Cyber-attacks: the financial service sector fights backs

His­tor­ic­ally highly tar­geted by cyber­crim­in­als, fin­an­cial ser­vices are among the most advanced in terms of pro­tec­tion. While they are alert to risks as well as being equipped to anti­cip­ate and avoid them, com­pan­ies must ensure that their sup­ply chain is as resi­li­ent their attackers. 

Aman­da Creak is respons­ible for tech­no­logy risk in Europe, Middle East, Africa (EMEA) for Gold­man Sachs. This “tech­no­logy risk” refers to all threats incurred by the invest­ment bank in rela­tion to digit­al tech­no­lo­gies. Of which there are many – espe­cially for fin­an­cial insti­tu­tions. Nearly 90% of cyber­at­tacks world­wide are motiv­ated by fin­an­cial gain. This involves either simply steal­ing money, hold­ing indi­vidu­als and com­pan­ies to ransom or steal­ing inform­a­tion from sys­tems that can then be resold – data, pat­ents, con­tact details, IDs and pass­words, and so on. 

For a fin­an­cial insti­tu­tion like Gold­man Sachs, cyber-risk is one of the main areas of focus. “Not only are all our pro­cesses digit­ised, but all of our equip­ment is con­nec­ted, from desktop com­puters to print­ers to air con­di­tion­ing! Many of the large fin­an­cial insti­tu­tions like ours attract cyber­crim­in­als,” explains Aman­da Creak. She has been pas­sion­ate about cyber­se­cur­ity since the begin­ning of her career and enjoys the chal­lenge of man­aging a sig­ni­fic­ant secur­ity pro­gram in a large bank. “As an invest­ment bank, we have a lot of con­fid­en­tial and there­fore sens­it­ive inform­a­tion; what we call Mater­i­al Non-Pub­lic Inform­a­tion (MNPI). This is inform­a­tion relat­ing to mer­gers, acquis­i­tions, IPOs, invest­ments, etc. But we are also an online retail bank, so we have to pro­tect our cus­tom­ers from all money-related crimes.” Moreover, risks are evolving rap­idly, and attacks are con­stantly renewed.

How­ever, the secur­ity of a fin­an­cial insti­tu­tion would be use­less if the sup­ply chain was not also highly secure. “We are in a reg­u­lated sec­tor and cyber­se­cur­ity is taken into account in reg­u­la­tions, stress tests, etc. But we need to make sure that our ser­vice pro­viders and part­ners, who are not neces­sar­ily sub­ject to the same reg­u­la­tions as we are, have the same level of secur­ity as we do,” explains Aman­da Creak. It isn’t always easy to ask a sup­pli­er to respect very restrict­ive rules when they are just restock­ing the com­pany with office sup­plies or cof­fee… Sim­il­arly, with the major­ity of staff work­ing from home at the height of the Cov­id-19 pan­dem­ic, solu­tions had to be made for it to be pos­sible to main­tain the same high level of secur­ity at home as in the office. 

For Gold­man Sachs, secur­ity is achieved through defence in depth and lay­ers of con­trols and focus­ing on good cyber hygiene. “We pay atten­tion to fix­ing secur­ity vul­ner­ab­il­it­ies and we strictly con­trol the use of USB sticks, which only a few dozen people can use,” says Aman­da Creak. Attack attempts, intru­sion attempts, ransom attacks, check-ups and patches are reg­u­larly car­ried out to assess the con­sequences and test the resi­li­ence of the sys­tem. The goal: that this insti­tu­tion, foun­ded in 1869, will remain a major play­er in world fin­ance for a long time to come.