Cybersecurity requirements for Financial Services companies

Cyberattacks are on the rise, and the costs and impacts of ransomware, data breaches and other cyberattack campaigns continue to grow. According to IBM's 2024 Cost of a Data Breach Report, the average cost of a financial sector data breach has risen to $6.08 million, maintaining its position as the second most targeted and costly industry behind healthcare. For UK organisations, the average remediation cost of a ransomware attack now stands at approximately $2.58 million when considering downtime and recovery efforts. The combination of growing cybersecurity risk and expanding regulatory pressure makes it vital for financial services organisations to implement security strategies that effectively protect their systems and the data entrusted to them against modern cyber threats.

What are the top Cybersecurity Challenges of Financial Services Organisations?

Due to the volume, value, and sensitivity of the data in their possession, financial services organisations are a primary target of cyberattacks. Financial institutions face various security challenges, including the following:

Ransomware

Ransomware has become a top-of-mind security concern for any organisation. Ransomware attacks are surging in recent years, and the costs of a ransomware attack are growing. For financial services, the average cost of remediating a ransomware attack is $2.58 million, which includes the cost of downtime, people hours, device cost and lost opportunity.

Data Breaches

Data breaches are another leading and costly threat to financial services. According to the 2024 Cost of a Data Breach Report, a data breach in the financial sector costs an average of $6.08 million. As a highly regulated industry, the financial sector has a high cost and impact of breaches because organisations are entrusted with large amounts of sensitive data that must be protected.

Digital Transformation

Many financial services companies have strategies in place for digital transformation and the adoption of next-generation technologies. Recent data shows that 91% of financial services organisations are currently using cloud computing or planning to do so within the fiscal year. Making the move to the cloud while maintaining data security and regulatory compliance can be a challenge, as demonstrated by the massive number of cloud data breaches that occur each year.

Remote Work

The COVID-19 pandemic had a significant impact on how many businesses conduct business. In the wake of the pandemic, many companies are looking to extend their telework programs, sometimes indefinitely. Remote work creates significant challenges for financial services organisations, especially in the areas of data security and regulatory compliance. As employees access sensitive customer data from home or anywhere, it can be more difficult to prove that they are doing so in a way that complies with applicable regulations. Not only do financial services providers need to ensure that data is properly protected but also that it complies with restrictions on data transfers outside jurisdictional boundaries defined by regulations such as the General Data Protection Regulation (GDPR).

Supply Chain and Third-Party Risk Management

Recent events such as the SolarWinds, Kaseya, and Microsoft Exchange hacks have demonstrated the limitations and complexity of a corporate cybersecurity program. While a business may have strong cybersecurity protection for its own environment, it may be vulnerable to attack via its third-party suppliers, vendors, and other partners. The trend toward open banking makes the financial services industry even more vulnerable to these types of attacks. As financial services organisations extend access to sensitive customer data to third-party service providers, they need the ability to ensure that this data remains secure against unauthorised access and is managed in accordance with applicable regulations.

How Modern Security Solutions Address Financial Services Security Challenges

Financial services face a wide range of cybersecurity risks and challenges. However, solutions exist that provide organisations with key capabilities vital to reducing their cybersecurity risk.

Access Management

Access management is crucial to financial services’ data security and regulatory compliance strategies. Many of the major cyber threats to financial services (such as ransomware and data breaches) exploit compromised credentials and privileged access to achieve their objectives. Additionally, managing access to sensitive customer data is the primary focus of most regulations that impact the financial industry. Financial services organisations can manage access to their data and systems in various ways.

Some of the primary components of an access management strategy include:

• Cloud Application Security Broker (CASB): CASB solutions monitor and manage access to an organisation’s cloud-based applications. As financial services pursue digital transformation and shift core applications to the cloud, CASB solutions are vital to preventing unauthorised access to sensitive customer data.
• Multi-Factor Authentication (MFA): MFA requires a user to use a combination of factors (such as a password and a physical token) to authenticate to an account. MFA is commonly mandated for access to customer financial data by regulations such as the Payment Card Industry Data Security Standard (PCI DSS).
• Privileged Access Management (PAM): 74% of data breaches involve third parties with unnecessary privileged access to a company’s systems and data. As financial services expand third-party relationships due to open banking and digital transformation initiatives, PAM solutions are vital to monitoring and managing accounts with elevated access to sensitive systems and data.
• Zero-Trust Network Access (ZTNA): Telework makes secure remote access solutions necessary as employees remotely access corporate data and systems. ZTNA solutions can enable financial institutions to manage data security risks and regulatory compliance requirements by providing access to data on a case-by-case basis determined by role-based access controls.

Endpoint and User Security

With the rise of remote work, endpoint security is more important than ever for financial institutions. As employees work from home, devices outside the traditional network perimeter have access to sensitive corporate and customer data and enterprise resources. If these devices become infected with malware, an attacker can exploit their remote access to attack the business directly.

