In recent years, the world has seen an alarming increase in cyber-attacks, with new and sophisticated methods being deployed by hackers and cyber criminals. With the increasing reliance on digital technologies for almost all aspects of our daily lives, from personal communication to critical infrastructure and financial systems, the risk of cyber-attacks has become a major threat to our security and well-being.
The pandemic has further exacerbated this situation, with the widespread adoption of remote work and online learning creating new vulnerabilities and opportunities for cyber criminals to exploit. In response to this new wave of cyber threats, organizations must be vigilant and proactive in their approach to cybersecurity, and implement effective strategies to detect, prevent and respond to attacks.
Babita BP, Chief Information Security Officer, Catholic Syrian Bank stated, “Every 11 seconds, there is a cyber attack happening somewhere in the world. What’s even more concerning is that by 2030, it is projected to increase every two seconds. As technology experts, we need to be well-prepared to face these threats. It is crucial to recognize that any technology or digitalization we engage in can be vulnerable to attack, and if an unauthorized person gains access to our system, it can be destroyed in a matter of seconds. This is why the topic of cybersecurity is of utmost importance.”
Shashank Bajpai, Chief Information & Security Officer, Credable shared, “The IT sector has now evolved into the cyber sector, which has led to an exponential increase in internet accessibility. We can see this increase in the uptake of Telecom from 4G to 5G consumption. With the increase in bandwidth, the consumption rate of the Internet is also increasing, leading to a higher demand for various services, including banking. The rise in cyber attacks is not limited to SCADA or Manufacturing systems but is more towards the financial sector. The hacking incentive goes up when systems are transacting finances. It could be insurance, mutual funds, a capital market, or a bank. The hacking incentive for a hacker goes up when they find that it is a banking or financial services network, and they try to plant bugs or any other malicious software.”
He further adds, “There have been numerous reconnaissance attacks on various systems, and hackers try to get the data handled by these systems, end-users, and the geography these systems cater to, and keep hunting for vulnerabilities. Log 4J is a classic example of how a vulnerability existed for a long time but was not exploited readily. However, once the exploit tool came into the market, it was adopted for executing remote code shell execution. As the uptake of the internet has increased, the systems are more connected, and it is allowing hackers to target systems from across the globe.”
Praveen Mishra, Senior Vice President, Yes Bank, stated that recent cyber attacks on big enterprises like Uber by a 17-year-old for fun highlight the intensity of such attacks. The primary reason for the increase in cyber attacks is the availability of vulnerabilities and the increasing knowledge of how to exploit them by New Kids on the Block. State-sponsored attacks and new disruptive technologies like Chat GPT that can quickly provide information on how to perform attacks are other reasons. While financial sectors are still high-priority targets, the pandemic saw an increase in attacks on manufacturing and pharma companies.
He adds, “A recent study predicts that the impact of cybercrime could reach 7.5 trillion by 2025, with ease of access to tools and services and the high return on investment for attackers, driving the increase in cyber attacks.”
Sunil Kumar KN, the Chief Compliance Officer at Federal Bank, stated “Regulatory bodies across the globe have taken a position on not stopping innovations or developments but also not stifling them. The regulators need to protect institutions and customers because the economic and financial risk-taking actions of banks need to be protected only when customers have faith in them.”
“From 2006 onwards, the regulator started the basic framework of outsourcing guidelines, which outlines the need for banks to ensure and do the risk management framework. When cloud computing was introduced in 2018, regulators, such as the financial conduct authority of the UK, wrote to certain banks to go slow and do the risk assessment. All countries started talking about guidance on how security-related aspects and how cloud-related data protection needs to be ensured by banks. In India, outsourcing regulation is the fundamental basis. RBI guidelines and SEBI consultation papers also talk about how banks should deal with particular situations and manage risks appropriately.”
He further stated, “The primary responsibility lies with the institution, and they need to ensure that the appropriate risk management is followed, even if the activity is done by someone else, such as a service provider or fintech. The institution needs to do the risk management and risk assessment appropriately and contractually bind all parties to ensure that all regulatory and legal requirements are met. Recently, RBI has come out with three fundamentals that include taking care of customers, data protection, security, privacy, and confidentiality is the responsibility of the bank.”
