The recent invasion of Ukraine by Russia has almost certainly escalated the risk of cyberattacks on U.S. financial institutions. On February 17, government officials from the White House, Treasury Department, U.S. Cybersecurity and Infrastructure Security Agency (CISA), and FBI met with executives from leading U.S. banks (including JPMorgan Chase and Citigroup) to discuss defenses and advise vigilance against potential Russian-backed hacking threats.
Suffice to say, the potential of Russian-backed cyber threats has grown exponentially in the days following, as Russia has attacked Ukraine by land, air, sea, and even cyberspace. Hundreds of computers in Ukraine, including those of a financial institution and government agency, have been hit with malicious data-wiping software, and the spread of malware may not stop there. With banking giants like Citigroup and Deutsche Bank still operating offices in Ukraine, shared global connections to Ukrainian systems may lead to infections spreading far beyond Ukrainian borders.
Bracing for Cyberattacks
U.S. financial institutions are no stranger to broad-scale ransomware and cyberattacks. Over the last decade, bad actors have not only become more sophisticated in their attacks but increasingly emboldened by others’ successful ransoms. The 2021 cyberattack on CNA resulted in the payout of US$40 million to a group linked to a Russian cybercrime syndicate, Evil Corp. This came just weeks after the attack on Colonial Pipeline—which disrupted gasoline distribution to the East Coast of the U.S. and resulted in the company paying DarkSide (a Russia-linked cybercrime group) a ransom of nearly US$4.4 million.
Institutions looking to shore up their defenses against cyberattacks would be wise to consider a multipronged approach to cybersecurity. As I discussed in my 2021 report on quantum technology, banks and insurers that make swift intentional strides toward crypto-agility (the ability to adopt new encryption methods without significant disruption to existing infrastructure) stand to benefit from longer-term enterprise data security.
Taking initial steps to maintain compliance with evolving data regulations, identify areas of critical vulnerability, tighten data governance policies, and embrace role-based security and two-factor authentication are a good start. Deployment of zero-trust architecture—which requires continuous validation of all digital interactions—is also key.
Emerging Uses for Quantum
Exploring quantum-safe security methods may soon be the next logical step. As the number and type of cyberattacks has increased fast year over year, even threats that may seem uncommon today, such as that of retroactive decryption, should not be dismissed. Though the advent of a quantum machine capable of cracking public-key encryption is still some years off, the threat of bad actors harvesting sensitive data to later decrypt is very real.
Quantum-safe security promises to protect key business intelligence and customer data from cyberattacks, both from the computers we know today and from the machines of tomorrow. Major players in the financial services space are leaping to attention; JPMorgan Chase recently partnered with Toshiba and Ciena to build a first-of-its-kind Quantum Key Distribution (QKD) network to secure data in transit from eavesdroppers. Capable of supporting 800 Gbps data rates, this QKD network should be able to stand up to the most sophisticated security attacks—even those from quantum computers.
Now more than ever, ensuring top-notch data security should be top of mind for banks and insurers alike. Fortunately, there are ways to prepare for increasingly sophisticated ransomware attacks as well as the looming threat of quantum attacks. For more on 2022 cybersecurity trends, check out Aite-Novarica Group’s Cybersecurity Practice report here. For more on quantum-safe security, financial services applications, and actionable recommendations for early quantum adopters, check out my report Quantum Technology and Insurance here.