It’s that time of year again, when companies review their plans for the upcoming year and look for ways to improve on their previous year’s growth (or lack thereof). But growth does not always mean sales and profits. While those are important, companies also need to look at growth in the maturity of their security operations (SecOps) effort. CISOs must improve their detection of new and growing threats each year, and measure the success of response and recovery capabilities.
Unfortunately, many SecOps teams face the year with reduced budgets and an ongoing struggle to retain the right talent, just as threats are becoming more frequent and complex. Ransomware continues to be a real risk to businesses both large and small, cloud migrations or hybrid environments create configuration complexities that can leave organizations vulnerable, and changes in regulatory compliance or privacy laws will all make 2023 challenging for SecOps teams.
Security leaders responsible for banks, wealth management firms, insurance companies or mutual funds must find creative solutions to four critical challenges in 2023: ransomware attacks, rising insurance costs, staffing or skills shortages, and compliance requirements impacted by new privacy laws. Each of these challenges must be met while facing economic headwinds.
Challenge 1: Rising Risk of Ransomware
In 2023 the risk of ransomware attacks will likely increase for financial services organizations. Emboldened by successful attacks, obscured by geopolitical instability in Ukraine, and driven by economic gains beyond credit card data, ransomware groups develop new tools and techniques every day as part of a growing ecosystem of malware developers, access brokers, and digital hostage negotiators.
According to the Sophos State of Ransomware in Financial Services Report, 2022, “55% of financial services organizations were hit by ransomware in 2021, up from 34% in 2020.” Over the course of one year, attackers have become more skilled, and continue to ramp up the scale of their attacks.
Not only are attacks becoming more frequent and advanced, but the same report found that “52% of financial services organizations paid the ransom to restore data, which is higher than the global average of 46%.” The average remediation cost for victims in the financial services industry rose to $1.59M, above the global average of $1.4M for other industries.
Financial institutions are keenly aware of ransomware risks, and have made large strides to provide security and protection to their customers. The Sophos report showed 98% of those surveyed have increased their cyber insurance coverage or have upgraded their cyber defenses in the last year. An astounding 89% of those surveyed reported having cyber insurance coverage against ransomware specifically, highlighting the industry’s awareness of the dangers of ransomware and the risk those attacks pose to customer data.
Solutions to the Challenge of Rising Ransomware Risk
To address the challenge of rising ransomware risk, SecOps teams in financial services must ensure 24/7/365 monitoring, maintain clear response and recovery plans, and integrate the latest threat intelligence to protect against new ransomware strains or threat groups. For more tips on protecting your organization from ransomware, see our eBook.
Challenge 2: Rising Costs of Cyber Insurance
With the rise in cyber attacks and the growth in attack sophistication, the cost of cybersecurity insurance has increased dramatically. Cyber insurers have reduced coverage, and now require more stringent security controls by policyholders.
Cyber insurance premiums increased by an average of 28% in the first quarter of 2022 compared with the fourth quarter of 2021, according to the Council of Insurance Agents & Brokers (CIAB), an association for commercial insurance and employee benefits intermediaries (3). As rates continue to climb and insurers offer more limited coverage, cyber insurance might become more and more difficult for many companies to afford. Without better security controls, many organizations may find cyber insurance unobtainable.
Solutions to the Challenge of Rising Cyber Insurance Costs
Prepare your organization for the true costs of an attack. Lost revenue, damaged brand reputation, and remediation costs are never fully recovered through cyber insurance alone. The cost of more coverage in 2023 may soon outweigh the cost of better security practices or managed services.
Learn More about Deepwatch MDR
Challenge 3: Growing Shortage of Security Talent
Even for companies that aren’t struggling with budget reductions, the lack of skilled professionals with knowledge of financial compliance requirements impacts the amount of “hireable” professionals in the industry. There are currently over 115K unfilled/open finance sector cybersecurity jobs within the U.S.(2) Staffing shortages increase organizational risk and can also cause burnout and possible turnover of security talent.
According to the State of Cybersecurity 2022 by ISACA, 60% of companies surveyed report difficulty retaining qualified cybersecurity professionals. The long working hours and increasing threat pressures placed on IT security decision-makers and teams are not sustainable at this pace.
Solutions to the Challenge of Skills and Talent Shortages
While hiring additional security analysts can be beneficial, it is not always the most cost-effective or efficient solution for many companies facing challenges in 2023. Partnering with an external MSSP is often a better, more cost-effective solution. Managed Detection and Response companies such as Deepwatch offer highly-skilled staff and can easily scale at a fraction of the cost of an internally staffed SOC.
Challenge 4: Changing Compliance and Privacy Requirements
2023 could be a watershed year for privacy laws in the U.S. as California, the first state to enact a sweeping consumer privacy law, updates its standard, while four additional states will join them in the implementation of state privacy laws. These laws, along with an expected national cybersecurity blueprint from the White House, could finally establish a new era of privacy in the U.S.
Solutions to the Challenge of Changing Compliance and Privacy Requirements
This new attention to privacy and security will create a number of complex regulations and increase risk of noncompliance fines, putting pressure on enterprises to hire knowledgeable staff to address security compliance and risk management concerns. Choose a skilled MDR provider to help your organization maintain compliance and improve SecOps maturity.
Financial Services organizations will face these 4 key challenges in 2023, all against the headwinds of an uncertain economy and reduced budgets. To best optimize your company’s security budget, consider utilizing an external MDR expert to reduce overall costs. Outsourcing managed security can alleviate both cost and time, with a high-quality, high-confidence result.
How Deepwatch Can Help
Deepwatch partners with customers to speed detection and response, providing SOC capabilities and 24/7/365 protection. The Deepwatch SecOps Platform leverages security telemetry across data sources to detect complex threats and provide a complete real-time response – programmatically, customized to each customer’s environment.
Deepwatch security experts work in partnership with your security team to identify and prioritize threats, and to proactively mature your SecOps effort.
As a partner and extension of internal security teams, Deepwatch offers customers peace of mind and assurance that threats are rapidly and holistically addressed, unlocking a new level of security that supports business outcomes.
To learn more, please visit https://www.deepwatch.com/managed-detection-response/.
↑
Share