Technology is a part of everything that financial institutions do, but adopting new technologies across businesses comes with
increased cyber risks. It is therefore likely no surprise that respondents ranked rapid IT changes and rising complexities as the No. 1 challenge in managing cybersecurity (figure 5) for the last three years, while the second biggest challenge was the
unavailability of skilled cyber professionals to help secure systems in such a rapidly evolving IT environment.
At the same time, business growth and expansion, a rising challenge according to respondents in our 2019 report, may recede for the time being, as companies have generally shifted focus from growth to pandemic response and recovery.
More and more financial institutions are using emerging technologies to innovate and develop new products, services, and digital channels. But these critical enablers could become the target of additional cyberattacks. Thus, embedding cybersecurity into new products and services and new channels remain the top two business issues with security implications at large financial institutions surveyed (figure 6).
New products and services: Financial institutions today are often competing as well as collaborating with fintechs on product and service innovation. As companies strive to be first to market, these innovations often require speed and flexibility to be successful. However, companies should ensure that enough precautions are taken in designing, building, and utilizing new innovations, as new cybersecurity threats could emerge during any of these stages. The challenge for an organization’s cybersecurity function is to create controls commensurate with the additional risk being taken on, without being perceived as a roadblock to innovation.
New channels: Companies often seek newer, easier ways to do business with customers, but newer channels may come with their own set of cyber vulnerabilities.
Take augmented or virtual reality (AR/VR), for example. Even as financial institutions experiment with using AR/VR to interact with clients, hackers have devised sophisticated cyberattacks to compromise AR/VR applications and devices, which could potentially cause serious physical or financial damage. Traditional cybersecurity controls might not be well-suited to protect against these attacks.
Cybersecurity functions should assess the need to digitize and enhance their controls to adapt to and protect these new digital channels. Companies should also consider adopting “security-by-design” principles, where customized security controls are developed and embedded into the core structure of new channels as they are established and operationalized.
Cost reduction was already much on the minds of respondents, ranking third in each of the past two surveys, even before the fallout from COVID-19 became an additional concern.
However, going forward, cost reduction is likely to become more important in the post-COVID-19 world. Many companies will be under pressure to reduce expenses in a recovering economy, which could mean taking measures such as workforce restructuring, office space reductions due to the continuation of remote work for many employees, as well as increased use of
automation or cloud capabilities, among other technology options.
However, actions taken to reduce operational costs should be evaluated carefully for their cybersecurity implications. Companies should consider corrective measures to ensure that costreduction initiatives do not expose them to additional cyber risks, such as insider threats. CISOs will also likely be called upon to come up with recommendations to manage costs. They could consider using selective outsourcing or increasing automation, while supporting costreduction initiatives across the organization (for example, by enabling a secure migration of data and/or systems to the cloud).
Access to Innovation
Access to Capital
Access to Talent
Access to Market
Access to Knowledge
