After an unrelenting year of fighting off cyber threats, the financial services sector should expect more of the same or even worse, as nation-state hacking campaigns are expected to mirror geopolitical tension and ransomware gangs retool to dodge increased scrutiny, an industry group report showed. The Financial Services Information Sharing and Analysis Centre, known as FS-ISAC, said in its annual report on cyber threats that global tension could fuel further attacks by state-backed hackers and patriotic hacktivists. In addition, after a series of devastating breaches on the software supply chain, the group said that its members need to be wary of potential nation-state meddling in products and services being used. “We expect current trends to continue and possibly worsen over the next year,” said the report, which was released on Thursday. Cybersecurity is “no longer just a back-office cost”, the group said, and cyber threats pose critical business risks, including operational disruption, lawsuits and credit downgrades. FS-ISAC, which shares cyber intelligence among financial institutions around the world, published the report at a time when Russia-Ukraine crisis has kept organisations in the US and elsewhere on alert for possible retaliatory attacks. So far, those fears appear largely unrealised and cyber attacks have played a smaller role in the conflict than many predicted. The report represents a relatively rare example of an industry publicly acknowledging cyber risks and encouraging its members to prepare for them. In an interview about the report’s findings, Teresa Walsh, who leads FS-ISAC’s global intelligence office, said the biggest worry remains a cyber attack that disrupts members’ ability to conduct business. Industry leaders, meanwhile, have previously sounded the alarm about the possibility for global conflicts to erupt into digital attacks capable of destabilising the financial system. At a January event, Goldman Sachs Group President John Waldron said the potential for a cyber attack that “hits at the core of the financial markets” poses a significant danger. “It doesn’t get enough attention,” Mr Waldron said. “When you sort of marry what’s going on with Russia and Ukraine and China and other actors around the world geopolitically, you have to come back and think that one of their major weapons is cyber.” The FS-ISAC report details a year of relentless cyber attacks globally in which the group raised its threat level from guarded to elevated three times. It typically does so once a year. The threat level system follows a colour scheme, with green denoting a guarded status and yellow meaning elevated. However, the threat level wasn’t raised to high (orange) or severe (red) last year, the group said. The organisation also hosted five member-wide webinars last year to address a security incident with the potential to affect the financial services sector, Ms Walsh said. Typically, FS-ISAC hosts one such “spotlight” session annually. The increases were due to several factors, including the “rapid digitisation of financial services, which accelerated during the pandemic” and increased entry points for hackers to possibly exploit, as well as a sharp rise in “zero-day” vulnerabilities being identified. Zero days are flaws in software and hardware that developers and cybersecurity professionals don’t know about, meaning that once a hacker exploits one of them, they have zero days to fix it. “There was a dizzying number of vulnerabilities,” Ms Walsh said. Third-party hacks remain a threat for the financial sector, due to its reliance on “a myriad providers and suppliers”, and a potential way to infiltrate organisations that “are considered adequately hardened to traditional attack methods, such as financial institutions”, the report said. There is also a concentration risk among financial institutions because many use the same suppliers, a FS-ISAC representative said. Several recent attacks on the software supply chain, such as breaches at SolarWinds and Accellion, have demonstrated that “a one-to-many compromise chain is possible”, the report said. FS-ISAC also said that ransomware remains a persistent concern, “a game of whack-a-mole, where operators shut down when they feel the heat of law enforcement, only to reopen under new names months later”, the group wrote. Despite a concerted effort by law enforcement to crack down on ransomware in the last year, particularly after a devastating attack on Colonial Pipeline that snarled fuel supplies last May, FS-ISAC’s report found that members reported an increase in ransomware-related events in the second half of 2021. Ms Walsh said she had expected to see a measurable change in ransomware attacks because of the increased scrutiny. But aside from a “few hiccups”, she said, “it didn’t drop at all”. The FS-ISAC report was written in early January, and Ms Walsh said the group recognised then that its predictions could be upended by world events. However, she said FS-ISAC members have been preparing for the possibility of increased cyber attacks for months, reviewing tactics and techniques commonly used by hackers and finding ways to defend against them.
