Connect with us

Cyber Security

The Evolution of Cybersecurity in Banking



By Ricardo Ferreira, EMEA Field CISO at Fortinet

Changes in the banking sector associated with new digital initiatives have ushered in unprecedented cybersecurity risks. As highlighted in recent reports, key activities in the financial ecosystem can be disrupted by cyber incidents, so risk management and secure network protocols are paramount. With cybercriminals relentlessly pursuing financial gain, data breaches have become more frequent and sophisticated, underscoring vulnerabilities in the banking sector.

Regulatory approaches, such as EU DORA, G7, and reports from other central banks and regulators, emphasize the critical importance of cyber resilience in the banking sector. These regulations are reactive measures to past threats and proactive strategies designed to anticipate and mitigate future risks. Characterized by continuous digitization, increased third-party dependencies, and geopolitical tensions, the evolving cyber threat landscape demands a robust response from financial institutions.

Central Bank Digital Currencies (CBDCs) add another layer of complexity. As CBDCs gain traction, they present both opportunities for financial inclusion and challenges in terms of cybersecurity. In this competitive landscape, where traditional banks, financial technology disruptors, and digital-native challenger banks strive for market share, delivering a seamless digital experience is crucial. However, institutions must not lose sight of potential vulnerabilities as they race to innovate. Embracing digital technologies is essential, but so is ensuring that these technologies are safeguarded against ever-evolving threats.

As banks and financial services providers continue to grow and innovate, a holistic approach to cybersecurity informed by the latest regulatory insights and threat intelligence will be crucial to ensure sustainable and secure progress.

Cybersecurity in Banking
In the rapidly evolving digital landscape of banking, cybersecurity teams are at the forefront of a complex battle. The financial sector is particularly vulnerable to cyber threats, including significant data breaches. The financial sector is a favourite target for attacks seeking financial gain, trade secrets, or service disruptions that bring publicity to social or political causes. In fact, financial and cybercrimes are now top global policy concerns, according to a new INTERPOL report.

Depending on the severity of the attack and the specific bank in question, a single successful breach can lead to serious damage to the brand. According to the European Union Agency for Cybersecurity (ENISA), more than 10 terabytes of data are stolen monthly, and more than 60% of organizations may have paid ransom demands. Another report states that 2022 was the biggest year ever for crypto hacking.

As digitization becomes an even greater necessity across the banking industry and security risks increase, executive teams need to ensure the resiliency of their business operations, compliance with government and industry regulations, and the effectiveness of their cybersecurity infrastructure to protect the expanding attack surface.

Financial services providers must defend against an onslaught of data breaches, ransomware, malware, phishing, and social engineering attacks growing in sophistication, frequency, and intensity. The challenges of fending off threats increase as the attack surface expands in breadth and complexity. In its 2023 Global Cyber Risk Outlook, Moody’s states that regulators and insurers are taking actions to reduce financial exposure to cyberattacks, and at the same time, demand for cyber insurance will outweigh supply.

To remain competitive and resilient in this environment, financial institutions must continue to innovate and ensure that those innovations are secure. This dual mandate becomes even more challenging given the expanding attack surface, driven by the rise of digital banking, fintech disruptors, and the introduction of CBDCs and the modernization of their core systems. Key cybersecurity imperatives for banking include:

  1. Visibility. Maintaining comprehensive network visibility is paramount with the proliferation of mobile banking, IoT integrations, and cloud deployments. As the cyber threat landscape becomes more intricate, having clear oversight of all network activities is crucial to prevent data breaches and manage cybersecurity risks.
  2. Automation and operational efficiency. The era of siloed security solutions is fading. Modern cybersecurity demands integrated solutions that can automate tasks, reducing the need for manual configurations and constant monitoring. Implementing “policy as code” can further streamline this process, ensuring that security policies are consistently and automatically enforced across a secure network.
  3. Flexibility. The diverse IT architectures, spanning multi-cloud and on-premises deployments, necessitate agile security controls and policies. As financial institutions navigate the complexities of digital transformation, their security solutions, including policy as code practices, must be adaptable, ensuring that security policies align seamlessly with infrastructure changes.
  4. Compliance reporting. Regulatory compliance is not just a checkbox exercise. With central banks and other supervising authorities emphasizing cyber-resilience regulations, security teams must strike a balance between adhering to these regulations and proactively defending against cyber threats. Utilizing policy as code can also aid in ensuring compliance by codifying and automating policy checks.

