Financial services companies must remain agile and vigilant in protecting their data, client information, and IT infrastructure from cyber threats. They need to understand cybersecurity requirements for financial service companies in order to stay ahead of the ever-evolving technology landscape.
This blog post covers cybersecurity best practices for financial services companies as they continue to monitor and protect their data and systems from malicious actors while evolving measures to ensure that the impact of cybersecurity regulations is favorable to their business objectives.
What is a Financial Service Company?
Broadly speaking, financial services companies are organizations engaged in a wide range of offerings within the finance industry. These include everything from payments to money management to banking and insurance.
According to the Organization of American States, the following activities are considered financial services:
Insurance and Insurance Related Services
(a) Direct insurance (including co-insurance):
- life
- non-life
(b) Reinsurance and retrocession
(c) Insurance intermediation, including brokerage and agency
(d) Services auxiliary to insurance, for example, consultancy actuarial, risk assessment, and claim settlement services.
Banking and Other Financial Services (excluding Insurance)
(e) Acceptance of deposits and other repayable funds from the public.
(f) All types of lending, for example, mortgage credit, consumer credit, financing of commercial transactions, and factoring.
(g) Financial leasing.
(h) All money transmission and payment services such as credit, charge, and debit cards, bankers’ drafts, and travelers’ checks.
(i) Guarantees and commitments.
(j) Trading for own account or for accounts of customers, whether on an exchange, in an over-the-counter market, or otherwise, the following:
- Money market instruments, including bills, checks, and certificates of deposits
- Foreign exchange
- Derivative products, including futures and options
- Exchange rate and interest rate instruments, including products such as swaps and forward rate agreements
- Transferable securities
- Other negotiable instruments and financial assets, including bullion.
(k) Participating in the issuing of all kinds of securities, including underwriting and placement as an agent (whether publicly or privately) as well as supply of services related to these issues
(l) Money broking
(m) Asset management, including cash or portfolio management; pension fund management; all forms of collective investment management; custodial, depository, and trust services
(n) Settlement and clearing services for financial assets, including derivative products, securities, and other negotiable instruments
(o) Provision and transfer of financial information, financial data processing, and related software by suppliers of other financial services
(p) Advisory, intermediation, and other auxiliary financial services on all the activities listed in (e) through (o), including credit reference and analysis, investment and portfolio research and advice, advice on acquisitions, and on corporate restructuring and strategy
Examples of Financial Services Companies
As noted earlier, financial services is a broad term that encompasses several firms. The following are some examples:
- Government institutions, e.g., the Federal Reserve (central bank), the Securities and Exchange Commission (SEC), and the Federal Deposit Insurance Commission (FDIC)
- Payment processors, e.g., Visa, MasterCard, PayPal
- Retail banks, e.g., Bank of America, BNP Paribas
- Investment banks, e.g., Morgan Stanley, Barclays, Goldman Sachs
- Investment managers, e.g., Vanguard Group, American Funds
- Exchanges and clearing houses, e.g., the NYSE, CME Clearing
- Insurance providers, e.g., Allstate, Berkshire Hathaway
Cybersecurity Threats to Financial Institutions
A cyber threat is an activity (such as phishing, ransomware, malware, etc.) aimed at compromising the security of an information system, for instance, by impacting the availability, efficiency, confidentiality, and integrity of the system or the information inside it, or disrupting a digital ecosystem as a whole.
The online space where cyber threat actors indulge in their cyber threat activities is referred to as the cyber threat environment. The environment includes devices, networks, and processes that are connected to the Internet and can be targeted by cyber threat actors, as well as the methods threat actors use to target those systems.
Cyber threat actors are individuals or groups maliciously seeking to take advantage of an information system’s weaknesses or exploit the operators of such systems in order to gain unauthorized access to perpetrate malicious activity by impacting victims’ data, devices, systems, and networks, for example, by distorting the information flowing to and from a system.
Because of the globalized nature of the Internet, threat actors can be based in any part of the world and still have the capacity to impact the security of information systems in another part of the world. Additional reading- Understanding the Cybersecurity Threats Facing Financial Services.
Why Financial Service Companies Need Strict Cybersecurity Standards?
Financial services constantly rank as one of the most targeted industries in the world. This relatively high rate of attacks is not surprising considering the high volume of valuable financial data and assets the industry boasts, as well as the potentially high-value outcomes of successful attacks. In a worrying turn of events, successful attacks seem increasingly commonplace, with several breaches recorded in the U.S. in 2022. One explanation for this could be a lack of financial data security compliance capabilities on the part of the attacked organizations.
