabilities: the ability to be secure, vigilant and resilient.
Enhancing security through a ‘defence-in-depth’ strategy: A good understanding of known threats and controls, industry standards, and regulations can guide financial-services firms to secure their systems through the design and implementation of preventative, risk-intelligent controls.
Based on leading practices, financial-services firms can build a “defence-in-depth” approach to address known and emerging threats. This involves a number of mutually reinforcing security layers both to provide redundancy and potentially slow down the progression of attacks in progress, if not prevent them.
Improving cyber-security with a ‘secure, vigilant and resilient’ strategy: Traditionally, the focus has been on being secure. However, the evolving cyber-threat landscape may necessitate a shift to a more dynamic approach and well-rounded cyber-security capability.
Secure: Enhance risk-prioritised controls to protect against known and emerging threats, comply with industry cyber-security standards and regulations.
Vigilant: Detect violations and anomalies through better situational awareness across the environment.
Resilient: Establish the ability to quickly return to normal operations and repair damage to the business.
Enhancing vigilance through effective early detection, signalling systems: Early detection, through the enhancement of programmes to detect both the emerging threats and the attacker’s moves, can be an essential step towards containing and mitigating losses.
Incident detection that incorporates sophisticated, adaptive signalling and reporting systems can automate the correlation and analysis of large amounts of information-technology and business data, as well as various threat indicators, on an enterprise-wide basis.
Financial-services companies’ monitoring systems should work 24/7, with adequate support for efficient incident handling and remediation processes.
Transforming to a secure, vigilant and resilient model: How can financial-services firms begin the journey toward establishing programmes to really be more secure, vigilant and resilient, and hence transform their cyber-risk management programmes?
Two important levers can come into play for many such companies as they seek to manage evolving cyber-threats in the long run:
1. Develop actionable threat intelligence in support of a well-rounded capability across all three components of the model.
2. Address the organisational challenges with decisive actions that recognise cyber-security as a strategic business problem, not just an “IT problem”.

Parichart Jiravachara is partner, Enterprise Risk Services, Deloitte.