Lastly, the human element cannot be overlooked. Beyond state-of-the-art technology, financial institutions need skilled professionals who can harness the potential of new platforms and systems. The limited availability of specialists in niche areas and a potential knowledge gap in understanding intricate products, processes, and systems pose additional challenges.

As the banking sector continues its digital journey, a holistic, informed, and agile approach to cybersecurity, adopting and succeeding at digital initiatives to converge network and security, reskilling the workforce, and driving automation will be the linchpins of success. Ensuring a secure network and effective risk management in the face of potential data breaches and evolving threats is paramount.

Cybersecurity Regulatory Impacts
Although the banking sector is a beacon of financial stability, it is increasingly grappling with dual challenges: ensuring robust cybersecurity and adhering to evolving regulations. As financial institutions strive to meet customer demands and counteract cybersecurity risks, they are simultaneously navigating a labyrinth of stringent data privacy and security regulations. These regulatory measures, coupled with the expanding digital landscape, have inevitably escalated operating costs, particularly in the realms of compliance for both retail and corporate banks.

The imperative for heightened security and compliance in banking is underscored by the need to protect sensitive personal data, maintain transactional integrity, and safeguard the health of national and global economies. Yet, a recent International Monetary Fund (IMF) survey paints a concerning picture of the regulatory landscape. Covering 51 countries, the survey revealed:

  1. 56% of central banks or supervisory authorities lack a dedicated national cyber strategy for the financial sector.
  2. 42% lack specific cybersecurity or technology risk-management regulation, and a staggering 68% do not have a specialized risk unit within their supervisory department.
  3. 64% have not mandated testing or provided guidance on cybersecurity measures.
  4. 54% do not possess a dedicated regime for reporting cyber incidents.
  5. 48% are without specific regulations addressing cybercrime.

While these statistics might paint a bleak picture, it’s essential to view regulatory and security requirements not as hindrances but as catalysts for innovation and risk management. For example, McKinsey highlights the potential of data analytics in banking, suggesting that it can lead to risk-reduction savings valued at up to $1 billion annually for some large banks. These savings encompass reduced fines, enhanced compliance reporting accuracy, improved management of sensitive data, and the mitigation of various other risks.

As the banking sector continues its digital evolution, striking a balance between innovation, cybersecurity risks, and regulatory compliance will be pivotal. Embracing this triad can unlock unprecedented opportunities, ensuring a secure, compliant, and forward-looking financial landscape.

Cybersecurity Risk Management for Banks
Cyber-risk management in today’s banking landscape extends beyond technical measures to encompass a holistic, organization-wide approach. However, many institutions grapple with limited tools to gauge cybersecurity risks, especially when integrating new digital partners and technologies.

Recent regulations emphasize operational resilience, advocating for a globally aligned risk management framework. This international convergence seeks to standardize practices, reducing fragmentation. A notable aspect of these regulations is the scrutiny of third-party providers, given their growing significance in the financial ecosystem.

While banks are traditionally cautious in IT vendor selection, the rise of innovative startups offers a number of promising solutions. Yet, this openness must be balanced with due diligence, especially when third-party relationships can introduce cybersecurity vulnerabilities. As banks evolve digitally, a harmonized approach to risk management that considers global regulations and third-party integrations is essential for a secure and progressive banking sector.

Banking Cybersecurity Challenges 
Historically, banks have operated as siloed entities. Distinct departments, each with unique objectives, often rely on separate systems. This fragmented approach has inhibited growth, restricted scalability, and diminished customer satisfaction. Traditional banks, particularly, have garnered a reputation for cumbersome processes, especially when customers seek new services or support.

Implementing a unified platform that centralizes data and bridges the gap among various systems can effectively counteract the challenges posed by these silos. However, information silos also amplify cybersecurity risks, data breaches, and compliance concerns beyond operational inefficiencies, which are all pressing issues in today’s banking landscape.

The integrity of the IT infrastructure and the vast amount of data it houses remain a paramount concern in banks’ digital transformation journey. Addressing technical debt is crucial. This debt is often a byproduct of historical underspending and the juxtaposition of modern technologies atop outdated infrastructure. To navigate these challenges, banks should establish dedicated units or expert teams focused on innovating and ensuring that their offerings remain competitive. Assigning clear responsibilities for these innovation projects is pivotal.

