Other parts of this series:
How are banks and other financial services institutions (FSIs) faring when it comes to protecting their assets and their customers from fraud, malware and a host of other security breaches? Accenture has conducted a wide-ranging survey into the state of cybersecurity.
The results are not comforting.
Perception, versus …
The survey, part of a larger, cross-industry research initiative into cybersecurity, found that overconfidence within the banking industry is alarmingly prevalent. Large percentages of banking respondents were confident that they are doing the right things in terms of cybersecurity. In fact, 78 percent of security executives expressed confidence in their cybersecurity strategies and 76 percent said they have actually embedded effective cybersecurity into their cultures.1
The reality is very different, however, revealing a major disconnect or misalignment between the assumptions about security capabilities and what’s actually happening in the trenches. From both external and internal sources, companies continue to be at high risk from an information security standpoint.
The survey revealed that financial services firms are suffering from an astounding number of security breaches. In addition to the thousands of daily attacks, a typical financial services organization will face an average of 85 targeted breach attempts every year, about a third of which will be successful.2
That’s between two and three effective attacks per month!
In addition, 68 percent of firms surveyed agreed that cyberattacks are “a bit of a black box.” That is, firms don’t always know what they don’t know.3
It’s clear that there is a serious dissonance between cybersecurity confidence and actual cybersecurity capabilities.
Attackers are spending too much time inside your systems
Of course, breaches are only a problem if they are not detected. It’s important to have defense in depth, rather than simply a tough exterior. But the length of time taken to detect these security breaches demonstrates that the attackers are spending considerable time inside organizations. Fifty-nine percent of banking respondents admit it takes “months” to detect successful breaches, while another 14 percent identify them “within a year” or longer.4
Asking some tough questions
Clearly, financial services firms should ask themselves some in-depth questions about their cybersecurity approaches, where their risks are and where they intend to invest.
- Are we confident that we have identified all priority business data assets and their location?
- Are they segregated from less critical data?
- Are we able to defend the organization from a motivated adversary? Do we know what tools and tactics they might use?
- How could these attacks affect our business?
- Do we know what the adversary is really after?
- How often does our organization “practice” its plan to get better at responses?
- Do we have the right alignment, structure and team members to drive the behaviors needed to realize our cybersecurity objectives?
A two-pronged defense
To defend against sophisticated attacks, Accenture recommends a two-pronged defense focused on cybersecurity assessment on the one hand, and attack simulation on the other.
I’ll discuss these defense approaches in my next blog.
- Accenture High Performance Security Report 2016. Access at: https://www.accenture.com/us-en/insight-building-confidence-facing-cybersecurity-conundrum