Attacks on the financial services industry can result in substantial losses, both for the breached organizations as well as for the customers that trust them to protect their financial information and accounts.
While federal and state regulators are focused on ensuring public trust in financial systems, there are challenges in providing adequate regulations and oversight to properly address the variety of potential issues. Technological advances across the financial services industry have allowed it to grow services and capabilities at a rapid rate, but related technological vulnerabilities have also made it a more attractive target for cybercriminals.
In an effort to address today’s threats and ensure organizations are putting their best effort forward when it comes to cybersecurity, on March 1, 2017, New York Governor Andrew M. Cuomo introduced a “…first-in-the-nation cybersecurity regulation to protect New York’s financial services industry and consumers from the ever-growing threat of cyber-attacks.”
The regulation requires the state financial institutions regulated by the Department of Financial Services (DFS) to have cybersecurity programs to protect private data and keep the industry safe across the state. This includes security governance, risk management, and specific security program requirements, such as 3 rd party and vendor management.
While New York’s latest regulations might be the first of their kind within the state, organizations like the Federal Financial Institutions Examination Council (FFIEC), Federal Reserve System, Federal Deposits Insurance Corporation (FDIC), and other organizations oversee the enforcement of protecting financial systems and the associated data.
Each time a rule or regulation is added to the financial services industry, there tends to be a consistent emphasis on the security aspect of banking operations. The velocity of change for regulations is fairly constant, resulting in new focal areas or emphasis by regulating body auditors. Financial organizations are typically driven by regulators to stay ahead of the security pace experienced in other industries. This requires keeping as technically current as possible by leveraging cutting edge cybersecurity solutions .
Meeting Regulatory RequirementsIt should come as no surprise that New York introduced the latest round of formal cybersecurity regulations. After all, it is a major financial hub within the U.S. With an increasing number of governing bodies distributing new cybersecurity rules and regulations, financial organizations are required to demonstrate the measure they have implemented to meet those requirements.
Many of today’s organizations attempt to adhere to such regulations by adding new devices to their already complex and tangled security structure. While additional devices may temporarily address new threats or regulatory requirements, adding additional overhead to an already complicated environment may not be a good strategy in the long run. Furthermore, security solutions that operate in siloes can be extremely limited in their ability to share information with other security solutions distributed throughout a network. This can create more problems than it solves.
Keeping Pace with the Evolving Threat LandscapeThe security attack landscape is very dynamic. Due to the rapidly evolving network environment, securing the changing threat landscape remains foremost in the minds of security professionals. While governmental action is a positive sign that security is being emphasized, the implementation of policy, legislation, and governmental action tends to lag behind the pace of threat evolution. By design, creating, changing, and implementing laws simply takes time. Unfortunately, cybercriminals move fast, unbound by laws and rules.
The networks of many financial organizations typically are rapidly evolving through the constant addition of new services, applications, and business processes. The velocity of change often creates new attack vectors, exposes the organization to errors due to rapid implementations, or can even change the overall threat landscape due to the adoption of certain technologies.
The diversity of new devices, users, and domains create avenues of exploitation for cybercriminals. With new and increasingly sophisticated attacks being developed daily, network security solutions must be able to automatically adjust to the changing attack surface and provide actionable threat intelligence in real time.
Because an exploit and its resulting damage can happen so fast, it’s not enough to just repair a breach in the system after the fact. Threat intelligence (both existing and emerging) needs to be rapidly distributed across the entire IT environment so vulnerabilities can be recognized and managed prior to or during the early stages of an attack.
The Cybersecurity Skills GapNearly a quarter (24 percent) of today’s IT leaders mark skills shortages as a top concern. Paired with the fact that vulnerable technologies (IoT, mobile, cloud, etc.) are being more broadly deployed and used on a daily basis, this skills gap puts pressure on organizations to find new ways to rapidly and efficiently defend the enterprise IT environment. This requires combining those highly cherished and skilled security professionals with integrated and automated intelligent security solutions.
There are currently thousands of job openings across the U.S. for cyber threat analysts, forensics experts, and incident responders. Technicians with the ability to manage Security Operations Center alerts, support incident response activities, provide IT forensics, or perform threat hunting in an IT environment are in high demand. CISOs recognize the need to balance growing those skills within their organizations with leveraging automation as an offset to the current skills shortage. Such security automation is essential, and Fortinet provides critical industry leadership in this new focal area. Fortinet’s powerful Security Fabric approach allows organizations to seamlessly expand protection, integrate different security solutions together, increase automatic security management and response, and improve the view across the entire connected network environment.
Addressing Security Needs with Fortinet FabricFortinet’s Security Fabric framework provides organizations with the ability to integrate a wide range of security technologies across the IT enterprise, centralize threat intelligence management and orchestration, and automate responses to threats without waiting for human intervention. Creating a synergistic communication capability to and from a variety of security technologies enables rapid threat identification, isolation, and elimination. And because this is all done in an automated manner, it frees up critical and scarce security resources for other needs within the organization.
Security managers are faced with security product challenges at every turn. Next Generation Firewalls (NGFW), endpoint protection systems, Data Loss Prevention (DLP), malware sandboxes, and other security technologies are often purchased as stand-alone technologies, requiring high degrees of integration effort in order to harmonize their functi