The truth of digital transformation is that we’re all now much more vulnerable than we used to be. The rise of online and mobile services has been both a blessing and a curse – the more we rely on data to help run our businesses and our lives, the greater the impact that hackers can have by interfering with it. This is particularly true for the banking industry, which has been entrusted to handle huge volumes of highly sensitive customer data.
The challenge of keeping this data safe and secure has become even more difficult with the accelerated shift to remote working during the Covid-19 pandemic. Owing to this, banks have had to rapidly extend their IT infrastructures with complex combinations of cloud, virtual and on-premises infrastructures. This has not been without consequence: Veritas research found that nearly two-thirds (63 percent) of banks now suffer from a transformation gap, meaning that their security measures lag behind the complexity of their IT infrastructures. While banks continue to collect vast amounts of personal data, their visibility of it and ability to protect it is waning.
Unless banks do something to close this widening gap, they’re putting themselves at huge risk of regulatory non-compliance, falling victim to cyberattacks and, ultimately, losing customer trust. Cybercriminals are already starting to take advantage of the gaps in security, with research indicating there was a 20 percent rise in ransomware attacks in the first half of 2020 alone. The ransom amount paid by victims of such attacks increased more than 300 percent in 2020 compared to the previous year.
Securing trust
When customers choose a bank to do business with, they hand over vast amounts of highly sensitive personal information that is intrinsically linked to their livelihoods. In return, they expect to receive seamless and tailored round-the-clock services, but they also expect their personal information to be treated with the utmost care and protection. Ultimately, this whittles down to one word: trust. It’s a concept that the industry relies upon to retain existing customers and attract new ones.
But building an industry on highly sensitive customer data is a double-edged sword – while banks can take advantage of a vast pool of valuable customer data to offer personalized services and explore new revenue streams, it also makes them a very attractive target for cybercriminals. In fact, an incredible 70 percent of financial services companies in the UK suffered cyberattacks in 2020 alone. In recent years, banks have been plagued by cyber threats and outages, with major banks reportedly suffering at least one outage a month. As a result, trust between customers and banks is fragile at the best of times. One data breach could bring the proverbial stack of cards tumbling to the ground.
The harsh truth
The honest truth is that many banks are not managing their data well enough and are at huge risk of failing compliance checks.
Given the rising threat of ransomware, now is a crucial time to be testing and perfecting recovery plans. Yet, Veritas research found that 46 percent of banks have either never tested their disaster recovery plans in the event of a ransomware attack or have not tested it in over 90 days. Further, more than one in 10 (14 percent) banks feel they would either never fully recover from a ransomware attack or that it would take over a month to do so. This is a huge concern given that nearly two-thirds (63 percent) of banks have been hit by a ransomware attack at some point in their history.
These figures demonstrate that banks are failing to prepare for when the inevitable ransomware attack strikes and could be doing much more to protect their most valuable digital assets. In fact, half (50 percent) of the banks surveyed have admitted to paying all or a part of a ransom to recover customer data.
Taking back control
In a world where banks have had to rapidly accelerate their digital transformation plans and fundamentally shift the way in which they operate, how can they ensure their data protection measures keep pace?
The answer cannot be to just simplify their IT infrastructure. As the volume of data banks store continues to rise, banks have to accept that there is always going to be complexity in the IT environment, but there is a way to use tools to abstract much of the complexity away. By standardizing the systems that manage data across the enterprise, banks can to start extracting value from their data.
Before simply jumping into any course of action though, it’s essential to understand what data they have, its value, where it needs to sit, who should access it and how long it needs to be held for. It’s also worth noting that data visibility shouldn’t just be a defense measure; gaining a better understanding of the data they hold can help banks identify trends and insights that can enable them to offer better customer experiences or open doors to new revenue streams. Without a full view of the data they hold, businesses are blind to their own potential.
Once they have visibility into their business-critical data, they need to ensure that business continuity and disaster recovery processes are optimized to protect it. In the event of a ransomware attack, an encrypted backup is the only line of defense. But it’s important to remember that there is no backup plan in place until it’s been tried and tested.
Testing disaster recovery plans help reveal cracks and vulnerabilities businesses otherwise would never have discovered. Are backups sufficiently isolated to avoid infection from spreading? Are there enough copies of valuable data and are those copies being retained for long enough? Only regular fire drills and tests can answer these questions conclusively. Testing could be something as simple as staff checking to ensure a backup site will go live should the main application fail or performing a single file recovery and checking the recovered copy matches the original. What’s important is that these tests are regular, repeatable and a crucial part of a business’ backup strategy.
Whatever the next year holds, banks are going to need to be ready to adapt again and again to keep pace. And despite their best efforts, most companies will fail to stop at least one cyberattack over the course of their lifetime. However, the key to survival is robust backup and disaster recovery plans that protect their most valuable digital assets. Without this, banks will become an open house for cybercriminals to come and play. And, when they leave, they’ll take the finest china with them. Some of it might be replaceable – at a heavy cost – but when it comes to customer trust, that’s a priceless asset that no company can afford to lose.
Barry Cashman, Regional Vice President UK&I, Veritas Technologies