Unfortunately, there are still a significant number of businesses and even entire governments that take cybersecurity for granted. For example, the IMF has found that 56% of the central banks or supervisory authorities lack a national cyber strategy for the financial sector and 64% neither mandate testing and exercise cyber security measures nor provide further guidance.
In these digital days, cybersecurity has become crucial to the success of financial services companies in terms of protecting sensitive customer information/data, guaranteeing the integrity of financial transactions, and helping ensure compliance with financial services cybersecurity regulations, among others.
Companies that understand and implement cybersecurity requirements have greater chances of staying out of trouble. Negligence can result in substantial financial losses, reputational damage, and even legal liabilities. The financial services industry has no option but to continue investing in cybersecurity to ensure the integrity of financial transactions and, hence, maintain the trust of its customers.
Increasing Regulatory Requirements in Financial Sector
Cybersecurity breaches not only impact the compromised company negatively, but also affect confidence in the industry as a whole. The IMF has analyzed the significant threat posed by a weak cybersecurity mechanism to the financial services industry in particular and the world in general. Potential consequences range from the above-mentioned loss of confidence in financial services to widespread economic instability. To help address this, global cybersecurity regulations have continuously emerged over the years. These laws seek to strengthen the security posture of both individual organizations and the industry holistically.
Introduction of GDPR
The General Data Protection Regulation (GDPR) is a European Union data privacy protection law that went into effect on May 25, 2018. It applies to organizations operating within E.U. territory as well as organizations outside the E.U. that process the personal data of E.U. residents in connection with providing goods or services to such E.U. residents or monitoring the behavior of individuals in E.U. territory.
Under the GDPR’s Article 4, personal data is defined as “any information relating to an identified or identifiable natural person,” (the data subject) while a personal data breach is “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored, or otherwise processed.”
Like other cybersecurity regulations and laws in the U.S. or regulations/laws with a global focus, compliance with the General Data Protection Regulation is mandatory, and non-compliance can attract undesirable penalties. Payments processing and other financial industry institutions that often process huge volumes of data associated with high-risk data processing activities are subject to compliance with GDPR provisions and penalties. Non-compliance can attract a fine of up to €20 million, or 4% of the organization’s total global turnover for the preceding financial year, whichever is greater.
Final Rule for Cybersecurity Guidelines from Federal Financial Institutions Examination Council (FFIEC)
Late last year, the Federal Financial Institutions Examination Council (FFIEC) released an update to its Cybersecurity Resource Guide for Financial Institutions. This was the first update to the guide since October 2018. The release came as the Council noted that ransomware incidents in the financial sector have been occurring at an alarmingly increasing rate.
According to the FFIEC, the Guide seeks to support financial sector resilience. However, FFIEC members do not endorse the organizations listed in the Guide, and any financial institution using any of the listed resources should do so voluntarily rather than mandatorily. Notably, the 2022 version of the Guide is substantially more voluminous than the 2018 version and the inclusion of a section about ransomware (including several self-assessment tools) is an indication that ransomware will probably be an area of growing concern to examiners for future reviews.
Other Regulatory Standards Introductions
The U.S. financial services industry is controlled by multiple federal and state regulators. Regulatory authority is often focused on particular financial services activities rather than particular companies or entities. Thus, it is likely that a financial services company with multiple products or service lines (e.g deposits, securities, and insurance) will have to be supervised by different regulators, each with a focus on particular aspects of its operations.
Below are some U.S. financial services regulations:
- NIST Standards (e.g., the NIST CSF and NIST 800-53 and NIST 800-171)
- NYCRR part 500 DFS cybersecurity regulation
- Sarbanes-Oxley Act
- California Consumer Privacy Act (CCPA)
- FTC Safeguards Rule
- Payment Card Industry Data Security Standard (PCI DSS)
- Gramm-Leach-Bliley Act (GLBA)
The Changing Cybersecurity Landscape
Growing security threats, adoption of the hybrid work model, uneven economic outlooks, geopolitical crises, and the ever-increasing cybersecurity requirements for financial services companies have all strained the financial services industry in recent years. While finance services are typically ahead of other industries in cyber defense maturity due to the relatively high number of cybersecurity regulations in their field, they are continually regarded as high-value targets by cyber criminals and nation-state attackers.
