The Fundamentals Behind a Financial Service Cyber Security Strategy

Cyber security breaches have the potential to cause significant damage across a range of industries.

Generally speaking, the financial services industry requires more risk-aversion due to the specific threats it faces, including:

• Industry regulations: these can result in serious financial implications, as well as reputational damage if they’re not adhered to
• High exposure: the sensitivity of the data they hold, and its potential value to bad actors, can see financial services organisations become a prime target for cyber attacks 

In recent years, financial services have seen some of its biggest data breaches. This includes the 2017 Equifax breach, which saw the names, social security numbers, telephone numbers, and email addresses of 143 million accounts in the United States and 400,000 in the United Kingdom exposed. 

Recent shifts towards remote working have also contributed to additional cyber security risks. Moreover, the economic disruption caused by lockdown restrictions has led to many organisations, including those in financial services, looking to reduce operational costs. As a result, the delivery of high-quality and efficient cyber security is as vital as it has ever been.  

Here at Six Degrees, we’re well aware of the importance of effective cyber security in the financial services industry. In this blog, we will look at the four pillars vital to an enhanced cyber security strategy, and explain how these can satisfy the demand for first-class protection from cyber attacks, while simultaneously reducing costs. Let’s get started.

Suggested Reading: If you’re interested in being able to explain the value of cyber security yourself, check out our free resources — Board Presentation Toolkit: Cyber Security and Threat Management.    

Pillar 1: Embrace the Cyber Security Journey

The cyber security threat landscape is constantly growing and evolving, and financial services companies are often high-profile targets. In the first half of 2018 for example, UK financial services businesses saw losses of £705.7 million due to fraud. As a result, vigilance is imperative. 

Work tools change, new practices emerge, and cyber threats are becoming more sophisticated. To counter this threat, cyber security must become an ongoing, iterative process. 

How can your financial services business deliver more efficient protection with the rising threats? The answer lies in orienting towards your objectives with a pragmatic approach. You need to:

1. Accept that no organisation can ever be 100% secure from cyber threats.
2. Build a fluid and agile system that can respond flexibly to uncertainty, change, and new information.
3. Incrementally improve that system one step at a time.    

This process is something we call the cyber security journey at Six Degrees. It involves a five-step iterative review process of your organisation and cyber security capabilities — illustrated in the diagram below.

Strategies to help:

Using the cyber security framework, you can increase efficiency by moving the goalposts away from achieving impossible perfection to creating a functional system that uses real-world feedback to improve itself one piece at a time. 

Additionally, if your security budget tightens, the cyber security journey creates opportunities to execute operations that allow you to demonstrate the value of security investments faster. A major problem with securing cyber funding is connecting it with ROI, and your ability to support new projects and application rollouts earlier will help you build a more robust system over time. 

Finally, a shift in strategy can be achieved without significant investment. Finding new, efficient processes means you can do more with less, all without sacrificing security. Ultimately, that is what an iterative approach is all about, and why it needs to be central to your strategy. 

Pillar 2: Create Flexible Response Capabilities

The disruption caused during 2020 underlines the importance of employing a flexible approach to cyber security. Many processes and policies designed to work in a pre-pandemic world have become outdated and insufficient. Investment in a flexible and agile response capability gives an organisation the manoeuvrability to adapt to changing circumstances.

However, budget restrictions leave security managers in a tight bind. Security expectations haven’t changed, but finding cost-effective solutions has become significant. Understanding and embracing the cyber security journey is part of a flexible approach to cyber defence. However, that is just a framework for success. You need to use that approach to identify tactical choices you can make to improve flexibility on the macro and micro scale.  

Strategies to help:

One approach that fits the ‘doing more with less’ ethos is Managed Detection and Response (MDR) in conjunction with endpoint security. 

• Endpoint security is a flexible solution that seeks to protect your system by monitoring flows of information from end-user devices — endpoints.
• MDR is a fully managed solution in which an outsourced incident response team monitors your system to respond to threats in real-time. 

Endpoint solutions create a scenario in which threats can be flagged before they become a breach — limiting exposure to specific endpoints. MDR then allows for the rapid response to those threats, preventing them from over becoming a breach. The flexibility for this combination allows organisations to engage with remote working in a far safer manner. MDR is more cost-effective than an in-house solution because of your ability to only pay for cyber security resources when they are needed — keeping costs down while improving results.   