Financial services need solutions that enable them to prevent, detect, and respond to potential infections on their employees’ devices. Some applicable cybersecurity solutions include:

• Extended Detection and Response (XDR): As malware and other cyberattacks grow more sophisticated, traditional standalone endpoint security solutions are growing less and less effective. XDR solutions are designed to take a more holistic approach to threat detection and remediation, collecting data from multiple sources (endpoints, email, network traffic, etc.) and analysing it to identify these more subtle attacks.
• Secure Web Gateway (SWG): Many security threats that employees face come over the Internet. Users may accidentally browse to malicious or infected websites or be directed there by phishing emails. SWGs sit between a user and the Internet and proxy all connections, enabling the organisation to block visits to inappropriate or dangerous sites and to monitor for malicious content.

Securing the Distributed Enterprise

As financial institutions embrace remote work and digital transformation initiatives, their IT infrastructure becomes more distributed. This is most obvious in cloud adoption, with 91% of financial services organisations currently using cloud computing or planning to do so within the fiscal year.

The shift from on-prem to the cloud creates security challenges for an organisation as traditional perimeter-based defences are no longer effective. Routing all traffic through the headquarters network for security inspection creates network latency and degrades performance, but allowing traffic to continue to its destination uninspected creates risk and risks regulatory non-compliance

As financial services embrace a more distributed IT infrastructure, they can enhance network performance and security by transitioning to modern security solutions, such as:

• Software-Defined WAN (SD-WAN): SD-WAN is a network optimisation tool designed to identify the best route between SD-WAN points of presence (PoPs) over various network media. This can ensure that latency-sensitive applications have the network performance that they require, and security solutions deployed alongside or integrated with SD-WAN solutions can secure all traffic flowing over the enterprise WAN.
• Firewall as a Service (FWaaS): Like other cloud-hosted, service-based solutions, FWaaS provides financial services with increased flexibility and scalability. FWaaS can be deployed alongside an organisation’s cloud-based applications to protect them and can also be used to provide high-performance and scalable protection to on-prem IT resources.

Threat Detection and Response

Rapid detection and response is vital to minimising the cost and impact associated with a security incident. The longer that an attacker has access to systems, the more opportunity to steal or encrypt valuable data, compromise user credentials, or deploy persistence mechanisms to deepen their hold on the system. Financial services need robust threat detection and response to minimise the cost of cybersecurity incidents and meet regulatory deadlines for breach reporting. To do so, companies require visibility into active threats and security personnel capable of addressing them. The following security solutions can help companies to meet these requirements.

• Security Information and Event Management (SIEM): The average enterprise has 75 security solutions, all of which generate logs and alerts about potential security incidents, overwhelming security analysts with too much data. A SIEM solution aggregates and analyses these logs, using context and multiple data sources to eliminate false positives and draw analysts’ attention to the most significant threats.
• Managed Detection and Response (MDR): A global cybersecurity skills gap makes it difficult for organisations to find the security talent that they need, leaving 61% of security teams understaffed. MDR can help an organisation to fill these gaps by augmenting or replacing in-house security teams with third-party providers with security and compliance expertise.

UK Regulatory Compliance Requirements

The UK financial services sector is one of the most heavily regulated in the world. Compliance obligations in this industry directly shape network security architecture decisions, as firms must prove the resilience of their infrastructure to avoid significant fines and reputational damage.

UK firms should monitor FCA and PRA guidance closely for any developments regarding DORA equivalence or updated operational resilience standards. Firms subject to multiple overlapping frameworks benefit from a unified network security architecture. Rather than deploying point solutions for each regulation, a consolidated SASE or SD-WAN approach allows for centralised policy enforcement that satisfies multiple compliance requirements simultaneously.

10 Questions to Ask Your SD-WAN and Cybersecurity Vendors and Service Providers

Many cybersecurity solutions and providers are out there, and it can be difficult to determine which are the best for your organisation. Some questions that you can ask to help identify if a potential vendor or service provider is a good fit include:

1. Can you provide third-party evaluations and customer testimonials?
2. How does your solution integrate with my existing security architecture?
3. Does your tool comply with applicable regulatory requirements?
4. How does your tool reduce exposure?
5. How do your tool’s capabilities map to MITRE ATT&CK, NIST, or other open standards?
6. What reporting capabilities does your solution have?
7. Where is data stored and how is it protected?
8. How often do you distribute updates?
9. How quickly are security patches created and distributed?
10. What is your process for reporting a security issue?
11. Can you provide a third-party security audit report for your products, development environment, etc.?

Robert Sturt

Managing Director

Robert Sturt is a leading expert in SD-WAN and enterprise network solutions with extensive experience in telecommunications and network infrastructure. As a Forbes Business Council member and contributor to TechTarget, he provides strategic insights on network transformation and digital connectivity solutions. His expertise spans SD-WAN implementation, network security, and enterprise digital transformation initiatives.

LinkedIn • Forbes • TechTarget

Fact-checked by: Harry Yelland - Cybersecurity Writer, Netify

Frequently Asked Questions