Gone are the days when IT security in banking was a linear affair. Today’s banking ecosystem comprises tens or even hundreds of thousands of interconnected devices ranging from computers to Internet-of-Things (IoT) integrations. And when the proliferation of social, cloud, and mobile channels is factored in, the potential attack surface for data breaches and cybersecurity risks magnifies exponentially. The pressing question remains. How can banks ensure a secure network amid such vast complexity?

Although the need for financial organizations to embark on digital initiatives is essential, it accentuates the need for scalable security and compliance solutions. As banks evolve, the scalability offered by Software-as-a-Service (SaaS) solutions becomes indispensable, especially in the retail banking sector. Organizations must ensure that risk management remains agile and responsive to the ever-expanding digital landscape.

Secure Networking Solutions for Financial Organizations
Whether an organization has cutting-edge or legacy technology, infrastructure vulnerabilities can become prime targets for cybercriminals. As these adversaries relentlessly exploit weaknesses, financial institutions face the potential for significant financial losses, operational downtime, brand damage, and regulatory fines. Financial leaders must prioritize the resilience and overall health of their institutions.

Financial institutions should consider converging networking and security into a single secure networking solution to address these challenges. They can apply consistent threat intelligence and security services by consolidating disparate point products into an integrated cybersecurity platform.

Key features of an ideal security solution include:

  • Visibility: Comprehensive oversight across the entire digital attack surface
  • Advanced protection: Defense mechanisms against threats that are growing in volume and sophistication
  • Intelligent integration: Seamless integration within a smart IT architecture
  • Automation: Leveraging technology to address the shortage of skilled human talent
  • Simplified compliance: Streamlined processes to ensure adherence to data privacy regulations

Cyber Security

Cybersecurity Collaboration Holds Immense Significance in Today’s Threat Landscape



Ertug Ayik, the VP and MD of Middle East and Africa at HP, speaks about the security threat landscape in the region and what companies can do to keep these threats at bay

Tell us about the security threat landscape in the region. How has it evolved over the years?
The security threat landscape in our region, like many others, has evolved significantly over the years. We have witnessed a shift from primarily isolated attacks to a complex and interconnected threat landscape. Threat actors are becoming more sophisticated, and attacks are increasingly targeted and financially motivated.

Emerging technologies, such as IoT and cloud computing, have introduced new attack vectors. The shift to the cloud has also made cybercrime easier, cheaper, and more profitable. Traditional security measures have focused on detecting malware to prevent attackers from gaining access to critical systems. Over the last year, we have seen signs of increased development and trading capabilities – from tools to hack BIOS passwords, to rootkits and trojans targeting device firmware.

Organizations must adapt to this dynamic environment by implementing proactive security measures and staying informed about evolving threats. Increased resiliency, meaning, the ability to respond to hackers who have managed to exploit a vulnerability, is key.

What sort of role does the security community play in countering cyber threats?
The security community plays a crucial role in countering cyber threats. It serves as a collective defence mechanism against the ever-evolving threat landscape. Security professionals, researchers, organizations, and governments collaborate to share threat intelligence, insights, and best practices. This collaboration fosters a deeper understanding of emerging threats, enables rapid response to incidents, and enhances detection and mitigation capabilities.

Additionally, the security community contributes to raising awareness about cybersecurity and promoting proactive defence strategies. HP Sure Click, one of our key security solutions, not only protects users from various cyberattacks but also contributes to this collaborative ecosystem. Its containment-based approach enables us to capture and analyse malware execution traces, providing valuable insights to the security community. Collaboration with industry experts and leveraging threat intelligence providers empower us at HP to better identify and evaluate emerging threats before they pose significant risks.

Tell us about HP’s HP Sure Click. How does it help in keeping security threats at bay?
HP Sure Click is a groundbreaking security solution that plays a pivotal role in safeguarding against security threats. It leverages cutting-edge micro-virtual machine technology to create secure environments for handling untrusted content. By isolating potentially malicious activities within these secure micro-VMs, HP Sure Click prevents threats from spreading to other parts of a network.

HP Sure Click goes beyond safeguarding web browsers; it extends its protection to cover documents like PDFs and Microsoft Office files. This approach ensures that even if a file is compromised, the malware within it remains contained and cannot infect the user’s device. HP Sure Click also quantifies risks by recording how users encounter threats, whether through email attachments, browser downloads or clicking on links.