With cyber threats constantly evolving in terms of both sophistication and frequency, financial services organizations must become more vigilant when it comes to safeguarding sensitive customer information, protecting financial assets, and preserving the trust that underpins the whole industry.
Growth of Online Fraud and Cyberattacks
Despite the best efforts of the cybersecurity industry, the Internet is still not as safe as stakeholders wish. For example, the 2022 Internet Crime Report by the FBI’s Internet Crime Complaint Center (IC3), confirms that cyber actors continue to target U.S. networks, attack critical infrastructure, steal money, exploit data for ransom, facilitate large-scale fraud schemes, and threaten national security.
During the period under review, a total of 800,944 complaints were received by the IC3, and total losses were in excess of $10.3 billion. Notably, while there was a 5% decline in the total number of complaints, dollar losses increased by as much as 49%. Phishing schemes led the way with 300,497 complaints, and, for the first time, investment schemes recorded the highest financial loss to victims. The largest group of reporting victims fell within the 30-39 age range, while the highest dollar loss occurred among citizens aged 60 and above.
Apart from phishing, other top complaints include personal data breaches and non-payment/non-delivery. Though phishing ranked top, the associated dollar loss of $52 million is small when compared with investment fraud which led to a $3.3 billion loss (a staggering 127% increase from the previous year). Cryptocurrency investment fraud also increased from $907 million in 2021 to $2.57 billion in 2022, with the most targeted age group ranging between 30 and 49.
Sophistication of Cyberattacks
The increasing sophistication of cyberattacks is one area that has been extensively researched and reported. For example, the Microsoft Digital Defense Report released in September 2020 noted the increased sophistication of threat actors. According to the report, these threat actors use techniques that make it more difficult to detect them and that enable them to threaten even the savviest targets.
Nation-state actors are evolving new reconnaissance techniques that increase their possibility of compromising high-value targets. Additionally, criminal groups targeting businesses have migrated their infrastructure to the cloud to hide among licit services, and attackers have come up with new ways to roam the internet in search of systems vulnerable to ransomware.
Added to the increasing sophistication of attacks are some other trends – threat actors clearly prefer certain techniques, notably credential harvesting, ransomware, and an increasing focus on IoT devices. The 2023 edition of the Microsoft report also harps on the increasing sophistication of cyberattacks.
Need for Designing and Implementing Stronger Cybersecurity Systems
There are a plethora of benefits to designing, implementing, and maintaining strong cybersecurity programs. These programs include protection for data, funds, and networks; protection for end users and endpoint devices; prevention of unauthorized access; improved recovery time after a breach; financial data security compliance; business continuity; and improved company reputation, among others.
Financial services (and other) organizations can reap these benefits by designing a strong cybersecurity program that includes:
- Establishing strong internal controls
- Hiring information security professionals
- Implementing stronger encryption and authentication protocols
- Utilizing better firewall and intrusion prevention systems
Important Components of Cybersecurity for Financial Service Companies
Because of the evolving nature, increasing sophistication, and frequency of cyberattacks, the need for creating a strong and comprehensive financial services cybersecurity program or strategy for all businesses in the financial services sector cannot be overemphasized. Such a strategy should be aimed at providing adequate protection against attacks, detecting cybersecurity incidents quickly, and responding effectively, thus minimizing disruption. Below are some key financial services cybersecurity components.
Risk Assessments
Risk Assessments identify the levels of cybersecurity risks or threats within a company and help it determine the degree of risk that is acceptable and otherwise, as well as how to avoid such cybersecurity risks altogether or how to mitigate their impact.
Security Policies
A cybersecurity policy is an official document that explains the rules and procedures for ensuring the safety of networks and their users. Articulating an effective cybersecurity policy sets a clear tone for what an organization needs to do to protect the availability, confidentiality, and integrity of data and resources.
Such a policy should include the following:
- Approved and unacceptable behaviors: Rules to be followed by administrators, users, business partners, guests, and other stakeholders who access, use, modify, or change network resources and assets
- Response tactics: Description of how IT teams should respond to cybersecurity incidents, including notifying relevant stakeholders of ongoing incidents
- Proactive strategies: Guidelines on how to educate users about threat recognition, proper security measures, and oversight, (e.g., secure default setting configurations and rules for monitoring)
- Assigned roles: Clearly defined roles and responsibilities in terms of ownership of different network assets, responsibility for their management, and enforcement of security measures in them.
