ZDC17: Panel Discussion - Strengthening The Cyber Resilience Of The Financial And Banking Sector

### Overview This panel discussion explores the state of cyber resilience, threat landscapes, and regulatory shifts within the banking and financial services sector. Moderated by Anton, the panel features industry leaders from banking, insurance, and enterprise technology: Richard Harper (FXO), Gary Delaney (AIB), Enda Devine (FBD), and Alan Jenkins (IBM). The conversation covers why financial institutions remain prime targets, how human behavior and legacy architectures impact defense postures, emerging compliance requirements like PSD2 and GDPR, and the vital necessity of inter-institution threat intelligence sharing.

### Key Topics - **Attractiveness of Financial Institutions**: Criminals target banks directly because they can directly access and monetize funds rather than needing intermediate steps like selling stolen data or credit cards. The Bangladesh Central Bank cyber heist (via the SWIFT network) is highlighted as an example of a low-risk, high-return theft where $81 million was stolen, prevented from reaching $1 billion only by a spelling error. - **Human Factor and Insider Risk**: End users and employees remain primary attack vectors. Phishing, social engineering, invoice redirection, and business email compromise (BEC) are common mechanisms where criminals manipulate employees into moving funds rather than breaching systems directly. Shadow IT and end-user computing (such as uncontrolled spreadsheets containing sensitive financial data) present major insider governance challenges. - **Banking vs. Insurance Profiles**: Banks face direct transactional money extraction, whereas insurance companies traditionally deal with insurance fraud, ransomware, and sensitive data breaches. While insurers have historically operated on conservative, manual, face-to-face processes, legacy back-office systems (some older than 30 years) are increasingly being interfaced with modern digital customer-facing layers. - **Fintech, APIs, and Regulation**: Innovations such as mobile banking, smart assistants (e.g., Alexa), Apple Pay, and regulatory mandates like PSD2 require banks to open APIs to third parties (e.g., accounting software). While driving customer convenience, these innovations introduce expanded attack surfaces and supply chain risks. - **Board-Level Communication & Industry Collaboration**: Communicating cyber risk to executive boards requires framing security around business value, reputation protection, and solvency rather than technical jargon. The panel stresses that cybersecurity is non-competitive; institutions must collaborate, share threat intelligence, and satisfy formal regulatory expectations (such as guidance from the Central Bank of Ireland).

### Technical Details - **Authentication and Network Controls**: Controls discussed include dedicated corporate devices, two-factor authentication (passwords and mobile devices), restricted C-drive access, strict email screening, and locked-down private networks. - **Automated Containment and Response**: Techniques previously deployed in related high-risk environments include rapid endpoint containment (shutting down suspicious devices or servers within 5 to 10 minutes) and automated analysis tools like IBM Watson alongside 24/7 incident response operations. - **End-User Computing Compliance**: Enforcing strict policies around sensitive data handling in spreadsheets to adhere to Sarbanes-Oxley (SOX) and GDPR governance through internal and external audit enforcement.

### Takeaways Financial institutions operate under a mature fortress mentality, but legacy systems, rapid fintech disruption, and the human element remain significant vulnerabilities. Security leaders must bridge technical risk to board-level business metrics, maintain strong governance over end-user computing, and actively collaborate across the industry to protect the wider economic ecosystem.