These insights reduce known risks and may even uncover previously unknown risky user behaviours that can be addressed at an organizational level. HP Sure Click automatically maps attack attempts to MITRE ATT&CK, an industry knowledge base that enables organizations to understand the techniques that attackers are using against their organizations and prioritize their defences based on the threats they face.

By employing HP Sure Click, organizations can proactively defend against malware attacks, enhance their cybersecurity posture, and maintain a secure computing environment.

What are the significance and benefits of cybersecurity collaboration in terms of public reporting, sharing analysis tools, and collaborating within trust groups to enhance collective knowledge and response capabilities?
Cybersecurity collaboration holds immense significance in today’s threat landscape. We all have different vantage points of the threat landscape so by engaging in collaborative efforts such as public reporting, sharing analysis tools, and participating in trust groups, the security community amplifies its collective knowledge and response capabilities. This approach helps in several ways.

Firstly, public reporting of cyber threats raises awareness and allows organizations to tackle emerging threats proactively. Secondly, the sharing of analysis tools accelerates the identification and response to cyberattacks, enabling faster mitigation. Thirdly, trust groups foster a sense of shared responsibility, trust, and mutual support within the security community. Collaboration within these groups promotes a more coordinated and effective response to threats.

HP recognises the importance of such collaboration and actively contributes to the security community by sharing insights and analysis through research and publications.

What are the challenges of cybersecurity collaboration, and can these be overcome?
In the realm of cybersecurity collaboration, we encounter a multitude of challenges that demand careful consideration. The foremost among these challenges is the reluctance to share sensitive information due to concerns about data privacy and security. However, to effectively counteract evolving threats, it is important that organizations overcome this hurdle by anonymizing data and following robust security protocols for information exchange. Organisations can consider participating in collaboration platforms that ensure confidentiality while also implementing clear legal and governance frameworks designed to protect shared information.

Building trust requires establishing strong relationships among all parties. Another formidable challenge lies in the allocation of resources required for seamless collaboration. Coordinating efforts across diverse entities can be resource-intensive, necessitating efficient resource pooling and allocation. To surmount these challenges, industry groups can play a pivotal role in facilitating collaboration and distributing resources effectively. Moreover, the establishment of standardized legal agreements can provide a solid foundation for secure information sharing.

Ultimately, the cornerstone of successful cybersecurity collaboration rests on trust. Fostering trust among collaborators is an ongoing process that hinges on transparent communication, the diligent protection of shared data, and a unified commitment to bolstering collective security efforts. By addressing these challenges head-on, we can collectively fortify our defences against the relentless evolution of cyber threats.

Continue Reading

Cyber Security

42 Abu Dhabi Hosts Coding Hackathon in Collaboration with Al Hathboor



42 Abu Dhabi, the UAE capital’s innovative and disruptive coding school that provides a unique peer-to-peer, gamified learning methodology, held a hackathon titled “AI See a Solution: Computer Vision Hackathon 2023” from 13-14 September. The hackathon was held in collaboration with Al Hathboor, a cutting-edge solutions provider dedicated to spearheading technological advancements for businesses and governments.

This two-day hackathon aimed to foster innovation and creativity among students by challenging them to harness the power of coding to solve real-world problems using AI. The event kicked off with a workshop on the first day, focusing on Computer Vision using Python Frameworks, Python Libraries, Open-source Models, and Datasets. Through the workshop, students gained valuable insights and skills essential for the hackathon, ensuring they are equipped to tackle the challenge ahead.

The team that won first place, including Ahmed Salem, Ghaiath Abdoush, Shatha Jadallah and Nousheen Ali, developed ‘Sawt AlRu’ya,’ an application which utilizes cutting-edge computer vision and AI technology to analyze live video streams, convert them into real-time textual descriptions, and seamlessly translate them into spoken words using a Large Language Model (LLM). By providing immediate audio feedback, ‘Sawt AlRu’ya’ empowers individuals with visual impairments to interact with their surroundings, effectively enhancing their daily lives and fostering inclusivity.

The second-place champions, including Avazbek Rashidov, Timur Mazitov, Zubaydullo Abdirakhmonov, and Nauman Munir, developed “Visulaw”, a tool which empowers users to capture photos of objects and instantly receive location-specific information about relevant fines and laws associated with those objects. This web application enhances user awareness and compliance with local regulations, fostering safer and more informed interactions with everyday objects.

