Financial firms brace for more cyberthreats after trying 2021

[NEW YORK] After an unrelenting year of fighting off cyberthreats, the financial services sector should expect more of the same or even worse, as nation-state hacking campaigns are expected to mirror geopolitical tensions and ransomware gangs retool to dodge increased scrutiny, according to an industry group report.

The Financial Services Information Sharing and Analysis Center, known as FS-ISAC, said in its annual report on cyber threats that global tensions could fuel further attacks by state-backed hackers and patriotic hacktivists. In addition, after a series of devastating breaches on the software supply chain, the group warned that its members need to be wary of potential nation-state meddling in products and services being used.

"We expect current trends to continue and possibly worsen over the next year," said the report, which was released on Thursday (Mar 10). Saying that cybersecurity is "no longer just a back-office cost", the group warned that cyberthreats pose critical business risks, including operational disruption, lawsuits and credit downgrades.

FS-ISAC, which shares cyberintelligence among financial institutions around the world, published the report at a time when Russia's invasion of Ukraine has kept organisations in the US and elsewhere on alert for possible retaliatory attacks. So far, those fears appear largely unrealised, and cyberattacks have played a smaller role in the conflict than many predicted.

The report represents a relatively rare example of an industry publicly acknowledging cyberrisks and encouraging its members to prepare for them.

In an interview about the report's findings, Teresa Walsh, who leads FS-ISAC's global intelligence office, said the biggest worry remains a cyberattack that disrupts members' ability to conduct business. Industry leaders, meanwhile, have previously sounded the alarm about the possibility for global conflicts to erupt into digital attacks capable of destabilising the financial system.

At a January event, Goldman Sachs Group Inc. President John Waldron said the potential for a cyberattack that "hits at the core of the financial markets" poses a significant danger.

"It doesn't get enough attention," Waldron said. "When you sort of marry what's going on with Russia and Ukraine and China and other actors around the world geopolitically, you have to come back and think that one of their major weapons is cyber."

The FS-ISAC report details a year of relentless cyberattacks globally in which the group raised its threat level from guarded to elevated 3 times. It typically does so once a year. The threat level system follows a colour scheme, with green denoting a guarded status and yellow meaning elevated. However, the threat level was not raised to high (orange) or severe (red) last year, according to the group.

"There was a dizzying number of vulnerabilities," Walsh said. Third-party hacks remain a threat for the financial sector, due to its reliance on "a myriad of providers and suppliers", and a potential way to infiltrate organisations that "are considered adequately hardened to traditional attack methods, such as financial institutions", according to the report. There is also a concentration risk among financial institutions because many use the same suppliers, according to a FS-ISAC spokesperson.

FS-ISAC also warned that ransomware remains a persistent concern, "a game of whack-a-mole, where operators shut down when they feel the heat of law enforcement, only to reopen under new names months later", the group wrote.

Still, common hacking methods remain an issue. Of the incidents reported by members, 24 started with an employee being targeted by a phishing attack, according to FS-ISAC. BLOOMBERG