Cyberattacks and cyber thefts are two of the most pressing global security concerns today, especially for financial institutions. But much still needs to be done if such institutions want to protect themselves properly, says Saqib Sheikh, head of sales services for Asia Pacific at Swift, a global provider of secure financial messaging services.
Sheikh explains that today’s cyberattacks on financial institutions are the result of persistent malicious actors that no longer rely on generic malware, but target their attacks on specific institutions.
“They really focus on their victim. They spend a significant amount of time and effort in studying them, understanding their vulnerabilities, and tailoring their attack for that particular institution, so they are more frequent, more persistent and sophisticated,” he says.
The numbers reveal a daunting picture. According to Norse, a provider of cyber threat intelligence, there are seven million hacking attempts worldwide daily, from individual machine infection through malware to critical infrastructure hacking.
In Hong Kong alone, financial losses resulting from cybercrime rose by about 51 per cent to HK$1.82 billion last year, while the number of cases were up 1.2 per cent to 6,778 cases, according to police statistics.
This is a worrying trend for a financial hub like Hong Kong where, according to the Hong Kong Monetary Authority, there were 11 million online banking accounts in the city last year which, on average, conducted 17 million transactions worth a total of HK$7.3 trillion per month.
Sheikh says financial institutions need to take the threat of cyberattacks very seriously. “For financial services and banks in particular, trust is very important. This is where we keep our money and we need to trust these institutions more than any other. Not reacting appropriately to these security concerns will have an adverse impact on trust in the banking sector.”
He emphasises that cybersecurity affects many different aspects of the financial sector, so responses need to be comprehensive rather than simply tactical.
At a minimum, institutions need to be looking at their IT, people and process controls. Staff need to be educated on cybersecurity and be careful with things like the way they manage their passwords. Institutions also need to assess their physical operating environment and ask themselves whether someone could easily access an operator’s work station.
“There are many things that you can do, but not everybody does it,” Sheikh says. “Global and regional banks are cognisant of this and have already made significant investments in this area. But with other institutions, depending on the nature of the business and the geographies that they operate in, they have different views of the risks and only commensurately apply control based on that risk perception.”
Therein lies part of the problem, he says. On one hand, there is a lack of knowledge about cybersecurity; on the other hand, institutions need the technical know-how to protect themselves.
In response to this situation, Swift has been helping the financial community raise awareness and reinforce their services.
The company is set to roll out a customer security programme that helps companies build on existing security. The numerous features include an information sharing platform , new tools to help customers strengthen their environments better, stronger security guidelines, the introduction of pattern detection, and enhancement of support with third-party providers.
Sheikh says that ultimately banks and other financial institutions need to assess the capabilities of their workforce.
“Large global, regional and national banks will have the sophistication and funds to respond to such advanced persistent threats to their business,” he explains. “Smaller institutions will need help to build a talent pool that can respond. This is where Swift, national banking forums and regulators can help.”
