Connect with us

Business

Financial Sector Under Threat: How Leaders can Prepare for Advanced Cyber Threats in 2022

Source: Finance Derivative

Bernard Montel, EMEA Technical Director and Cybersecurity Strategist,Tenable   

Data is essential in today’s world. Because of this, businesses of all types and sizes are facing one of the most serious continuity and reputational threats of our time: cyberattacks. Cybercriminals capitalise on data, and the more private and/or personal, the more interest cyber criminals will show. This makes financial services a prime target for attackers given the type of information utilised. Cyberattacks go beyond data as, if the attack implicates the digital infrastructure the bank relies upon to function, it can cause system outages which has a direct impact to the entire economy.

According to research by Tenable at least 40,417,167,937 records were exposed worldwide in 2021, but that’s just an indication of the true number. According to the researchers, just 13% of breach disclosures analysed included information on the number of records exposed, meaning this figure will be significantly higher. As the world of work continues to transform, and hybrid working becomes crucial for business growth, leaders must begin to think seriously about security.

Bernard

The Threat of Ransomware

Ransomware has had a monumental impact on organisations in 2021, responsible for approximately 38% of all breaches analysed for the Threat Landscape Retrospective report, and up to 45% in EMEA. With the rise of ransomware globally, every organisation has been feeling the pressure; but only a few have felt the pain as much as financial institutions and financial service providers.

The most popular way attackers infect organisations is through spam and phishing emails. Others, however, may contain a link to a webpage controlled by the attackers. The goal is to get the target to open the attachment and trick the victim into enabling macros or clicking the link. This can deliver a malicious downloader, leading to the final payload, which is ransomware. Due to the nature of financial institutions as places where individuals and institutions place their money and trust, the severity and potential consequences of a successful ransomware attack can be widespread and long lasting.

Basic security principles can go a long way in blocking the attack path ransomware takes. In the majority of instances, it is a known vulnerability that allows the malware to infiltrate the infrastructure and encrypt systems. Another attack path is the exploitation of misconfigurations in Active Directory. Threat actors will use these to elevate privileges to dig deeper into the network.

The New Normal

During the pandemic, millions of financial services employees, from traders to bankers, transitioned to working remotely. A recent study conducted by Forrester revealed that 78 percent of businesses have reported that some of their staff are still working from home. Stepping into the New Year, businesses must be aware that the digitalisation of financial services and remote working are here to stay. In fact, financial institutions have the highest chance of maintaining remote and hybrid work models, since three-quarters of their employees’ time can be used productively out of the office.

In their shift to remote working, organisations have been migrating their operations to cloud, often without enough thought given to the security implications of this shift. As businesses continue to implement remote working policies, they are simultaneously adopting cloud infrastructure and bringing in more third-party service providers. Business leaders supporting a remote workforce must be conscious of how these changes influence their security posture.

Successfully Connecting Cybersecurity and Financial Institutions

The World Economic Forum’s Global Risk Report 2022 has ranked cybersecurity as the number one risk in Great Britain and Ireland, meaning cyber risk will remain dominant amongst the areas of emergent threats in the New Year.

Attacks in the financial services industry are not a new concept and, in recent years, banks and institutions have become much more sophisticated and regulated. However, it is essential to secure external vendors and potential points of weakness, particularly through implementing audited industry best practises.

Security teams need to adopt solutions that provide appropriate visibility, security and control across the cloud and converged infrastructure. Identify the critical systems organisations rely on to function, identify any vulnerabilities that affect these systems, then take steps to either patch or remediate the risk. Also address excessive permissions in Active Directory that allow attackers to elevate privileges to further infiltrate the infrastructure.

As businesses start to truly understand their expanded attack surface, ensuring that they hold the same level of control and governance over the cloud as they would do for on-premises security is essential. In the post-COVID world, which is increasingly interconnected and digitalised, failing to do the basics means the business is vulnerable and disruption imminent whoever is attacking.

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Business

AI and GenAI tools can add business value – but the right skills are vital to make this possible

Source: Finance Derivative

Faye Ellis, Principal Training Architect – AWS at Pluralsight

Generative AI has captured the imagination of many over the past year. However, aside from using ChatGPT to write our wedding speeches and do our kid’s homework, there are many ways to maximise the technology to add real business value and a competitive edge.

Getting the right skills in place for employees is also key for businesses. Whether employees are total beginners to AI or looking to move into advance uses, investment in the technology will only bring true business benefits if people are empowered to work with it effectively, try new applications, and do so securely.

Here are four examples of where AI, when used well, can bring real business value:

Build your own chatbots

Conversational chatbots and virtual assistants can increase customer engagement in an interactive and personalised way. They can be tailored to reflect brand voice, and be delivered in a consistent way across a site so customers always have access to timely support.

Amazon Lex, for example, makes it easy to build high-quality conversational interfaces powered by generative AI. 

