Table of Contents
What is Cybersecurity?
According to the American Bankers Association (ABA), data breaches cost financial intuitions an average of $5.97 million in 2021 and 2022, with health care being the only sector with a higher cost per breach, according to a report released in July, 2022, by IBM Security.
According to an executive summary offered by ABA, key findings of the report are as follows:
IBM commissioned a 12-month study of 550 organizations across multiple sectors as part of an annual report on data breaches.
- The cost of dealing with a data breach for financial institutions rose by $250,000 compared to a similar study conducted in 2020-2021. IBM defined financial services as banks, insurance and investment companies.
- Across all sectors studied, the global average cost of a data breach reached an all-time high of $4.35 million, with breach costs increasing nearly 13% during the last two years of the report, IBM said. Health care organizations paid the most per breach at an average of $10.1 million.
- Use of stolen or compromised credentials remained the most common cause of a data breach. One trend was an increase in the number of data breaches caused by ransomware, which accounted for 11% of breaches compared to 7.8% in last year’s report.
The ABA contends that banks have the highest level of security among critical U.S. industries — and the most stringent regulatory requirements. ABA’s expertise and resources help ensure your bank understands the risk environment, and has the right plans in place to identify and prevent cyber incidents. The national organization offers a plethora of resources, as well as a Financial Crimes Enforcement Conference and Cybersecurity Awareness Training programs for its member financial institutions.
The ABA shared an update in August, 2022, regarding an assessment of banks’ cybersecurity mitigation efforts by the Office of the Comptroller of the Currency (OCC). In an online article, it offered this summary:
The financial services sector has done “a good job” so far of building cyber defenses and working with law enforcement and the regulatory community to guard against attacks, but there’s more work to be done, said Acting Comptroller of the Currency Michael Hsu today during remarks to financial services groups.
He noted that the OCC has observed increases in cyberattack frequency and severity against financial institutions and service providers. Cyberattacks, such as ransomware, have elevated risks beyond financial loss, Hsu said. “Disruption to financial services can significantly impact banks’ abilities to deliver critical services to their customers and has the potential to affect the broader economy. Many of the largest financial institutions … not only support their own customers, but also support critical activities including wholesale payments, trade settlement and custody.”
Hsu said cybersecurity breaches have been caused or intensified by the failure to have effective controls in three areas: strong authentication; effective systems configuration and patch management; and cyber response and resilience capabilities. He said banks need to assess the potential effect cyber incidents may have on their institutions as well as the broader financial system, adding that “effective management of basic cybersecurity controls can significantly contribute to enhancing the resilience of systems and operations against cyber threats.”
Cybersecurity-related Government Agencies
Also important for financial institutions, is the work of a government agency which works to understand, manage, and reduce risk to our cyber and physical infrastructure
Cybersecurity & Infrastructure Security Agency (CISA)
The Cybersecurity and Infrastructure Security Agency (CISA) leads the national effort to understand, manage, and reduce risk to our cyber and physical infrastructure. We connect our stakeholders in industry and government to each other and to resources, analyses, and tools to help them build their own cyber, communications, and physical security and resilience, in turn helping to ensure a secure and resilient infrastructure for the American people.
CISA’s stated mission is to lead the National effort to understand, manage, and reduce risk to our cyber and physical infrastructure.
To that end, it plays two key roles.
- Operational Lead for Federal Cybersecurity, or the Federal “dot gov”
CISA acts as the quarterback for the federal cybersecurity team, protecting and defending the home front — federal civilian government networks — in close partnership with the Office of Management and Budget, which is responsible for federal cyber security overall. CISA also coordinates the execution of the national cyber defense, leading asset response for significant cyber incidents and ensures that timely and actionable information is shared across federal and non-federal and private sector partners. - National Coordinator for Critical Infrastructure Security and Resilience
The agency looks at the entire threat picture and works with partners across government and industry to defend against today’s threats, while securing the nation’s critical infrastructure against threats that are just over the horizon.
Designed for Collaboration and Partnership
Established in 2018, CISA was created to work across public and private sectors, challenging traditional ways of doing business by engaging with government, industry, academic, and international partners. As threats continue to evolve, the agency recognizes that no single organization or entity has all the answers for how to address cyber and physical threats to critical infrastructure. By bringing together its insight and capabilities, they work to build a collective defense against the threats we face.
Jen Easterly is the Director of the Cybersecurity and Infrastructure Security Agency (CISA), who was nominated by President Biden in April 2021 and unanimously confirmed by the Senate on July 12, 2021.
