Today’s bankers have a lot on their plates. As if persistently low interest rates, credit risk and the ever burgeoning burden of regulatory compliance weren’t enough to deal with, even the smallest and humblest community bank must now also contend with a myriad and ever-changing assortment of cyber attacks.
In response, banking regulators have taken a largely prescriptive approach to the problem, promoting information sharing and self-evaluations rather than slapping financial institutions on the wrist when they find themselves under attack from cyber threats that could be located anywhere in the world.
The Federal Reserve Bank of Boston yesterday convened a half-day cybersecurity conference in an effort to promote conversation and information sharing among the New England financial institutions it supervises and to highlight the benefits of the Boston Fed’s own threat sharing program.
“Every bank is confronting threats in cybersecurity,” COO Kenneth C. Montgomery said in his opening remarks before the conference. Citing a recent piece of research from Symantec, Montgomery told his audience that about 1 million new pieces of malware are introduced daily.
Traditionally, banks have focused on mitigating risk that was much more localized. “You think about bank fraud, you think about bank robberies. These are things that banks have worried about for 100 years,” said Boston Fed President Eric Rosengren. “What has changed with cybersecurity issues is that cyber attacks can occur from anywhere in the world. You don’t have to be local. You can be anywhere. You can be in Russia, you can be in Azerbaijan, you can be in any part of the world as long as there’s a computer hookup.”
Rosengren also used his opening remarks to address the subjects of economic uncertainty and the probability of a very gradual tightening of monetary policy, but the day was largely focused around cybersecurity. The day’s agenda covered the U.S. Treasury’s perspective, bitcoin and blockchain technology and its implications for cybersecurity, and the board of directors’ role in overseeing cybersecurity matters.
James Burrell, an assistant deputy director with the FBI, focused his presentation on emerging technologies, covering the technological adoption cycle, the Internet of things, insider threats and the risks associated with both early adopters and late adopters.
Banks should pay attention to emerging technologies because, he said, because “customers and employees will use these products even if you don’t.”
Burrell emphasized the value of teaming up with academia when evaluating emerging technologies and the risk to your organization and he underscored the importance of evaluating the opportunities along with any risk. He also encouraged financial institutions to conduct a skills analysis of their existing employees. You never know who might have an expertise you could use in the cybersecurity realm.
Editor’s Note: This article was updated on April 6 to correct the number of new pieces of malware introduced daily.
