Cybersecurity
Risks and Opportunities
Syed Mehdi Hassan, World Bank
Doha, State of Qatar
5 November 2017
Strictly Confidential © 2013
Agenda
• Key Cybersecurity Risks in Financial Sector
• Recent Cybersecurity Events
• Cybersecurity Landscape
• Threats and Vulnerabilities
• Risks and Opportunities
• Vulnerabilities
• Using Principles
• World Bank Technical Assistance Programs
2
Key Cybersecurity Risks in the Financial Sector
•Direct Financial Loss: Monetary loss through cyber crimes
•Indirect Financial Loss: Cost of recovery/remediation, Loss through market share
shrinkage, reputation damage, regulatory fines, etc.
•Client Data Loss: Loss or unauthorized disclosure of client Information
•Service Unavailability: service level agreements and expectations set with
stakeholders may not be met (indirectly revenue may be lost and penalties imposed)
•Money Laundering: proceeds of crime are transformed into legitimate money or
other assets.)
•Fraud: Losses due to malicious acts intended to swindle or misappropriate property
Recent Cybersecurity Events
Central Bank of Bangladesh heist Personal information associated with an
attempt to steal $951 million estimated 3 billion Yahoo! user accounts
through fraudulent Swift was compromised
transactions
Compromised email system. Several
gigabytes of data exfiltrated
Bangladesh
Bank
Feb. 2016 Sept. 2017 Dec. 2016
WannaCry
Over 45,000
ransomware attacks
Breach exposed sensitive data for reported in over 100 State sponsored hacker group infiltrated the
143 million US customers countries around the systems of the Democratic National
world Convention
Sep. 2017 May 2017 Jun. 2016
4
Recent Cybersecurity Events – Key Lessons
Red indicates countries impacted by WannaCry
Key Lessons:
• Brilliant on the Basics ‐ Install the latest patches, upgrade systems before they are out of vendor
support.
• Manage vulnerabilities ‐ Have adequate processes to detect vulnerabilities and missing security
patches. Equifax ordered patch deployment back in March, yet failed to detect missing patches.
• Strengthen security monitoring and threat detection ‐ The attacker gained initial access to sensitive
data on May 13, 2017. Equifax first observed suspicious activity on July 29.
• Conduct phishing exercises – Phishing emails were the primary delivery method for WannaCry.
5
The Changing Cybersecurity Landscape
• Cybersecurity is not a problem that can “be fixed”, but rather a
persistent issue requiring a series of dynamic trade‐off
decisions
• Perfect protection is difficult to achieve. Focus on detection
and response to reduce dwell times of threats and the potential
damage when breaches inevitably occur
• Focus cannot be solely technology‐driven, but must be
augmented by changes in user behavior driven by a corporate Continuous improvement of
security culture cyber‐security capabilities
through people, process,
and technology
• Cybersecurity is not an IT‐only issue, but an enterprise‐wide
issue requiring a risk management approach
6
Information Security Threats
External Threats Internal Threats
Attack Patterns
• Organized Crime • Careless/Unaware User
Crimeware
• Hacktivist Group • Malicious Insider
• State or Business Sponsored Entity Cyber-Espionage
Denial of Service
• Destructive attacks are evolving i.e. NotPetya Ransomware network worm
designed to destroy data
• Data manipulation and data integrity attacks are increasing, some with objective Insider and Privilege Misuse
to create “fake” information to support propaganda
• Proliferation of insecure IoT devices leads to more Distributed Denial of Service Errors
(DDoS) attacks
• Third‐party breaches exposing staff’s sensitive data
• Business email compromises where phishing emails were targeted at senior Web Application Attacks
management, staff, and central banks
• Ransomware attacks are becoming more targeted as it is a lucrative business Business Email Compromises (CEO Fraud)
model for cyber criminals
• Nation state actors are launching more sophisticated attacks
7
Risks and Opportunities
Strategic Elements Potential Risks Opportunities
Cloud Adoption • Unauthorized disclosure of data • Increased business resiliency
due to commingled environments • Leverage vendor’s security capabilities
• Loss of governance and control • Faster time to market
• Shadow adoption • Cost efficient solution to improve country
office performance
• Embed cloud risk management into ITS Risk
Management
• Availability of innovative solutions
Expanded usage of • Loss or theft of sensitive • Better user experience
mobile devices information • Increased productivity
• Geo‐tracking of employees and • Location and device independence
clients
Use of 3rd party • Unavailability of core services • Increased agility and flexibility in meeting
services • Unauthorized disclosure of data business delivery needs
• Vendor lock‐in • Optimize sourcing options
8
Vulnerabilities
• Maturing information security • Emerging capability for • Evolving cloud and third party
culture identification and governance vendor landscape
of critical information assets
• Fluctuating contingent • Complex IT infrastructure and
workforce • Inconsistent information delayed patching
classification
• Accommodations for personal • Potential weak controls and
and consumer‐based • Maturing data access, privacy cybersecurity posture of
technology protection and vendor associated partners and third
management practices parties
9
Using Principles to Guide the Program
Balanced Approach to a Secure Consistent, Reusable, and
Business Outcome Resilient Solutions
Simplify,
Leverage Industry
Standardize, and
Solutions Continuous Improvement with Automate
Cross‐Discipline Perspective
Data Driven Insights Controls Closer to the
and Decisions Data
10
World Bank Technical Assistance Programs
Given the increasing critical importance of Cybersecurity to the
global financial stability, the World Bank has setup a cross
functional team that provides technical assistance to member
states in the following key areas:
Developing regulatory and supervisory practices on
cybersecurity in the Financial Sector
Conducting Cyber Crisis Simulation Exercises
Assistance in preparing National Cyber Security Strategy
Guidelines
Tools and capacity building to combat cybercrime in emerging
economies (World Bank Toolkit to Combat Cyber Crime)
Thank you
12
