What resilience gaps are we seeing?
Cyber-attacks are a growing threat for financial and related professional services, which are a primary target due to the vast amount of sensitive information and assets they handle. Currently, with over 600 million attacks globally every day (1), the scale and potential impact of these events has made cyber resilience a business priority. Cyber warfare is increasingly waged by hostile nation states through professional proxy groups that continue to grow in size and sophistication. Meanwhile, Generative AI (GenAI) has reduced the barrier of entry for cyber criminals, who can execute social engineering and ransomware attacks with greater volume and effectiveness. Fraudsters are testing the waters with GenAI, creating synthetic identities in an attempt to find loopholes in financial systems. Against this backdrop, organisations are collecting more information – including biometrics – to protect systems against threat actors.
The growing interconnectedness and digitalisation of supply chains has only amplified the potential for cyber risks, as each link in the financial chain presents a potential vulnerability that can be exploited. The CrowdStrike outage in 2024 demonstrated how exposure to major third-party technology providers could cause significant disruption, with a single bad update impacting companies across industries, geographies and revenue bands. Regulatory action, seen with the newly adopted Digital Operational Resilience Act (DORA) and the NIS2 Directive, has placed additional reporting requirements on financial institutions, moving from a focus on data privacy to greater resilience throughout the industry. As a result, financial and related professional services firms must do more to remain compliant, with failure on this front potentially resulting in hefty fines, legal action and reputational damage.
Quantum computing is a threat to the future scale and severity of cyber-attacks, with most cryptographic methods in use today capable of being broken by a quantum computer. There is a risk that bad actors can store data that is encrypted today with the intention of decrypting it later when quantum computers become more viable. Quantum computers could also generate valid digital signatures without access to private keys. The advice of the National Cyber Security Centre and other state cybersecurity agencies is migration to post-quantum cryptography (PQC), built on asymmetric crypt algorithms based on maths problems that are believed to be secure from attack by both classical and quantum computers. Work on these algorithms has been ongoing for many years, culminating in these algorithms being standardised more recently.
PQC has primarily been a topic for cryptographers up to this point, but it will soon be an IT and operational technology (OT) issue as organisations prepare to migrate their technology. Technical system and risk owners of both enterprise and bespoke IT should begin or continue financial planning for updating their systems for PQC. As systems are updated in service or replaced as they come to the end of their supported lifecycle, new IT should either use PQC or be capable of being upgraded to support it.
The first activity in a well-planned migration is crypt discovery, understanding where the risks lie in legacy technology and supply chains, as well as what data is being protected as part of an organisation’s estate. This provides the basis for migration activities, which should prioritise high value or long-lived sensitive data, and systems which will either take a long time to upgrade or will be deployed for a long period of time. As migration will be a costly and multi-year upgrade, buy-in from budget holders and system owners will be required to minimise the risks posed by quantum computing.
The importance of proactive cyber security cultures
Despite often being understood as a technological issue, lapses in cyber security are more frequently the result of people or organisational vulnerabilities. A strong cyber security culture with good cyber ‘hygiene’ practices is the antidote to this problem, being based on effective communication around cyber threats and understanding the ways in which employees can uphold cyber security throughout their work. To achieve this, it’s important that employees have a firm understanding of what ‘normal’ looks like on their systems and feel empowered to raise concerns around suspicious activity. Finding potential faults in a system should be viewed as a success, giving personnel the opportunity to fix vulnerabilities before they are exploited.
Buy-in from boards is a critical building block of proactive cyber security cultures, in turn emphasising the need for a collective understanding of where cyber security fits in the ‘big picture’ of the organisation. Chief Information Security Officers are increasingly integrating with the wider business to build the technology response into the overall view of business risks.
For global organisations, regulatory fragmentation is also a crucial factor when considering the effectiveness of a coordinated cyber policy. Internal misalignment in practices due to varying regulations at a local level complicates the implementation of a single cyber approach throughout an organisation, highlighting the value of a standardised reporting system for all geographies.
