Cyber Risk Management in Financial Services 2016

<p>The threat of a cyber attack has moved up the agenda at financial institutions (FIs) after a number of&nbsp;high profile attacks involving data breaches, ransom demands, distributed denial of service (DDoS)&nbsp;attacks and other hacks. Examples include the Carbanak gang that stole $1bn from 100 banks across 30&nbsp;countries and the JP Morgan Chase data breach in the US and the latest $101m Bangladesh incident.</p>

<p>This report examines best practices for managing the risks of cyber attacks, the threat vectors as&nbsp;technology advances, and what FIs can do to protect themselves and their supply chain partners.&nbsp;Expenditure trends, and the regulatory, reputational and technology drivers are examined. Chartis&nbsp;gathered feedback from 105 institutions, involving 32 qualitative face-to-face interviews with FIs&nbsp;and vendors, and 73 participants in the Chartis Cyber Risk Management Global Survey. Conclusions&nbsp;include:</p>

<ul>
<li><strong>The regulators are closing in.</strong> Cyber security has been embedded in regulations for years, but there&nbsp;is an increasing focus on more specific compliance requirements. Some of these regulations carry&nbsp;potentially firm-destroying consequences, such as the European General Data Protection regulation&nbsp;in which firms may be penalized 4% of global turnover for non-compliance. In addition, more firms&nbsp;outside of financial services are being fined for cyber breaches or security failures, from telecom&nbsp;companies to hotel chains. FIs have escaped significant regulatory censure thus far, but when the&nbsp;precedent for fining FIs for breaches is established, the floodgates will open.</li>
<li><strong>With respect to breaches, the question is not “if” but “when.</strong>” Only a small minority (5%) of&nbsp;respondents reported a decrease in cyber security incidents last year. 37% reported a double figure&nbsp;increase, with 11% experiencing a rise of between 25-50%. Beyond this, the delivery vectors for&nbsp;cyber crime have increased with mobile and online banking, and soon the “internet of things.” In&nbsp;addition, there is an increasing commoditization of cyber crime tools in the black markets, and&nbsp;emerging complex persistent threats from organized crime and nation states. Firms expecting that they&nbsp;will not be breached are not merely optimistic, but unrealistic.</li>
<li><strong>Investment is increasing.</strong> 68% of respondents report a double figure increase in cyber risk&nbsp;management expenditure for 2015-16. 24% are increasing their budget by 15% or more. The&nbsp;cyber risk management technology market for financial services is now worth $1.9bn. Cyber&nbsp;risk management is the fastest growing segment in the financial crime risk management (FCRM)&nbsp;technology sector.</li>
<li><strong>Cyber security is not enough.</strong> High expenditure is being driven by more investment in technology&nbsp;and staff as FIs seek to protect their intellectual property (IP), data, customers, systems and&nbsp;ecosystems. However, expenditure is frequently tactical, and aligned to a mixture of external&nbsp;standards and siloed internal functions.</li>
<li><strong>Firms should begin the move from cyber security to cyber risk management. </strong>It is no longer&nbsp;enough to only try to protect assets, and potential breaches must be analyzed within the context of&nbsp;both probability and impact. Thus, cyber security should be established as a tactical subset of an&nbsp;enterprise-wide strategic risk management framework. Key to this is the quantification of cyber risks.</li>
</ul>

<p>The quantification of cyber risks can inform capital allocations and enable insurance against&nbsp;cyber attacks, as well as providing justifications for business decisions to the regulators who will&nbsp;increasingly be testing and fining firms. However, this is one of the final goals in a journey which&nbsp;most FIs are barely starting. Low-hanging fruit at the start of the journey include establishing clear&nbsp;lines of communication between chief risk officers (CROs) and those who have the responsibility&nbsp;for cyber security such as the Chief Information Officer (CIO) and Chief Security Officer (CSO),&nbsp;and establishing processes for delivering cyber security information (numbers of breaches, specific&nbsp;vulnerabilities) up to the board level.</p>

<p>&nbsp;</p>

• Tweet  
• Facebook  
• LinkedIn  
• Save this article
• Send to  
• Print this page  

• Topics
• Analytics
• Market Analysis
• Quantitative Methods
• AI & Machine Learning
• Business Intelligence
• Networking
• GRC and Operational Risk