Banks are Turning to Their Talent to Boost Their Cyber Resilience

Banks are Turning to Their Talent to Boost Their Cyber Resilience
September 28, 2023 8 mins

Banks are Turning to Their Talent to Boost Their Cyber Resilience

woman_1255077848

As cyber attacks become more sophisticated, banks can shore up their cyber-security resilience efforts by building a partnership between business leaders and cyber technologists.

Key Takeaways
  1. A mix of remote work and increasingly skilled hackers have made banks more susceptible to cyber crime.
  2. Banks and financial institutions can bolster their cyber-security resilience by assessing vulnerabilities and tapping into their workforce.
  3. Weaving cyber know-how into the fabric of the company helps ensure the longevity of banks’ cyber-security investments.

Overview

Banks and other financial institutions — as well as their customers — have become prime targets for cyber attacks. Spencer Lynch, head of Aon’s Cyber Solutions practice in the UK, notes that threat actors and hackers used to steal personal data for the sake of reselling it. Now, the goal has changed: hackers are finding ways to monetize their attacks through ransomware and other forms of extortion. In a 2022 study, 74 percent of financial institutions reported a ransomware attack, and 63 percent of those institutions paid the ransom.

“Cyber security is an important topic for banks because they rely on their reputation to show that their customers can trust them to keep their assets safe,” says Peter Keuls, global head of Aon’s Talent Solutions practice. “There were 10 times more suspicious activity reports filed by the SEC regulated firms in 2022 compared to four years ago.”

Despite an increase in security training, research shows many employees remain vulnerable to cyber threats. For banks and financial institutions to maintain their cyber resilience, they should consider new strategies to strengthen their cyber defenses and equip their workforce with effective cyber skills.

In Depth

Many financial institutions have been contending with data theft for so long that it can be difficult to modify their staff’s approach to cyber attacks. For example, many institutions send ongoing breach notifications, which can desensitize customers to alerts and lead to potential long-term negative outcomes for customers as well as financial institutions. Changes in hacker technology — including artificial-intelligence-enhanced phishing and the ability to leverage the multitude of internet-based communications platforms companies use legitimately — add to the challenge of maintaining cyber awareness among employees.

Leaders in financial institutions should be aware of some factors that have changed cyber security and take steps to improve their cyber resilience. To establish long-term cyber resilience, financial institutions must ensure business leaders own cyber security in collaboration with their technology partners, take a proactive approach to equipping their workforce with cyber-related skills, properly assess their vulnerabilities and build cyber awareness throughout the entire organization.

Quote icon

With generative AI, hackers and threat actors can easily use the data that’s already out there to impersonate people and create convincing phishing messages and other forms of content, such as verbal communications or deepfake videos.”

Spencer Lynch
Global Security Consulting Leader, Aon

How the Cyber Landscape has Changed for Banks

Cyber crime can happen in myriad ways, and recent trends have changed how attackers target financial institutions. Advanced technologies, such as generative artificial intelligence (AI), have made phishing emails much more sophisticated, making them harder to identify and prevent.

“With generative AI, hackers and threat actors can easily use the data that’s already out there to impersonate people and create convincing phishing messages and other forms of content, such as verbal communications or deepfake videos,” Lynch says.

The people component to cyber security is critical. Cyber incidents often relate to the people who are targeted rather than the IT application itself. In other words, people click on phishing links, type in their usernames and passwords, run a program or open an attachment that they shouldn’t have. Chris Blain, partner in Aon’s Talent Solutions practice in the UK, notes that skills gaps and talent shortages have affected IT-related roles, and remote-working environments have made it harder for companies to monitor and defend against cyber attacks.

“As we see more cyber attacks and breaches, banks are trying to retain talent that has cyber-resilience skills,” Blain explains. “They need to ensure that they’re paying at the right levels and attracting new people who already have those skills.”

“It seems like remote working, to some degree, is here to stay, which means that this challenge of managing this expanded attack footprint is something that the cyber professionals in the bank will have to learn to cope with,” adds Keuls.