Marcos Muller Habig, Acting CEO of 42 Abu Dhabi, said, “We were thrilled to host the hackathon in collaboration with Al Hathboor, which served as an opportunity for our students to showcase their talents and unleash their creativity. The hackathon empowered 42 Abu Dhabi’s students to leverage their coding skills to develop advanced technologies which can drive meaningful change within the community. This cements our leading position as a talent incubator that is upskilling a new generation of coders who are equipped to accelerate the Emirate’s digital transformation and make a positive impact on society.”

Raj Sandhu, General Manager of Al Hathboor, said, “We at Al Hathboor are proud to collaborate with 42 Abu Dhabi in spearheading technological advancements through coding and practical sciences. AHB is pleased to be part of the very first Computer Vision hackathon in collaboration with 42 Abu Dhabi. We extend our appreciation to the participants and 42 Abu Dhabi Faculty’s unwavering support, and we look forward to future collaboration opportunities.”

Continue Reading

Cyber Security

Chinese Malware Appears in Earnest Across Cybercrime Threat Landscape



Since early 2023, Proofpoint has observed an increase in the email distribution of malware associated with suspected Chinese cybercrime activity. This includes the attempted delivery of the Sainbox Remote Access Trojan (RAT) – a variant of the commodity trojan Gh0stRAT – and the newly identified ValleyRAT malware. After years of this malware not appearing in Proofpoint threat data, its appearance in multiple campaigns over the last six months is notable.

The phrase “Chinese-themed” is used to describe content related to this malicious activity, including lures, malware, targeting, and metadata that contains Chinese language usage. Campaigns are generally low-volume and are typically sent to global organizations with operations in China. The email subjects and content are usually written in Chinese and are typically related to business themes like invoices, payments, and new products. The targeted users have Chinese-language names spelled with Chinese-language characters, or specific company email addresses that appear to align with businesses’ operations in China. Although most campaigns have targeted Chinese-speaking users, Proofpoint observed one campaign targeting Japanese organizations, suggesting a potential expansion of activity.

These recently identified activity clusters have demonstrated flexible delivery methods, leveraging both simple and moderately complex techniques. Commonly, the emails contain URLs linking to compressed executables that are responsible for installing the malware. Proofpoint has also observed Sainbox RAT and ValleyRAT delivered via Excel and PDF attachments containing URLs linking to compressed executables.

Research into additional activity clusters utilizing this malware demonstrates enough variety in infrastructure, sender domains, email content, targeting, and payloads that researchers currently conclude that all use of these malware and associated campaigns are not attributable to the same cluster, but likely multiple distinct activity sets.

The emergence and uptick of both novel and older Chinese-themed malware demonstrates a new trend in the overall 2023 threat landscape. A blend of historic malware such as Sainbox – a variant of the older Gh0stRAT malware – and the newly uncovered ValleyRAT may challenge the dominance that the Russian-speaking cybercrime market has on the threat landscape. However, the Chinese-themed malware is currently mostly targeted toward users who likely speak Chinese. Proofpoint continues to monitor for evidence of increasing adoption across other languages.

With this resurgence of Chinese-themed malware, the question arises: is the impact of older malware easier to detect due to its age? Does mature detection always mean mature security? Based on Proofpoint’s analysis, the answer is not necessary, as older malware can still be effective, especially when threat actors constantly change tactics by rotating IPs, domains, encoding, and obfuscation. Consequently, even though these malware families are not new, organizations cannot afford to underestimate the risk they pose.

Proofpoint research suggests that this activity does not seem to be related to a single entity but rather appears to be a cluster of activities based on temporal patterns. The appearance of ValleyRAT alongside the older families hints at the possibility of their relationship in terms of timing. Proofpoint anticipates ValleyRAT will be used more frequently in the future.

Raising awareness in 2023 about the reappearance of these threats serves as an informational bulletin for the community. While new and sophisticated threats seemingly dominate the daily threat landscape, it is essential to maintain a balanced perspective by acknowledging seemingly less significant risks that persist. Despite being neither new nor advanced, Sainbox RAT still poses a threat in 2023, and ValleyRAT is an emerging threat in this space.

Continue Reading

Follow Us


Copyright © 2021 Security Review Magazine. Rysha Media LLC. All Rights Reserved.