“When we ensure all these things, it should be done through a contractual Arrangement, and the institutions need to do regular audits and continuous risk assessments to protect the data of customers. Domestication of the data is coming into the picture, and developed countries have already implemented GDPR. In India, there is still only a single sentence for consent clauses in contracts, but that will change with the digital personal data protection-related activities bill. The regulatory framework is not comprehensive, but it is not archaic or completely innovative, and institutions have a pivotal role to play in protecting the customers, institution, and economy”, he concluded
SV Sundar Krishnan, Chief risk officer, Reliance Nippon General Insurance shared, “I believe that after analyzing various types of attacks, it has become apparent that Insider attacks pose a greater threat than ransomware attacks, external attacks, or other forms of attacks. This is due to the vulnerabilities present in various systems such as databases, operating systems, Wi-Fi networks, and other points of connection, especially now that people are working remotely due to the pandemic. Even if an employee is working from home, there are multiple security measures that need to be in place, such as an authenticated VPN and remote card access.”
He stated, “In the insurance sector, we came up with around 40 to 45 digital controls for remote security access guidelines, but implementing them can be difficult due to budget constraints and adapting to requirements. Insider threats can pose a significant risk to the company’s reputation, especially if data is lost and ends up on the dark web. With the enforcement of Privacy bills, organizations need to ensure that they have adopted all necessary controls and security measures to protect customer data. Even if you transfer the responsibility to vendors and customers through excellent contract management, the reputational risk remains high if data security is not taken care of in an enterprise manner.”
“Cyber risk assessments, reviews, and audits alone are not sufficient. A holistic response is required to mitigate the risk of being attacked, and this is becoming increasingly challenging with each passing month and year”, he concluded.
Stephen Panovsky President and CEO, UBX Cloud shared, “Although it has been mentioned that it is everyone’s responsibility to be security conscious and keep things safe, I strongly believe that the responsibility should start from the top of large organizations. They are the ones who approve budgets and make important decisions, and not making a decision is still a decision. There needs to be an understanding of business loss, business risk, and reputational risk, and all these factors need to be taken into account. Even with the strongest technology for data protection and cybersecurity, an organization can still be infiltrated by insiders such as employees with access, contractors, or trusted vendors. Therefore, it is crucial to look inward as well as outward for threats and constantly challenge the existing security measures.”
Also Read | Panel Discussion: Leapfrogging traditional BFSI: Syncing old with new
He stated, “As someone who runs a cloud services provider, my motivation is to ensure that our customers enter a secure environment by design. Many on-premise infrastructure and information technology deployments come with legacy baggage and complexity that we simplify as an organisation. When a workload is brought to our cloud or a public cloud, we automatically inherit controls that minimize risks, whether it is a financial uplift or taking ownership of the responsibility. However, even with all the security measures in place, we still need to look inward and put in place measures that may not be apparent at board meetings or to the CISO and SOC teams. For example, an accounting person may be motivated to sell information, secrets or access, and this may not be detected by the security teams.”
He further added, “As cloud services providers, we also see the criminal aspect of cybersecurity threats, not just the financial gain aspect. We are often brought in to mediate and move damaged workloads by insurance providers, breach console law firms, or other teams involved in the incident response. These threats are not always visible, and it is essential to protect the inside as much as the outside. Convincing decision-makers that the risk is real is critical, and they cannot rely on one vendor or technology. It takes an entire assortment of offensive and defensive weapons to manage cybersecurity threats. Unfortunately, cloud services providers, systems engineers, and data protection specialists are often the ones put in charge of solving these challenges and thinking two steps ahead of the criminals.”
“One critical element of cybersecurity is insurance. Cybersecurity insurance is becoming more popular and necessary to protect businesses’ continuity, intellectual property, and services. Insurance companies are stepping in to provide public relations services and protect businesses’ information, just as they protect the environment. The outlook needs to shift to protect the business’s intellectual property, knowledge, and sweat equity that went into the products and services. The people on the panel are catalysts for change and need to demand more from insurance providers and vendors. Cybersecurity threats can be business extinction events, and they need to be handled carefully; otherwise, a business might be gone tomorrow”, he concluded.
Elets The Banking and Finance Post Magazine has carved out a niche for itself in the crowded market with exclusive & unique content. Get in-depth insights on trend-setting innovations & transformation in the BFSI sector. Best offers for Print + Digital issues! Subscribe here➔ www.eletsonline.com/subscription/