To learn more, read What is MDR?

Suggested Reading: For more information on endpoint and MDR, check out our guide — Planning for the Future of Cyber Security Today.

Pillar 3: Understand Your Risk Appetite

Any effective cyber security strategy for a financial services business needs to start with one crucial question: What is your risk appetite? Due to the inherent nature of cyber attacks, no organisation is ever 100% free from risk. Within financial services specifically, it’s crucial to act preemptively to address ever-evolving cyber security threats. 

Unfortunately, you can’t implement every security measure you’d ideally like. At some point, you have to accept your limitations and weigh up which type of risk exposure would be most harmful to your organisation, and prioritise your defences around that.     

As a result, cyber security investments must be made to align with your organisation’s appetite for risk. In financial services, security breaches can lead to the exposure of high volumes of confidential data. This can result in regulatory sanctions and reputational damage, which carry an additional threat themselves, necessitating a robust cyber security strategy.   

Suggested Reading: For a better understanding of how cyber security deficiencies can impact your organisation, take a look at our blog — How to Conduct a Cyber Risk Assessment: 5 Steps to Success.

Strategies to help:

Financial services organisations must factor in that when considering improvements to their cyber security strategy, ultimately, they are presented with the dilemma of pay now or pay later. 

By paying attention to potential cyber security risks — and taking a proactive stance — a small upfront investment can save your organisation from vast financial and reputational costs in the future. When it comes to security, prevention is better than a cure.

Additionally, by understanding your organisation’s risk appetite, you can focus your priorities on the main threats. This lean operating model eliminates unnecessary tasks, which reduce costs. However, cutbacks like this can create risks and vulnerabilities. Again, understanding your risk appetite is crucial when prioritising your focus.

Pillar 4: Leverage Strategic Partnerships

To achieve a more efficient and streamlined operation, third-party strategic partnerships can make a great deal of sense for your organisation. Fundamentally, outsourcing can improve quality while increasing efficiency. This is for three main reasons: 

• Economies of scale: By using a strategic partnership, you get access to an industry-leading cyber security team that does nothing but cyber security. This enables that organisation to be more efficient with their investments and pass savings on to you.

• On-demand access: Partnerships allow you to access experts when you need them, rather than building an in-house team that you need to pay all of the time. For example, MDR provides access to 24×7 monitoring. But you only need to pay for the incident response capabilities when a threat surfaces. 
• High-quality: The cyber security skills shortage means that access to specialist staff is limited and highly expensive. By using a strategic partnership, you can ensure that they’ve got the staff with the tools and skills to keep up with the changing threat landscape. 

Strategies to help:

Staying ahead of cyber security trends, including those accelerated by COVID-19, is no easy task in the context of financial services, so strategic partnerships with cyber security experts can be used to supplement or manage the entirety of your online security. By outsourcing these concerns, organisations can focus on their core competencies and benefit from a well-trained team that is on-trend and informed about the latest concerns and risks in the cyber security space. 

Selecting the right partnership is the first and most important challenge. Look for flexibility, expertise, and a range of quality services that align with your business needs. Fundamentally, strategic security partners should be willing to work with you to identify the right solution for your organisation and help you better understand the critical security needs on which you should focus.

Suggested reading: For more information on the value of cyber security partnerships, check out our blog — Four Ways Strategic Partnerships Improve Cyber Security.

Six Degrees Can Help

Economic uncertainty has seen financial services organisations tighten their belts even as they deal with the consequences of a shift towards remote working. This has forced businesses to reconcile these two positions and try to do more with less when it comes to cyber security.  

The increased speed and consequences of cyber attacks necessitate a balance between being open and being secure. As attacks rise and regulators scrutinise the pressure mounts. By adjusting your framework, creating a flexible response, and garnering an understanding of what risk means to your organisation, you can maintain and increase security without considerable investments. 

At Six Degrees, we’re committed to using our experience to deliver a range of on-demand services, as well as using our knowledge to mitigate the cyber threats posed to the financial services industry, including enumeration attacks and business logic flaws. 

Partnering with an expert cyber security team gives you access to efficient and effective cyber security solutions, and can assist in delivering optimised outcomes within the financial services industry. If you’re looking to build a safer future with enhanced flexibility get in touch today.

Suggested Reading: For more information on what a partnership with Six Degrees can deliver, check out our blog — The Six Degrees Approach to Cyber Security.