Organizations in the financial services industry not only face attacks directed at individual institutions; they are also up against the threat of systemic financial cyberattacks. In a systemic breach scenario, the entire banking and payment system could be shut down, throwing the financial services industry into complete chaos.

In an interview published on Sept. 20, JPMorgan Chase CEO Jamie Dimon told CNBC that the greatest vulnerability for the financial system is the threat of cyberattacks. Just this week at the Sibos 2018 conference, a panel discussion focused on the varying levels of cybersecurity preparedness across the industry, and the risk that variance poses when it comes to preventing and responding to attacks. How can financial institutions get on the same page?

Is the Payment Industry Prepared for Systemic Financial Cyberattacks?

Some of the premier payment companies recently decided to take action against the threat of a systemic breach. These companies came together to prepare for the worst-case scenario with an intense, immersive cyberattack simulation at IBM Security’s X-Force Command Center.

Multicompany events such as this help payment companies address critical concerns, such as the potential for a systemic attack. Cyber range exercises security leaders to gauge the organization’s level of preparedness and identify challenges that the industry might face when striving to respond in a collaborative manner. It also helps them develop and hone a contingency plan that could be implemented in the event of a total loss of payment infrastructure and systems.

This multicompany event was not unique; rather, it illustrates a growing trend. More and more, we see financial services companies sharing cyberthreat intelligence. We also see financial institutions banding together to participate in simulated cybersecurity exercises to assess their state of readiness and formulate effective incident response (IR).

Why You Should Invest Equally on Both Sides of the Boom

When financial services companies consider the ramifications of a cybersecurity attack on the stability of the industry, they must focus on two key aspects: “left of boom,” which refers to what an organization does to secure and protect itself from a cyberattack, and “right of boom,” which is what a company must do to respond to and manage a cyberattack after it occurs. Until recently, most companies have focused investments on left of boom, with few companies investing equally on right of boom. As a result, many security leaders are uncertain of their ability to effectively react once a breach takes place.

Financial institution executives who dedicate more attention to right of boom and their IR plans will also be better positioned to address compliance requirements. Industry regulatory requirements, such as the 23 NYCRR Part 500 cybersecurity standard, provide specific levels of accountability, including the requirement to have a fully developed IR plan in place. Despite these mandates, many organizations are inadequately prepared to respond to major financial cyberattacks.

IBM Security has hosted countless financial services companies at the X-Force Command Center, either independently or with peer companies. Not only do these companies go through incident management exercises, but they also have the opportunity to work with law enforcement, law firms that specialize in legal response and regulators that enforce the accountability that companies must demonstrate.

What security challenges does your organization face?