- Legal obligations: Legal responsibilities within an organization during breaches and consent-gathering activities, including notification of law enforcement and posting terms of service agreements
- Hardware and system rules: Approved technology lists, guidelines for security asset acquisition, per-device access rules, and server access rules
Awareness and Training
Organizational culture plays an important role in both the security and overall success of an organization and cybersecurity awareness should be an essential component of that culture. Cybersecurity programs aimed at awareness should teach employees various cybersecurity measures, such as how to avoid malicious attacks, possible consequences of an attack, how to recover from attacks, the importance of software updates, changing passwords, and more.
Data Loss Prevention (DLP)
Without sound DLP practices and tools, all the hard work that an organization does can be undone. A due diligence exercise will enable an organization to see what fits best with its business model. With the wealth of options out there, a financial services firm should evaluate the costs, determine its preferences, and any other requirements before making a final decision.
Adopting Cloud Security Solutions
Historically, financial services companies have often exhibited hesitancy towards adopting the cloud for significant aspects of their workload. These companies will instead tend towards being strategic when it comes to choosing what they use the cloud for. However, a recent McKinsey survey predicts that cloud adoption in the financial services industry will likely continue to increase in 2023. Over half of the survey’s respondents (54%) said they intend to shift at least half of their workloads to the public cloud within the next five years.
Introduction to Cloud Security
Cloud security is a cybersecurity discipline that includes a set of procedures and technologies developed to tackle threats to business security. More specifically, cloud security seeks to provide storage and network protection against internal and external threats, as well as enhance access management, data governance and compliance, and disaster recovery.
Many financial industry institutions and other organizations rely on cloud security as they transform digitally and adopt cloud-based tools and services as part of their business model.
What are the Benefits of Cloud Security?
Cloud computing has gradually evolved into the choice technology for organizations looking to be agile and flexible enough to drive the needed innovation and satisfy the expectations of modern-day customers. However, a company moving to a cloud environment has to adopt new security measures aimed at ensuring data security across its online information systems or networks.
Some benefits that financial services companies can realize from cloud security include:
- Tightened financial data security and other forms of protection (including fraud detection)
- Reduced costs
- Regulatory compliance
- Enhanced customer relationship management (CRM)
- Increased scalability
Adopting the Right Cloud Security Solutions
From big banks to medium-sized fintech companies to small insurance providers, financial services organizations are taking advantage of the cloud to stay ahead of the competition and deliver the best possible customer and employee experiences. A 2018 report by Bloomberg indicates that at least 25 of the world’s 38 largest financial institutions and insurance companies have subscribed to Microsoft’s cloud business and have commenced migrating their applications to the cloud.
Some banks are transferring their entire systems and platforms to the cloud while others are only allocating some of their components to the cloud and domiciling the rest on their internal infrastructure. Whatever the case, security remains a priority that a cloud security provider can help address.
Today’s virtual environments are dynamic and there are certain essential financial services cybersecurity attributes a company should look out for when selecting a cloud security vendor. The most important of these attributes are data security, scalability, visibility/control, and openness.
There are a plethora of providers to choose from in today’s market, so it is important to consider these four attributes when investing in a solution. Doing so will help to ensure peace of mind in terms of meeting legal requirements, having a more secure data environment, and the likelihood of easy scaling. CMMC Ready Cloud Solutions.
Staying Ahead of Cybersecurity Threats
Any financial services business wishing to thrive in the present complex cyber ecosystem will have to be forward-looking and flexible enough to keep future cyber-criminals at bay. This requires emphasizing proactivity as much as reactivity. Such a mindset implies that businesses should consider themselves always under attack with the possibility of being breached at any time. A high level of alertness will help ensure tightened financial data security as well as prompt detection and remediation of any likely breaches to avoid damage.
In other words, the key to staying ahead of financial services cybersecurity threats is to come up with an effective cybersecurity program with the right combination of defensive, detection, and response mechanisms that help ensure protection before a potential breach occurs. Ideally, any steps at evolving such mechanisms should be based on a clear comprehension of cybersecurity requirements for financial services companies. There must also be a rigorous, objective assessment and evaluation of the current state of readiness vis-a-vis the future required state of readiness, as well as a clearly defined program for possible improvements that can be measured or tracked over time.
