The UK finance industry must improve collaboration with government and law enforcement to disrupt the cybercrime business model more effectively, according to a new report from KPMG and UK Finance.
The report, Staying ahead of cybercrime, claimed that the industry spent a whopping $360 billion on IT in 2016 and spends three times more on cybersecurity than other sectors.
However, as cyber-criminals get better at finding the gaps in the way financial services firms work, the industry must come together to better address the problem.
While organized crime is agile, flexible, transnational and able to recruit and reward success, banks and similar are faced with an IT skills crisis, highly regulated processes, legacy systems and legal constraints, the report argued.
The answer is to work together to make the hackers’ business model less profitable, by reducing their revenue, increasing their cost base and/or making operations more risky.
This could be done by: raising the bar on security across the industry; regulatory reform to improve automated information sharing; active defense to deny criminals access to infrastructure; improving fraud and cybersecurity links to block exploitation of data; blocking cash-out and monetization faster; and working with police to increase the personal risk to the cyber-attacker.
Kirill Kasavchenko, EMEA principal security technologist at Netscout Arbor, broadly agreed with the report’s findings.
“Looking forward, we must admit that some aspects of security threats cannot be mitigated by any single organization alone. Terabit-scale DDoS attacks of 2018 are a good example: if the trend of growing DDoS attacks stays, there will be just a few organizations globally able to handle the threat. Therefore, the industry should be open to collaborate not only on best practices and information exchange, but also on the collective mitigation,” he argued.
“All organizations should be aiming for this proactive stance, rather than wishing attacks away. This is true for all sectors, but more so for financial services organizations who are particularly at risk due to the amount of sensitive data and money they store. The simple truth is that we can do more together than separately.”
Mark Weir, director of cybersecurity at Cisco UK & Ireland, claimed the collaborative spirit could be found in two industry groups: the Cybersecurity Tech Accord and the Cyber Threat Alliance.
“Ultimately, cyber-criminals are continuing to get more sophisticated and powerful, and we need to join forces if we are to ever regain control of the cyber-storm,” he argued.