Automate your repetitive business processes

Generative AI is ideal for automating repetitive tasks that don’t require high levels of creativity, such as reviewing and summarising contracts, generating project collateral, and code documentation. FAQ engines that handle common customer support and HR inquiries are expected to become commonplace. Marketing teams that need to develop campaigns in a similar style to previously successful campaigns, or automate customer outreach, will also find that they can easily automate these repetitive tasks with generative AI. 

Content marketers can use services like Bedrock to build a social media campaign for a new product or service. Marketers provide relevant data and prompts, and Bedrock generates copy and images for targeted social media posts. 

Incorporate generative AI into your cybersecurity

Generative AI can be used in risk modelling and assessing and interpreting the risk of cybersecurity incidents and findings.

Use generative adversarial networks (GANs) to create synthetic data, enabling security experts to anticipate what might happen during a cyber attack

Generate image, video, and text

Most of us are familiar with image, video, and text generation—the primary capabilities of generative AI. Use cases include creating original content, images, and summarising text.

Leading pre-trained AI models are available through SageMaker and Bedrock to help you get started quickly. Use Bedrock Chat Playground to experiment with various models using a chat interface.  

Getting your teams up to speed with AI

To start using these technologies, you need your staff to be skilled in using them.

Organisations might be accelerating AI adoption, but employees need the right skills – otherwise organisations risk facing an AI literacy gap. In fact, our recent research found that 80% of executives currently neglect employee training, and 20% don’t have an understanding of their teams’ AI skills.

By focusing on training the existing talent pool, it’s possible to propel them through the next wave of AI innovation, and fill talent gaps from within.

Continue Reading

Business

How can a payments strategy support business growth?

Source: Finance Derivative

Following the global economic upheaval brought on by the pandemic, businesses are once again prioritising growth on a global scale. While every business recognises the importance of expansion, their methods, obstacles, and risks differ greatly.

In the following article, Sonya Geelon, Chief Commercial Officer at Conferma, explores some of the most common challenges holding businesses back, and how by including innovative payments solutions in your payment strategy, you can successfully position your business to expand into global markets.

Barriers to global expansion

At Conferma, we wanted to know what businesses felt stood between them and their growth ambitions, so we spoke to 400 financial decision makers to find out.

The research, shared in our new Growth Ignition Index report, identified global expansion as a key priority for businesses looking to grow across all regions. Significant drivers included increasing customer demand (46 per cent), maintaining a consistent cashflow (36 per cent) and undertaking digital transformation (34 per cent.) Businesses also highlighted a number of barriers, such as identifying valuable markets to expand into (27 per cent) and navigating complex cross-border payment systems (13 per cent.) The following sheds light on some of the factors that businesses perceive to be hindering their growth.

Operational inefficiencies

It’s a well-known fact that operational efficiency is crucial for giving businesses the competitive edge. If your processes run smoothly and effectively, you’re likely in a good position to grow. However, a third (33 per cent) of businesses identified operational inefficiencies as a significant sticking point, particularly among small-and-medium sized organisations. This perhaps indicates that larger companies have already invested in boosting efficiency to a degree, however, the issue was noted across businesses of all sizes.

Complex cross-border payments

Successful growth relies heavily on being able to make fast, seamless transactions, however, recent research from Rapyd found that 38 per cent of businesses experience delays of five days or more when sending or receiving international payments.[1] Costs and delays in cross-border transactions can have a significant impact on growth, cutting into revenues, restricting cash flow and complicating financial planning. Our own research highlighted this, with 14 per cent of businesses reporting slow and/or complex cross-border payments as a significant barrier to expansion.

So how can businesses overcome these challenges and unlock global growth?

Taking your payments strategy virtual

Amid the array of payment options available in the market, virtual cards have emerged as a versatile solution, valued by users globally. According to Juniper Research, the global value of virtual cards will increase over threefold in just 5 years, climbing from $1.9 trillion in 2021 to a staggering $6.8 trillion by 2026.[2]

So how do they work?

Virtual cards are essentially digital versions of traditional credit cards. The technology generates a 16-digit card  number, allowing an employee to make payments without having to physically hand over a card. Instead, they provide the virtual card number, expiration date, and security code, just like they would with a regular credit or debit card.

Virtual cards come with built-in fraud and security features, enabling restrictions on usage. For instance, users can set a specific date range or limit usage to certain merchants. This ensures that any attempts to exceed the set amount, use the card at unauthorised merchants, or spend beyond the specified date range will result in a declined transaction.

Using a virtual card provider allows access to extensive, pre-existing payments ecosystems. For example, Conferma connects 75+ card issuers and banks across the world. This enables businesses to use virtual cards in 62 different currencies, making international payments frictionless while mitigating costly cross-border fees. Virtual cards can also help boost cashflow and improve operational efficiency, automating reconciliation and cutting lengthy processing times. By removing convoluted payment processes, virtual cards give businesses the freedom to grow in the markets they deem most valuable, not just most accessible.

