Modernizing cybersecurity defenses in banking

A version of this article first appeared in the BAI Executive Report: Navigating effective risk management. You’ll find more insight within on prepping for CRA enforcement, liquidity and credit risk, fraud considerations and more.

In today’s rapidly evolving digital landscape, the banking industry faces a relentless wave of cyberattacks that threaten the foundation of financial security. Cybercriminals employ tactics such as phishing and ransomware attacks to breach banking systems, steal sensitive data, and disrupt operations.

And with emerging threats like ransomware as a service (RaaS), distributed denial of service (DDoS) attacks, organized cybercrime, state-sponsored threat actors, for-sale evasion tools, and a host of others, you must be more vigilant than ever.

A successful cyberattack can result in substantial financial losses, a tarnished reputation and diminished customer trust. The aftermath of a data breach often includes costly legal battles, regulatory fines and extensive recovery efforts to restore compromised systems and data. Most importantly, the erosion of customer confidence can lead to a decline in business as clients seek more secure alternatives.

Develop a modern, layered approach to cybersecurity

If you’ve dealt with cybersecurity for any amount of time, you know that industry experts suggest having a layered, defense-in-depth approach to cybersecurity.

Don’t put too much focus or confidence in any one specific cybersecurity “solution.” MDR, XDR, zero-trust networks, multifactor authentication and even branded offerings from managed security service providers are all potentially good defenses, but by themselves, none can provide all the protection you need.

The bottom line: modern threats require modern cybersecurity defenses.

So, what modern defenses should you have in place ‒ or at least be actively evaluating?

Leverage AI and machine learning

Artificial intelligence (AI) in cybersecurity is revolutionizing the way organizations protect their digital assets and respond to cyber threats. That’s why any modern cybersecurity defense strategy should begin with an exploration of AI.

As cyber threats become increasingly more sophisticated, cybersecurity systems can leverage AI and machine learning (ML) ‒ a subfield of AI that uses data and algorithms to enable AI to learn without explicitly being programmed ‒ to analyze large amounts of data and identify patterns to detect anomalies, predict potential attacks, automate security tasks, and respond to incidents in real time.

By automating repetitive cybersecurity tasks, AI reduces human error, resulting in enhanced efficiency and accuracy. This also translates to cost savings, as security teams are free to focus on higher-level tasks and fewer workers are required for basic monitoring duties. And because AI can handle massive datasets, it’s highly scalable for even the largest of organizations.

Although there are some potential drawbacks of utilizing AI in the fight against cybercrime (data quality and bias, adversarial attacks and privacy concerns, among others), the technology is well on its way to becoming an essential part of financial industry cybersecurity strategies.

With that in mind, look at the cybersecurity areas where you’ll likely need to modernize your defenses.

Secure your internet perimeter

At the very least, you already have some sort of firewall protecting your internet perimeter.

Moreover, you probably have some type of Unified Threat Management (UTM) device combining firewall, VPN, IPS, AV and more into a single integrated unit. UTMs have been around for a while and are a critical cybersecurity component. But when was the last time you reviewed your internet perimeter protection to ensure you’re fully utilizing the latest capabilities?

Modern UTMs, or “next-generation firewalls” as some vendors call them, now have expanded protection features.

Your FW/UTM should be performing deep-packet inspection – inspecting all encrypted HTTPS traffic and other SSL-based traffic as it enters or leaves your network. You should also be leveraging your FW/UTM for sandboxing to analyze unknown inbound files before they ever get to internal devices. And for outbound files, you should enable data leak prevention capabilities to scan for sensitive data and potentially stop files from leaving your network.

Determine if your endpoint protection needs an update

Endpoint protection is the cybersecurity approach to defending endpoints (desktops, laptops, mobile devices, etc.) from malicious activity.

You no doubt have endpoint protection in place. But how modern is it?

Endpoint protection capabilities have advanced tremendously in the past few years. Have you evaluated your current solution to determine if it provides continuous behavioral analysis of device activity? Is your solution monitored and managed 24/7? Are the logs integrated into a security information and event management system for context and analysis? Do you have features like application control and breach containment on the device?

If your endpoint protection can’t do these things – or if you aren’t sure – it may be time to upgrade.

Ask: Does your security information and event management (SIEM) system meet today’s standards?

Monitoring the security information being generated by your systems and applications is crucial. But simply collecting security logs in a central location with basic alerting is not enough.

Modern SIEMs leverage machine learning to perform deep analysis of disparate log data to find activity and threats no human team could discern. SIEMs can also ingest data from more devices, cloud services, and applications than ever before, allowing you to cohesively monitor your entire environment.

With SIEM, your security data can be automatically cross correlated with other organizations’ data, as well as with third-party threat intelligence, to detect suspicious activity before any damage has occurred. With today’s advanced SIEM solutions, you can modernize your log monitoring into proactive threat detection across your entire IT environment.

Modernize now to bolster your defenses

In an industry where trust is paramount, the inability to effectively counter cyber threats can undermine your stability and credibility, emphasizing the critical need for comprehensive cybersecurity frameworks and continuous vigilance.

The best defense against cyber threats is to implement a modern strategy before a cyberattack or security incident occurs. With a combination of diverse, feature-rich cybersecurity software and good digital habits – like regularly updating software, backing up data, and being cautious of suspicious emails and links – you’ll be better prepared to safeguard your financial institution – and your accountholders – from ever-evolving cyber threats.

Eric Gravett is Information Security & GRC Specialist at Jack Henry.