Banks confident in cyber security capabilities but lacks real-world testing: Report

Many senior bank executives are confident about their cyber security strategy, yet a lack of comprehensive, practical testing is leaving gaps in their defense, according to a new report from Accenture.

The report, Building Confidence: Solving Banking’s Cyber security Conundrum, is based on a global survey of 275 senior security executives across the banking and capital markets sectors. It found that 78 percent of executives surveyed expressed confidence in their overall cyber security strategy, with more than half the respondents indicating high levels of comfort in their ability to identify the cause of a breach, measure the impact of a breach and manage the financial risk due to a cybersecurity event (cited 51 percent, 51 percent and 50 percent, respectively).

However, the analysis also points to ongoing security challenges for banks. For example, in addition to the many phishing, malware and penetration attacks that banks around the world receive each day, on average, respondents reported that their banks had experienced 85 serious attempted cyber breaches each year. Of these, about one third (36 %) were successful, that is, at least some information was obtained through the breach. In these instances, it took 59% of banks several months to detect breaches that occurred.

Additionally, nearly half (48%) of respondents cited internal breaches as having the greatest cybersecurity impact and 52% indicated a lack of confidence in their organization’s ability to detect a breach through internal monitoring.

“As Indian financial services firms are in the initial stages of adopting digital technologies they have a unique opportunity to set up proper checks and balances to prevent cyber-attacks,” said Piyush Singh, managing director for Accenture’s financial services group in APAC and India. “They should take an enterprise-wide view of cyber security, weed out cyber security protocols operating in silos, tackle the issue as a business priority, and hire and continuously train people skilled in building cyber resilient businesses. They should also focus on deploying practical testing scenarios that include highly realistic simulated attacks. No amount of vulnerability scanning or risk assessment will replicate that.”

While banks’ security teams detected a high number of each company’s breaches, virtually all (99 percent) of respondents said they learned about the remainder of the breaches from their own employees, pointing to the critical importance of establishing strong awareness, strengthening internal training programs and establishing effective internal escalation processes.

According to the report, developing and implementing the right governance model to drive a holistic approach to cyber security is critically important in strengthening a firm’s external and internal defense capabilities. Developing effective capabilities should be driven by a two-pronged strategy: focused cyber security assessments on one hand and comprehensive testing on the other.

Banks Expect Cyber security Skills Shortage

The research also points to several areas where respondents foresee a significant skills shortage, including end-point / network security, incident response and vulnerability management (cited by 61%, 53% and 53%, respectively).

The report complements the recently released Accenture Security Index, in which banking organizations ranked second in a cross-industry evaluation of high-performance security capabilities. Banks received a high rating in eight capabilities, including “what-if” threat analysis and “third party cybersecurity” preparedness. To gauge the effectiveness of current enterprise security efforts and the adequacy of their existing investments, Accenture surveyed 2,000 top enterprise security practitioners representing companies with annual revenues of $1 billion or more. The results of this survey were analyzed in collaboration with Oxford Economics to develop the Accenture Security Index comparing the relative strength of organizations to protect themselves from cyber attacks.