Other parts of this series:
In my most recent blog in this series, which looked at where financial services firms should optimally invest to fight cyber crime, I closed by highlighting an important opportunity firms have to up their game: Only 26 percent of firms surveyed in the “2017 Cost of Cyber Crime Study,” an Accenture and Ponemon Institute, LLC report, have deployed artificial intelligence-based security technologies and just 31 percent are using advanced analytics solutions. (See Figure 1.)
Figure 1: Nine key security technologies deployed in the financial services industry
Fighting the “bad guys”
Why is this a concern? Primarily because the “bad guys” are using artificial intelligence (AI), bots, machine learning and other sophisticated methods and technologies. If you’re a bank or insurer not keeping up with that, then you might get yourself into trouble.
Take polymorphic malware as an example of what cyber criminals are doing. This type of malware takes aim at one method companies have relied on in the past to detect bad programs: analyzing subroutines or features. Polymorphic malware takes your program and changes it just subtly enough so antivirus programs can’t detect it, and it uses machine learning to do that. So FS firms should respond with machine learning approaches to detect the malware—to discover whether someone used an algorithm to hide their malware.
I think we’re going to see increasing use of machine learning algorithms by both the bad guys and the good guys.
Another thing we’re seeing out there is cyber criminals really scaling up with automation to make distributed denial of service (DDOS) attacks. One well-known example was the Mirai botnet, a self-propagating botnet virus. It used the Internet of Things (IoT) to attack several types of companies, including banks.
One thing to remember is that IoT devices are running a full computer inside them. So, if you are able to take control of millions of IoT devices and point them at an e-commerce site or a bank’s website, the site is probably going down. Criminals are only able to achieve that result through automation they write to exploit vulnerable devices. So, if the criminals are using machine learning and automation, banks should be using those technologies, too. They should be able to respond in seconds to get unusual traffic blocked or rerouted.
Voice biometrics is the last technology I’ll mention here. Some banking customer service areas are increasingly using this technology to verify a customer’s identity. So, for example, I could simply say, “I’m Chris Thompson” and I’d be good to go. The technology understands my voice patterns. But security researchers have shown that machine learning algorithms can replicate my answers to questions and circumvent the system. So this is another example of how banks should be evolving to counter increasingly sophisticated threats.
Think like a restaurant chain
Turning to an entirely different kind of issue, banks and insurers are finding it increasingly difficult to hire the talent they need in the cyber security space. In the short term, what are they to do? One answer is to think like a restaurant chain. What do I mean? Consider that not every restaurant in the chain is going to have a top-level chef at work. Instead, a few top-level chefs create the menus and then the ingredients and instructions are sent around to all the other restaurants.
In much the same way, a few topnotch cyber security people should be building the scripts; creating better algorithms, automation and machine learning tools; and then using those to equip people working in a security operations center for a large financial services firm.
Machine learning is especially important in this context. If you’ve got to write clever searches in things like Python™ and low-level code, then you’ll need a great number of really sophisticated people in my view. Instead, you want to find a few sophisticated people and then ask them to translate the difficult stuff into a higher-level language that others can use. A security person can ask, “What sorts of things am I looking for?” And then an algorithm can go and find it.
I began by calling AI, automation and machine learning technologies big opportunities for banks and insurers. But in truth, financial services firms should quickly find them to be essential. Criminals are continuously innovating and banks should do the same.
For more information, take a look at our presentation summarizing the economic impact of cyber attacks in financial services.
Cost of Cyber Crime Study, Accenture and Ponemon Institute, February 2018.