“Room for improvement” in banking cybersecurity
22nd January 2025 • Park Plaza Victoria, London, UK
The ECB didn’t say much about its recent stress tests, but banks need to do better. Which gaps need to be filled?
More investment in security and resilience needed, say regulators
"The results of the stress test are insightful and showed that while banks do have high-level response and recovery frameworks in place, there is still room for improvement," said Anneli Tuominen, an ECB supervisory board member.
Now, the test didn't probe banks' ability to prevent cyberattacks, it started with an assumed core database encryption and so tested resilience and business continuity.
But it found that many banks couldn't meet their recovery time deadlines and lacked centralized inventories of business processes and associated IT assets.
It was also clear that the industry largely still lacks established processes for quantifying economic impact holistically. And there seemed to be a lack of end-to-end testing of both technical and banking processes using serious scenarios.
Interestingly, the ECB showed concern that banks depend very significantly on external providers. This seems an obvious statement, given banks dependence on Cloud and on hundreds of specialist tech companies in areas from cybersecurity to compliance to the fight against financial crime and fraud, as well as to operate their core banking systems.
The financial service industry is often held up as an example of best practice in security and resilience, both because it is heavily regulated and because financial firms generally have the budgets to buy that best practice.
Yet the ECB believes that much more needs to be done to “raise awareness internally about existing cyber” and that “banks need to prioritise investment in cybersecurity and treat it as a vital strategic component that underpins their operational resilience”.
With DORA here now there exists “a robust framework that will require banks to step up their efforts to foster a culture of continuous cyber risk management.”
So
- Where must banks focus their security and resilience efforts now?
- Do they need to change the way they think about security – are processes the new crown jewels not data?
- If they can’t determine damage then how can they evaluate the ROI of security programmes?