Here are some key elements in a nutshell:
- Assessment and evaluation of readiness
- Staying abreast of the latest requirements in cybersecurity for financial services companies
- Proactive response to potential cyberattacks
- Utilizing automated security process monitoring
- The right combination of defensive, detection, and response mechanisms
- Compliance with financial data security regulations
- Designing an improvement program
The Role of Cyber Insurance in Fintech
In today’s highly interconnected world where cyber threats and security breaches are on the rise, trust and reputation are important characteristics for fintech companies. The increasing dependence on technology in rendering financial services, (including the digitization of financial transactions) has made cyber insurance a necessity for the protection of sensitive customer information and safeguarding companies from financial losses.
What is Cyber Insurance?
Cyber insurance is a specialized type of insurance that provides financial coverage and support in case of a cyberattack such as a data breach, or other cyber-related incidents.
Benefits of Cyber Insurance
Financial services companies can benefit from cyber insurance in a variety of ways. Among the key benefits include:
- Financial protection: Cyber insurance covers financial losses due to data breaches and other cyberattacks. Such costs include legal expenses, business interruption, customer notification, and credit monitoring.
- Reputational damage control: One single successful cyberattack can do considerable damage to the reputation of a financial services company. Cyber insurance providers offer clients access to public relations experts who can help manage the aftermath of a cyberattack incident. These experts can help communicate with stakeholders and re-establish trust with customers.
- Coverage for non-compliance: Companies in the financial services sector face numerous data security, privacy, and other financial cybersecurity compliance regulations that they have to comply with. Cyber insurance can cover fines and penalties arising from non-compliance.
- Risk assessment and mitigation: Several cyber insurance companies offer risk assessment services to help financial services providers identify systems vulnerabilities and consequently implement necessary security measures. Such assessments can prevent cybersecurity incidents before they occur, thus reducing the possibility of pecuniary losses and reputation damage.
Cost Considerations of Cyber Insurance
Like many other industries, the cyber insurance landscape is constantly evolving. Though the industry is experiencing growing demand, several challenges confront both insurers and customers. For instance, increased demand in recent years due to rising cyberattacks has brought about soaring cyber insurance costs. Moreover, with the potential for humongous financial damages due to large-scale attacks, many insurance providers are re-evaluating their exposure to such losses and consequently imposing higher premiums and more limitations on coverage.
Apart from rising costs, cybersecurity insurance coverage can vary widely between providers when compared to traditional insurance products. Being a relatively new product, cyber insurance is yet to be standardized. Each insurer has its policy form and language, all of which can be confusing for customers trying to compare alternative options and/or understand the scope of coverage.
Introduction to Managed Cyber Security Service Providers (MSSP)
MSSP may be considered an extension of a company’s IT department albeit with a focus on security. The main duty of MSSPs is to indulge in round-the-clock real-time monitoring of security systems to prevent any potential threats and deal promptly with any likely breaches. In other words, MSSPs safeguard IT systems and boost security as a whole.
The scope of work of MSSPs involved in financial services cybersecurity (and security in other sectors) ranges from detecting and blocking malware to managing VPNs and firewalls to timely intrusion detection. Depending on the agreement, MSSPs can also offer extra services, for example, assisting with system modifications, changes, and updates as well as helping ensure compliance with financial data security regulations.
Key Benefits of Working with a Cybersecurity Vendor
Cybersecurity vendors can be extremely beneficial to financial services companies and other businesses because without them many of these companies would struggle with navigating the digital world and its threats. Some of the benefits they provide include:
- Improving cybersecurity awareness
- Identifying security vulnerabilities
- Conducting cybersecurity training
- Providing a dedicated security team
- Time and cost savings
- Helping reduce regulatory risks and ensure financial cybersecurity compliance
- Rapid incident response
For help get in touch with us.
Conclusion
In today’s increasingly digital landscape, cybersecurity has assumed critical importance to financial services companies hoping to keep sensitive customer information/data safe, protect the integrity of financial transactions, comply with financial services cybersecurity regulations, and more. Not only could neglecting cybersecurity be the cause of significant financial losses but it could also inflict considerable reputational damage as well.
The key to staying ahead of financial services cybersecurity threats is to develop a cybersecurity program with an ideal combination of defensive, detection, and response mechanisms. This will be a product of clearly understanding cybersecurity requirements for financial services companies. Also, with local regulations (e.g., the NYCRR part 500 DFS cybersecurity regulation) and global regulations (e.g., the GDPR) constantly emerging to address cybersecurity concerns and lapses, financial services companies should always have adaptive strategies to make sure that the impact of cybersecurity regulations is compatible with their business objectives.
