Why Financial Services Must Adopt a Zero Trust Approach to Cybersecurity

The current approach to cybersecurity within the financial services industry is flawed. With regulations such as the new General Data Protection Regulation (GDPR) and New York State’s DFS Cybersecurity Regulation being enforced, putting ever greater pressure on data protection, combined with the fact that the financial services industry is one of the most targeted, regulatory and consumer eyes alike are firmly on financial institutions to improve their cybersecurity processes and models. 

If they haven’t already, then the 146 million records of U.S. consumers stolen in the Equifax breach should be causing alarm bells to ring; there is no excuse for any organizations that don’t have proper cybersecurity and data protection processes in place.

Fundamentally, the current “protect, detect, react” approach is no longer fit for purpose; instead, firms must focus on the critical element of breach “containment,” and this can only be achieved by adopting a Zero Trust approach to cybersecurity.

Dated Security Postures

Unsurprisingly, the financial services industry is a prime target for hackers. In 2016, it was attacked 65% more than the average organization across all industries, and according to IBM, 200 million financial services records were breached in 2016, a 900% increase from 2015. 

Yet these breaches are not occurring at companies that have failed to recognize the risk to customer data – indeed many have occurred at organizations that are meeting regulatory compliance requirements to protect customer data.  Clearly, organizations are struggling to lock down data against the continuously evolving threat landscape. Moreover, it is becoming ever more apparent that regulatory compliance is no safeguard against data breach.

Meanwhile, the motivation to attack the industry is not likely to diminish. The goldmine of sensitive data – from credit card to consumer details – means that financial institutions are likely to be under constant attack from hackers trying to find weaknesses in the network so they can get in. So whilst the regulators are taking an increasingly hard stance on data protection, organizations that take a regulation-only approach to cybersecurity are actually putting themselves at greater medium- to long-term risk. 

The reason should be apparent: with new threats emerging weekly, the time lag inherent within the regulatory creation and implementation process is a problem. It can take upwards of 24 months for a regulatory body to understand and identify weaknesses within its existing guidelines, update and publish requirements, and then set a viable timeline for compliance, often 12 to 18 months.

During this time an organization with a security strategy dictated by compliance is inherently insecure. Furthermore, these are catch all standards that are both open to interpretation and fail to address specific business needs or operational models – immediately creating security weaknesses.

And worse, they actually provide hackers with an “access blueprint,” as weaknesses in the security model that are not covered by regulation are clearly visible for any hacker to exploit.

Innovation is needed.

Zero Trust Security

The entire security model is flawed not least because most regulatory bodies are still adhering to the “secure the border” model. Breach prevention, even breach detection, are not adequate security postures. They assume a level of trust – that anyone or anything inside the border is trusted until proved otherwise. But this is patently untrue, as the raft of breaches – many of them undetected for months – reveal.

The solution lies in the Zero Trust model. A phrase coined by Forrester, the Zero Trust approach to cybersecurity abolishes the idea of a trusted network inside the corporate perimeter. It assumes that you can no longer trust anything that is within the extended infrastructure – no users, apps or devices. It assumes that the network can be compromised at any time, by anything. 

This means decoupling security from the complexity of the IT infrastructure and addressing specific user/IoT device vulnerability. Instead of firewalls, network protocols and IoT gateways, organizations should consider data assets and applications; and then determine which user roles require access to those assets.

Building on the existing policies for user access and identity management, organizations can then deploy cryptographic segmentation to ensure only privileged users have access to privileged applications or information. Each cryptographic domain has its own encryption key, making it impossible for a hacker to move from one compromised domain or segment into another – it is simply not possible to escalate user privileges to access sensitive or critical data, meaning that in the inevitability of a breach, the threat is both contained and rapidly identifiable – and any fallout limited. 

Conclusion 

Organizations are understandably concerned about the financial penalties associated with failing to achieve regulatory compliance. But take a step back and consider the financial implications of a data breach or of a high-profile customer data compromise. That is a far more significant cost and an event that will have long term repercussions on customer perception and loyalty.

If the financial services industry is to keep itself out of the headlines and prevent high-profile data breaches, then attitudes need to change. The heavy focus on regulatory compliance over data security means that financial institutions will not achieve the robust security posture required to protect data against the continually evolving threat landscape.

It is time to ensure that innovation plays a part in security best practice and deploy solutions that are in line with a Zero Trust approach.