Financial firms brace for more cyber threats after trying 2021

After an unrelenting year of fighting off cyber threats, the financial services sector should expect more of the same or even worse, as nation-state hacking campaigns are expected to mirror geopolitical tensions and ransomware gangs retool to dodge increased scrutiny, according to an industry group report. 

The Financial Services Information Sharing and Analysis Center, known as FS-ISAC, said in its annual report on cyber threats that global tensions could fuel further attacks by state-backed hackers and patriotic hacktivists. In addition, after a series of devastating breaches on the software supply chain, the group warned that its members need to be wary of potential nation-state meddling in products and services being used.

“We expect current trends to continue and possibly worsen over the next year,” according the report, which was released on Thursday. Saying that cybersecurity is “no longer just a back-office cost,” the group warned that cyber threats pose critical business risks, including operational disruption, lawsuits and credit downgrades.

FS-ISAC, which shares cyber intelligence among financial institutions around the world, published the report at a time when Russia’s invasion of Ukraine has kept organizations in the U.S. and elsewhere on alert for possible retaliatory attacks. So far, those fears appear largely unrealized, and cyberattacks have played a smaller role in the conflict than many predicted.

The report represents a relatively rare example of an industry publicly acknowledging cyber risks and encouraging its members to prepare for them.

In an interview about the report’s findings, Teresa Walsh, who leads FS-ISAC’s global intelligence office, said the biggest worry remains a cyberattack that disrupts members’ ability to conduct business. Industry leaders, meanwhile, have previously sounded the alarm about the possibility for global conflicts to erupt into digital attacks capable of destabilizing the financial system.

At a January event, Goldman Sachs Group Inc. President John Waldron said the potential for a cyberattack that “hits at the core of the financial markets” poses a significant danger.

“It doesn’t get enough attention,” Waldron said. “When you sort of marry what’s going on with Russia and Ukraine and China and other actors around the world geopolitically, you have to come back and think that one of their major weapons is cyber.”

The FS-ISAC report details a year of relentless cyberattacks globally in which the group raised its threat level from guarded to elevated three times. It typically does so once a year. The threat level system follows a color scheme, with green denoting a guarded status and yellow meaning elevated. However, the threat level wasn’t raised to high (orange) or severe (red) last year, according to the group.

The organization also hosted five member-wide webinars last year to address a security incident with the potential to impact the financial services sector, Walsh said. Typically, FS-ISAC hosts one such “spotlight” session annually.

The increases were due to several factors, including the “rapid digitization of financial services, which accelerated during the pandemic” and increased entry points for hackers to possibly exploit, as well as a sharp rise in “zero-day” vulnerabilities being identified. Zero days are flaws in software and hardware that developers and cybersecurity professionals don’t know about, meaning that once a hacker exploits one of them, they have zero days to fix it.

“There was a dizzying number of vulnerabilities,” Walsh said. 

Third-party hacks remain a threat for the financial sector, due to its reliance on “a myriad of providers and suppliers,” and a potential way to infiltrate organizations that “are considered adequately hardened to traditional attack methods, such as financial institutions,” according to the report. There’s also a concentration risk among financial institutions because many use the same suppliers, according to a FS-ISAC spokesperson.

Several recent attacks on the software supply chain, such as breaches at SolarWinds Corp. and Accellion Inc., have demonstrated that “a one-to-many compromise chain is possible,” the report said.

FS-ISAC also warned that ransomware remains a persistent concern, “a game of whack-a-mole, where operators shut down when they feel the heat of law enforcement, only to reopen under new names months later,” the group wrote.

Despite a concerted effort by law enforcement to crack down on ransomware in the last year, particularly after a devastating attack on Colonial Pipeline Co. that snarled fuel supplies last May, FS-ISAC’s report found that members reported an increase in ransomware-related events in the second half of 2021. Walsh said she had expected to see a measurable change in ransomware attacks because of the increased scrutiny. But aside from a “few hiccups,” she said, “It didn’t drop at all.”

The FS-ISAC report was written in early January, and Walsh said the group recognized then that its predictions could be upended by world events. However, she said FS-ISAC members have been preparing for the possibility of increased cyberattacks for months, reviewing tactics and techniques commonly used by hackers and finding ways to defend against them.

Still, common hacking methods remain an issue. Of the incidents reported by members, 24% started with an employee being targeted by a phishing attack, according to FS-ISAC.

More stories like this are available on bloomberg.com