The 2017 Sibos conference, a global financial services networking event organized by SWIFT that took place this year in Toronto, was awash in cybersecurity sessions.
While sitting on the “How to Manage a Cyber-Security Crisis” panel in October, Ali Arasteh, a senior director at FireEye-Mandiant, said there is little variability in the ways and methods attackers get data or in the information they are looking for. As a result, it would behoove companies to share information with each other.
Vas Rajan, a chief information security officer with CLS Group who was on the same panel, posed the following questions: “The willingness to share information is one thing, but do you have the channels in place to share securely? Is your response plan such that it includes your legal department? Do you know who you want to share it with, and do you know how to share and avoid liability?”
Planning how best to share information across platforms, says Rajan, is one of the most important first steps in managing a crisis.
Will Carter, deputy director of the technology policy program at the Center for Strategic and International Studies, said during a separate cybersecurity session at the conference that “defenders always have a narrower view of what constitutes a computer than hackers.”
He pointed to the “internet of things” and how so many consumer products are digitized and connected to the internet, opening up “a whole new variety of weapons that can be exploited by attackers, whether they want to steal money, extort, steal personal information, or steal information that can be used against citizens.”
Attackers recognize that devices outside of a bank’s system can be used to launch attacks on that bank. Carter noted that mobile devices are vulnerable to hackers, as banks build out their technology infrastructure so more consumers can perform banking transactions without having to visit a branch.
“This is changing the geography of cybercrime,” he said, as attacks can be launched from anywhere. “Places like Latin America and South Asia have really become hubs of criminal activity.”
There was conference chatter about the $81 milllion hack of Bangladesh’s central bank that was widely reported last year. The Wall Street Journal said in a May 2016 report that Bangladesh officials had suggested that some blame lies with SWIFT, or the Society for Worldwide Interbank Financial Telecommunication, which operates a messaging system among banks.
Another session at Sibos focused on the language of cybersecurity.
All the data, sharing of information, and security can go only so far without speaking the same jargon. Generally, there are too many terms that mean too many things, according to Jason Ferdinand, the founder of consulting firm IKSM and creator of Europe’s first MBA in cybersecurity at Coventry Business School.
“What we want to do is create a taxonomy and similar terminology which will allow people to align themselves properly to take steps in case of an attack,” he said.
Building on that same theme, in yet another session on cybersecurity, Abeer Khedr, the information security director for the National Bank of Egypt, said senior management is less interested in the technical issues and more interested in the risks to the bank and its systems.
“You should be able to explain issues to them in business terms,” Khedr explained. “It demonstrates to management where the risks are.”