Investing in cyber security can be expensive, but the cost of not investing is much greater. Losing information can cause significant delays for companies, and losing transactional information in customer accounts could be detrimental if the bank can’t reconfigure the balances of each account. Variations in regulatory environments can also add to the impact of a cyber incident. Depending on where they’re doing business, some banks can come under two or three regulators, which increases the threat of investigation and penalties if there’s a cyber incident. Regulators are also increasing pressure on banks to reduce the cyber-incident reporting window.

Quote icon

As we see more cyber attacks and breaches, banks are trying to retain talent that has cyber-resilience skills. They need to ensure that they’re paying at the right levels and attracting new people who already have those skills.”

Chris Blain
Partner in Aon’s Talent Solutions practice in the UK

What Banks can do to Improve Cyber-Security Resilience

Banks can take three steps to protect themselves and reinforce their cyber efforts.

First, they can assess their vulnerabilities. The goal of this exercise is to find where new vulnerabilities exist in infrastructure and determine how long it will (or could) take to fix them once they’re discovered.

“A lot of companies do penetration testing, which is often mandated for banks by a regulator,” explains Lynch. “This test involves a consultant pretending to be the hacker and breaking into the bank. There’s also vulnerability scanning and ongoing and continuous vulnerability management, where you check all the external infrastructure and see if there’s any new vulnerability that’s been found.”

Maturity assessments and other forms of benchmarking are another chance to test for weakness. Companies should assess their performance across several areas, such as multifactor authentication and endpoint detection and response. Banks can also work with consultants to assess what they’re doing across different types of controls and control domains and compare their approaches to industry benchmarks.

Second, banks can determine whether they’re underinvesting or overinvesting in cyber security. Benchmarking against other banks can help financial institutions determine if they are underinvested or overspending on cyber functions. Leaders should look at how cyber functions are organized and see what kinds of functions are being insourced and outsourced.

“The level of investment around cyber in a typical bank is enormous, running into tens if not hundreds of millions of dollars. So it’s very important that they get the balance right in terms of cost, especially at a time when banks are focused on their cost base,” says Blain.

Third, banks can manage cyber security from a talent perspective. They can assess skill sets across departments to see if people working in areas such as risk can take on cyber-related positions. “Adjusting talent in this way would be of great benefit to the banks of course, but it also opens up a great opportunity for people employed by the banks, allowing them to move into new roles and maybe even increase their levels of compensation by doing that,” says Blain.

Weaving Cyber Strategies Into Talent Strategies

Building a more resilient workforce also helps solve cyber issues within banks because talent equipped with cyber skills is more likely to stay within the organization. Lynch adds that a lot of organizations struggle to connect cyber to their business. “IT professionals are trying to manage cyber security and think through what the impact on the business could be, but they’re not the business — they’re not the ones dealing with customers every day,” he explains. “They can’t predict all the different possible impacts, so getting that cross-pollination of thought is tremendously important for banks.”

CEOs and other executives can create a workplace culture in which everyone feels that cyber security is part of their responsibilities. By leveraging the power of IT and talent across departments, financial institutions can respond to current and emerging cyber threats and become much more cyber resilient.

General Disclaimer

This document is not intended to address any specific situation or to provide legal, regulatory, financial, or other advice. While care has been taken in the production of this document, Aon does not warrant, represent or guarantee the accuracy, adequacy, completeness or fitness for any purpose of the document or any part of it and can accept no liability for any loss incurred in any way by any person who may rely on it. Any recipient shall be responsible for the use to which it puts this document. This document has been compiled using information available to us up to its date of publication and is subject to any qualifications made in the document.

Terms of Use

The contents herein may not be reproduced, reused, reprinted or redistributed without the expressed written consent of Aon, unless otherwise authorized by Aon. To use information contained herein, please write to our team.

More Like This

View All
Subscribe CTA Banner