Digital Transformation Strategies For Banks

Weighing the Risks & Opportunities of New Digital Technologies

• AI is expected to save the banking industry $1 trillion in the US alone.5
• 75% of banks are investing in developing customer-centric business models.6
• 80% of bankers see open banking as a strategic opportunity.7

Malware Attacks

Malware assumes many forms and takes advantage of a great variety of attack vectors, from social engineering scams to software vulnerabilities. Common types of malware include adware, spyware, viruses, trojans, and ransomware. The latter has recently become one of the more popular types of malware.

Phishing Scams

Cybercriminals are always looking for the path of least resistance. It can take less time to hack a human’s trust than a well-engineered network. As such, the human element is usually the weakest link, hence the ubiquity of social engineering scams. By posing as members of a legitimate company, or even as friends or colleagues, scammers attempt to dupe victims into unwittingly surrendering confidential information.

VIP Attacks

Smarter and more resourceful scammers often target high-profile executives rather than carry out simple phishing scams en-masse. These so-called spear-phishing or ‘whaling’ campaigns involve intensive research into the intended victim for the purpose of customizing the attack. In other cases, scammers may impersonate executives to increase their chances of duping lower-ranking employees.

Reputational Risk

Digital sabotage remains a serious problem in an age when cyberwarfare conducted by foreign states routinely targets influential organizations, such as high-profile banks. However, given how quickly information (or misinformation) spreads online, even one angry customer taking to social media to voice their complaints can be enough to result in serious damage to a brand’s reputation.

Data Loss

Not all cases of data loss are a direct result of malicious actors. In siloed organizations where there are no established protocols for exchanging information, there’s a much higher chance of sensitive data being accidentally disclosed. Not only does data loss present serious operational and productivity problems – it can also lead to a breach of data privacy regulations.

Compliance Failures

In an industry where trust is everything, it comes as no surprise that banks are subject to a wide range of regulations. A lack of oversight of digital communications is bound to lead to compliance violations resulting in harsh penalties. With that comes potentially enormous reputational damage, as well as the high costs of litigation, remediation and recovery.

Cybersecurity – Who’s Protecting What?

Both the transformative power and the risks associated with new digital technologies stem from the fact that these critical channels lie outside of network perimeter defenses. On social media, for example, it can be difficult for marketing-oriented community managers to recognize the signatures of spear-phishing or account take over attacks. Moreover, employees posting on their own social media accounts may be vulnerable to targeted social engineering attacks, threats that are completely invisible to the enterprise.
 
Even collaboration channels which are ostensibly for "internal" communications, like Slack or Yammer, present unique challenges. As cloud-based applications, malicious content or malware links remain difficult to mitigate for traditional network controls.

 
Critical Channels Lie Outside of Network Perimeter Defenses

To mitigate these risks, administrators need to maintain complete visibility into digital assets like social media accounts, instant messages, and any other branded communications and properties. Furthermore, security teams need access to real-time threat intelligence. They require the ability to communicate and work with marketing and compliance teams quickly to coordinate remediation efforts. Alerts are not enough, security tools must be able to lock down accounts that are being misused, quarantine threats, and close compromised or impersonated accounts.
 
With a centralized monitoring and control system, security teams have real-time visibility into all information being posted online from owned channels such as social media profiles and instant messages. Instead of trying to secure information at the device-level, such a defense system extends perimeter defenses around cloud-based digital channels, enabling banks to protect critical information assets and business operations.

Phishing remains one of the most common digital threats facing the public sector, not least because it’s the main vector for data theft and malicious software infections, like ransomware. Social engineering scams may be waged against the state, local and federal government organizations alike by foreign actors, unscrupulous political opponents or hackers. Given that digital data is now one of the most powerful and valuable commodities on the planet - digital risks for the government are high too. Malevolent actors are using it to command high ransoms, sow public discord, or even influence election outcomes.

Marketing – The New Frontline in Brand Reputation Protection

9% of consumers claim that they will not hesitate to stop doing business with a bank that suffers a data breach.10 Thus, reputational damage is one of the biggest costs resulting from a data breach.

Traditionally, digital security has always been seen as something only IT departments have to worry about. However, given widespread use of digital channels throughout every department, it’s now safe to say that marketing and customer relationship teams are the new frontlines in brand defense. After all, it can take many years to build up a solid reputation, but mere seconds for just one malicious action to undo everything. The Marketing Accountability Standards Board has found that brand value contributes about 19% of enterprise value, research corroborated by the Forbes Marketing Accountability project.¹¹ Fake or fraudulent accounts that damage brand reputation can, therefore, have a measurable dollar impact on a company’s stock price or value.
 
Hackers routinely target banks using social media, which is what happened when criminals set up fake Twitter accounts to direct Bank of America customers to fraudulent websites designed to steal credentials back in 2015. Moreover, a recent North Korean operation leveraged a LinkedIn job posting to hook a developer working at Chile’s Redbanc ATM network.¹² With brand impersonations being one of the biggest threats to banking, CMOs must work more closely with CISOs as brand reputation risks and cyber threats are now intertwined.
 
By eliminating the widespread corporate confusion as to who is responsible for social media security, for example, banks can extend the culture of accountability to their marketing teams as well.
 
While CISOs may be responsible for selecting and implementing the right technological and administrative controls, CMOs must be responsible for ensuring that their teams communicate reputation risks, such as fake or imposter accounts, to security teams for remediation.

Governance – a Chance to Gain Business Insights

Banks are already spending $270 billion on compliance-related costs every year, but a sizable portion of this is a direct result of corporate confusion as to who’s responsible for things like communications on social media.¹³

Regulatory compliance isn’t just bureaucracy – it’s a direct and highly necessary result of the fact that digital safety and privacy are squarely at the forefront of consumers’ minds. In no case is this truer than banking, in which few people would continue doing business with a financial institution that doesn’t have an impeccable track record when it comes to protecting consumer data. Compliance-related issues are magnified on a massive scale with the use of social media and mobile chat technologies in the banking sector. Larger banks have hundreds of employees posting on multiple platforms multiple times per day. Promissory language and exposure of sensitive or misleading information, whether intentional or accidental, can all lead to serious compliance violations.
 
Compliance-related issues are magnified on a massive scale with the use of social media and mobile chat technologies in the banking sector.
 
However, simply refusing to engage with new technology, or outright forbidding employees from using these channels is unrealistic. Fear is not a sustainable business strategy. Whether it’s incentive structures or a market imperatives, employees will gravitate toward tools that make their jobs easier or more profitable. With this in mind, compliance and risk teams should incorporate ways to enable and empower their workforce to use these new digital tools securely within their digital transformation strategy. Moreover, there is a hidden business opportunity. Automated archiving provides a more actionable data set. By simplifying capture and compliance protocols, an organization frees up time to better analyze what is being captured. In these messages, which before were seen as a compliance risk, may lie key business insights about opportunities for new products or services. In this way, data protection also becomes data enablement.