Of those surveyed, four out of five  respondents (82 per cent) plan on expanding their virtual card usage in the next twelve months, with 64 per cent extending usage to additional payment needs. Businesses already using virtual cards also anticipate a substantial increase in the volume of payments they make virtually, with our data projecting a rise from 45 to 57 per cent of all payments being made using virtual cards in the next 12 months.

Virtual cards offer a compelling solution to the challenges limiting international growth by offering enhanced security, streamlined operational processes, and seamless cross-border transactions. By embracing virtual cards as a strategic tool, organisations can unlock opportunities for growth and innovation, empowering them to navigate the complexities of international commerce with ease.


[1] The 2023 State of Cross-Border Payments, Rapyd, 2023.

[2] Virtual Cards: B2B and B2C Applications, Competitive Analysis & Market Forecasts 2021-2026, Juniper Research

Continue Reading

Business

How can businesses make the cloud optional in their operations?

Max Alexander, Co-founder at Ditto

Modern business apps are built to be cloud-dependent. This is great for accessing limitless compute and data storage capabilities but when connection to the cloud is poor or shuts down, business apps stop working, impacting revenue and service. If real-time data is needed for quick decision-making in fields like healthcare, a stalled app can potentially put people in life-threatening situations.

Organisations in sectors as diverse as airlines, fast food retail, and ecommerce that have deskless staff who need digital tools accessible on smartphones, tablets and other devices to do their jobs. But because of widespread connectivity issues and outages, these organisations are beginning to consider how to ensure these tools can operate reliably when the cloud is not accessible. 

The short answer is that building applications with a local-first architecture can help to ensure that they remain functional when disconnected from the internet. But then, why are not all apps built this way? The simple answer is that building and deploying cloud-only applications is much easier as ready-made tools for developers help expedite a lot of the backend building process. The more complex answer is that a local-first architecture solves the issue of offline data accessibility but does not solve the critical issue of offline data synchronisation. Apps disconnected from the internet still have no way to share data across devices. That is where peer-to-peer data sync and mesh networking come into play.

Combining offline-first architecture with peer-to-peer data sync

In the real world, what does an application like this look like?

  • Apps must prioritise local data sync. Rather than sending data to a remote server, applications must be able to write data using its local database in the first instance, and then listen for changes from other devices, and recombine them as needed. Apps should utilise local transports such as Bluetooth Low Energy (BLE) and Peer-to-Peer WiFi (P2P Wi-Fi) to communicate data changes in the event that the internet, local server, or the cloud is not available.
  • Devices are capable of creating real-time mesh networks. Nearby devices should be able to discover, communicate, and maintain constant connections with devices in areas of limited or no connectivity.
  • Seamlessly transition from online to offline (and vice versa). Combining local sync with mesh networking means that devices in the same mesh are constantly updating a local version of the database and opportunistically syncing those changes with the cloud when it is available.
  • Partitioned between large peer and small peer mesh networks to not overwhelm smaller networks if they try to sync every piece of data. In order to do this, smaller networks will only sync the data that it requests, so developers have complete control over bandwidth usage and storage. This is vital when connectivity is erratic or critical data needs prioritising. Whereas, the larger networks sync as much data as they can, which is when there is full access to cloud-based systems.
  • Ad-hoc to enable devices to join and leave the mesh when they need to. This also means that there can be no central server other devices are relying on.
  • Compatible with all data at any time. All devices should account for incoming data with different schemas. In this way, if a device is offline and running an outdated app version, for example, it still must be able to read new data and sync.

Peer-to-peer sync and mesh networking in practice

Let us take a look at a point-of-sale application in the fast-paced environment of a quick-service restaurant. When an order is taken at a kiosk or counter, that data must travel hundreds of miles to a data centre to arrive at a device four metres away in the kitchen. This is an inefficient process and can slow down or even halt operations, especially if there is an internet outage or any issues with the cloud.

A major fast-food restaurant in the US has already modernised its point of sale system using this new architecture and created one that can move order data between store devices independently of an internet connection. As such, this system is much more resilient in the face of outages, ensuring employees can always deliver best-in-class service, regardless of internet connectivity.

The vast power of cloud-optional computing is showcased in healthcare situations in rural areas in developing countries. By using both peer-to-peer data sync and mesh networking, essential healthcare applications can share critical health information without the Internet or a connection to the cloud. This means that healthcare workers in disconnected environments can now quickly process information and share it with relevant colleagues, empowering faster reaction times that can save lives.

Although the shift from cloud-only to cloud-optional is subtle and will not be obvious to end users, it really is a fundamental paradigm shift. This move provides a number of business opportunities for increasing revenue and efficiencies and helps ensure sustained service for customers.

Continue Reading

Copyright © 2021 Futures Parity.