Organizations in the financial services industry not only face attacks directed at individual institutions; they are also up against the threat of systemic financial cyberattacks. In a systemic breach scenario, the entire banking and payment system could be shut down, throwing the financial services industry into complete chaos.

In an interview published on Sept. 20, JPMorgan Chase CEO Jamie Dimon told CNBC that the greatest vulnerability for the financial system is the threat of cyberattacks. Just this week at the Sibos 2018 conference, a panel discussion focused on the varying levels of cybersecurity preparedness across the industry, and the risk that variance poses when it comes to preventing and responding to attacks. How can financial institutions get on the same page?

Is the Payment Industry Prepared for Systemic Financial Cyberattacks?

Some of the premier payment companies recently decided to take action against the threat of a systemic breach. These companies came together to prepare for the worst-case scenario with an intense, immersive cyberattack simulation at IBM Security’s X-Force Command Center.

Multicompany events such as this help payment companies address critical concerns, such as the potential for a systemic attack. Cyber range exercises security leaders to gauge the organization’s level of preparedness and identify challenges that the industry might face when striving to respond in a collaborative manner. It also helps them develop and hone a contingency plan that could be implemented in the event of a total loss of payment infrastructure and systems.

This multicompany event was not unique; rather, it illustrates a growing trend. More and more, we see financial services companies sharing cyberthreat intelligence. We also see financial institutions banding together to participate in simulated cybersecurity exercises to assess their state of readiness and formulate effective incident response (IR).

Why You Should Invest Equally on Both Sides of the Boom

When financial services companies consider the ramifications of a cybersecurity attack on the stability of the industry, they must focus on two key aspects: “left of boom,” which refers to what an organization does to secure and protect itself from a cyberattack, and “right of boom,” which is what a company must do to respond to and manage a cyberattack after it occurs. Until recently, most companies have focused investments on left of boom, with few companies investing equally on right of boom. As a result, many security leaders are uncertain of their ability to effectively react once a breach takes place.

Financial institution executives who dedicate more attention to right of boom and their IR plans will also be better positioned to address compliance requirements. Industry regulatory requirements, such as the 23 NYCRR Part 500 cybersecurity standard, provide specific levels of accountability, including the requirement to have a fully developed IR plan in place. Despite these mandates, many organizations are inadequately prepared to respond to major financial cyberattacks.

IBM Security has hosted countless financial services companies at the X-Force Command Center, either independently or with peer companies. Not only do these companies go through incident management exercises, but they also have the opportunity to work with law enforcement, law firms that specialize in legal response and regulators that enforce the accountability that companies must demonstrate.

What security challenges does your organization face?

More from Banking & Finance

Cost of a Data Breach: Banking and Finance

The importance of cybersecurity has touched almost every industry. Beyond that, robust cybersecurity is table stakes for several sectors, particularly health care and the banking and finance industry. Not only is financial data at risk, but so is customer trust. In banking and finance, trust means everything. Yet, consumers are hesitant to share their confidential data. A recent McKinsey survey revealed that no industry achieved a trust rating of 50% for data protection. Here’s the most sobering stat: 87% of…

What Do Financial Institutions Need to Know About the SEC’s Proposed Cybersecurity Rules?

On March 9, the U.S. Securities and Exchange Commission (SEC) announced a new set of proposed rules for cybersecurity risk management, strategy and incident disclosure for public companies. One intent of the rule changes is to provide “consistent, comparable and decision-useful” information to investors. Not yet adopted, these new rules – published in the Federal Register on March 23 – could change reporting requirements. Take a look at some of the big-ticket items and what your organization needs to know.…

SEC Proposes New Cybersecurity Rules for Financial Services

Proposed new policies from the Securities and Exchange Commission (SEC) could spell changes for how financial services firms handle cybersecurity. On Feb. 9, the SEC voted to propose cybersecurity risk management policies for registered investment advisers, registered investment companies and business development companies (funds). Next, the proposal will go through a public comment period until May 9.  The Importance of Cybersecurity in Finance The 2021 X-Force Threat Index found that financial services were the most targeted industry. Manufacturing beat out…

Top Security Concerns When Accepting Crypto Payment

From Microsoft to AT&T to Home Depot, more companies are accepting cryptocurrency as a way to pay for products and services. This makes perfect sense as crypto coins are a viable revenue source. Perhaps the time is ripe for businesses to learn how to receive, process and convert crypto payments into fiat currency. Still, many questions remain. How can you safely enable customers to pay with Bitcoin or other digital currency? What are the security risks that come with cryptocurrency? Let’s…