As a symbolic and data-rich target, Wall Street faces a number of cyber threats. Regardless of the size of an attack, there remains the need for effective recovery and response mechanisms, underpinned by preventative measures.
The hub of the US financial sector, Wall Street holds great symbolic and physical importance. As such, nation states and lone hackers are reported to have launched attacks in a bid to disrupt national security or gain financial advantage through the sale of stolen confidential data.
In 2011, Iranian-sponsored hackers launched attacks against the websites of 46 Wall Street institutions, including the New York Stock Exchange and NASDAQ. Although inconclusive, US-led sanctions on Iran possibly triggered the cyber attack as retaliation. This would reflect a symbolic attack on the US financial markets.
Listen to Data and Goliath: The Hidden Battles to Capture Your Data and Control Your World
More recently, Russian hackers allegedly acquired over 150,000 press releases from Wall Street publications in August 2015. It is claimed that this data was then used to gain a trade advantage, worth $100 million.
Both examples show how, by targeting Wall Street, hackers can influence foreign affairs or make financial gains, estimated to be in the realm of $120 billion in the US alone during 2013.
What Does It Mean to Be Cyber-Secure?
Due to the technological inter-connectivity of Wall Street, a cyber attack is not an isolated affair. Instead, multiple financial institutions are targeted, as shown in the previous examples. Inter-connectivity is both a blessing and a curse. It is vital for the sharing of real-time financial data, crucial to Wall Street firms. However, one data breach can disrupt multiple organisations.
This is where Wall Street is not so cyber secure. Firms are reluctant to publicly acknowledge mass data breaches, over fears that this will produce market volatility and damage a firm’s reputation. However, the reporting of cyber attacks to other interconnected institutions is crucial in responding to and preventing, further attacks.
Cyber security exercises, such as Quantum Dawn 3, held in 2015, featured 80 financial firms. It pitted Wall Street against fictitious cyber adversaries, to test its detection, reaction and recovery from attacks. Communication and cooperation between firms and the government were crucial in maintaining the operation of Wall Street during a series of simulated attacks. This remains true outside of the controlled safety of an exercise.
The Human Element in Cyber-Security
Whilst information technology has developed rapidly, humans remain the greatest security risk to Wall Street. Cyber security is gradually rising up the agenda in Wall Street board meetings. In a survey conducted by FIS, a financial services technology consultancy, 77% of participating banks view cyber security as their biggest risk.
Despite being identified as a threat, only 18% of those firms questioned adopted the updating and reporting mechanisms prescribed by the US government. This is to keep all interconnected networks on Wall Street aware of live attacks. Whilst a good understanding of the potential risks posed by cyber attack is evident, Wall Street will not remain cyber secure for long due to inaction.
Read NSA, the Military-Internet Complex, and Cybersecurity
The CEOs of the future, the so-called Millennials, may be the greatest hope for improving Wall Street’s cyber security. Tech-savvy financial leaders who have lived and breathed information technology since birth are best placed to detect, counter, and aid Wall Street’s recovery from cyber attack.
As FIS’s survey cleared illustrated, however, increased security spending and the hiring of experts still fails to influence boardroom decisions sufficiently at present. The basics of prevent, respond and recover are relatively neglected.
Overall, therefore, Wall Street is responding to cyber threats half-heartedly. Investment in cyber defence ebbs and flows, increasing immediately after attacks, yet dwindling when none are detected. Palo Alto Networks and FireEye, two leading cyber security firms, depreciated over a quarter in value in 2016. Wall Street generally views cyber security as a short-term risk or issue.
Is Wall Street Cyber-Secure?
Wall Street can be considered relatively cyber secure at present. Successful breaches have allegedly lost millions, though these attacks are infrequent. It must be understood, however, that no organisation can be fully cyber secure. Efforts should, therefore, be focused on improving cyber defenses, resilience, and recovery capacity in order to minimize the disruption of a successful attack.
There is a noted increase in cyber threat awareness, crucially at the executive level. It is hard to say how long this relative security will last. Wall Street must remain agile, adapting to new threats as they develop.
Less tech-savvy Wall Street executives cannot remain complacent. They must not only understand cyber threats, but act upon them. This requires more than just investment and the recruitment of experts. Millennials are very likely to have a greater grasp of the risks and opportunities that cyber connectivity presents, having been born into a technologically interconnected world, more so than senior executives relying on risk briefings by younger subordinates.
Wall Street also has a long way to go in adopting simple defense mechanisms. Unanimous incident logging and sharing among institutions of all sizes and government departments would be a start. Mass-participant exercises such as Quantum Break 3 must continue to expose vulnerabilities.
Cyber insecurity is a growing threat and complacency should not be an option. Wall Street must get the basics right. The logging and reporting of cyber attacks will improve resilience. It provides wisdom so that CISOs can learn the methods of attack used by hackers and tackle them in the future.
