Mohd Adhari Belal Din: Cybersecurity - safeguarding the future for innovative financial inclusion

Remarks by Mr Mohd Adhari Belal Din, Assistant Governor of the Central Bank of Malaysia (Bank Negara Malaysia), at the "Cybersecurity: Safeguarding the Future for Innovative Financial Inclusion", Kuala Lumpur, 1 August 2017.

The views expressed in this speech are those of the speaker and not the view of the BIS.

It is my privilege to welcome you to this landmark event - A very important policy forum for policymakers and regulators to discuss on the significance of cybersecurity in safeguarding the future for innovative financial inclusion.

Intersection of financial inclusion and cybersecurity

As digital financial services expands in reach, scope and scale, cybersecurity matters a great deal for policymakers and regulators with financial inclusion mandates. The fast-changing digital landscape has brought the financially excluded and underserved populations into the formal financial system, bringing about a positive impact on economic growth and stability. However the rapid paced innovation of digital financial services also opens up opportunities and incentives for cyber-attacks, which challenges the fundamental principles of information risk and cybersecurity management. Leaders must understand the risks associated with digital innovation, and balance the imperative to protect their organisations and consumers with the need to adopt innovative technology approaches.

The likelihood for cyber-attacks and fraud is exacerbated by those who are inexperienced with formal financial services and unfamiliar with consumer rights. Low financial and technology literacy amongst consumers could translate to greater vulnerabilities and exposures. More worryingly, we have seen major cyberattacks occurring globally which caused disruptions to essential financial services and destroy savings or financial assets that the underbanked depend on. Financial institutions are not only prime targets for cyberattacks but bear tremendous fiduciary and legal, regulatory, and compliance responsibility to protect customer data and privacy. Safeguarding trust in the formal financial system is now particularly important for the newly included grassroots.

In financial services, the push for digital innovation, disruptive technologies, delivery of more personalized customer experiences, and seamless access to consumers for more inclusion continuously introduces new threats. Forrester Research calls this dynamic an "epic" battle between privacy and digital innovation, and predicted that by 2020 financial services and insurance companies expect to generate the biggest portion of their total sales from digital products, services, or items sold online. Alongside this drive toward digital business, many organisations rely on legacy IT systems that are expensive to maintain and susceptible to more vulnerabilities, greatly compounding the cybersecurity challenge.

Importance of cybersecurity

The current chairman, president and CEO of IBM, Ginni Rometty had described cybercrime as "the greatest threat to every profession, every industry, every company in the world." While cybersecurity used to be considered an issue primarily for the IT folks, these days it is an agenda item for the entire C-Suite. What has really changed? It is not just the frequency of media reports on cybersecurity breaches. If anything, these are merely symptomatic of a larger shift underway. Cyber-attacks are fueled by increasingly sophisticated technologies along with relatively new trends in mobility usage, social media, and rapidly expanding connectivity, all in the hands of organized online criminal networks.

The first six months of 2017 have seen an inordinate number of cyber-attacks and they were not just the standard corporate breaches. Already there has been viral, state-sponsored ransomware, leaks of spy tools from US intelligence agencies, targeted denial-of-service attacks and full-on campaign hacking. Unfortunately, this is likely a prelude of more cyber-attacks to come.

Let me share with you some key statistics on cybersecurity:

• The global cost of cybercrime will reach USD2 trillion by 2019, a threefold increase from the 2015 estimate of USD500 billion.
• Last year, cybersecurity researchers estimate that criminals made over USD1 billion through ransomware, with victims ranging from the chief executives of Fortune 500 companies to mom-and-pop businesses and private individuals.
• 1 in 131 emails contained malware in 2016, the highest rate in 5 years.
• 76% of organisations worldwide reported being victim of a phishing attack in 2016
• Only 38 percent of global organizations claim they are prepared to handle a sophisticated cyberattack.
• Global spending to combat cybercrime will top USD80 billion this year, with organisations increasingly focusing on detection and response. I shall deliberate more on this shift of focus.

Shift cybersecurity focus to detection and response

Traditionally, the main focus of cybersecurity traditionally has been on prevention. However, organisations which have been taking preventative approaches to combat cybersecurity threats are coming to realise that this strategy have not always been successful in blocking malicious attacks. A paradigm shift is required to move from the 'old ways' of trying to prevent every threat. Organisations need to emphasize on detecting and responding to malicious behaviors and incidents, because even the best preventative controls will not prevent all incidents. There is just no such thing as perfect protection. As there are more and more innovative financial inclusion initiatives coming on-board, we will all need to continually reassess how much risk and controls are appropriate.

The disparity between the speed of compromise and the speed of detection is one of the starkest failures discovered in breach investigations. According to a 2015 report by Mandiant, the average targeted malware compromise was present for 205 days before detection. The longest malware presence was 2982 days, and 69% were actually discovered by external parties and not internal IT security functions. Additionally, the 2015 Verizon Data Breach Investigations Report highlighted that, "in 60% of cases, attackers are able to compromise an organization within minutes."

In this digital world, the pace of change and innovation is already too fast to anticipate and, combined with advanced and persistent attacks, it will be impossible to defend against every type of cyber-attack. Organisations must invest in technical, procedural and human capabilities to detect when a compromise occurs. They must provide the tools for first responders to react quickly and investigate the source and impact of breaches, compromises and incidents.

Most essentially, there is a need to balance the right mix of investments across prevention, detection and response capabilities vis-à-vis an organisation's risk appetite. Not only are new and advanced tools needed to supplement existing protection solutions, but also new skills and culture need to be developed within existing security teams and the larger organization, more so within the ambit of digital financial services whereby regulatory compliance plays a major role in cybersecurity.

Regulatory compliance does not equal cybersecurity

Regulations are designed to protect organisations, clients, and consumers against the potentially devastating consequences of cyber-attacks. Regulatory requirements for financial institutions have undeniably become tougher, and organisations are continuously burdened by the need to interpret what a fragmented global regulatory landscape means for their operations. Financial institution often find themselves chasing regulatory compliance, rather than leading independent security planning. Regulatory compliance by itself is not cybersecurity.

When new cybersecurity requirements or frameworks are published, organisations must first determine their current security state and identify gaps. If routine testing and remediation are conducted, being compliant or meeting regulations should be easier to achieve. Of course, some parties will want or need to go above and beyond regulations. Too often, however, organisations find themselves in reactive mode.

Rather than taking a "check the box" approach, organisations should implement an integrated and cross-discipline effort in order to adopt an enterprise-wide program of cyber risk management that is tailored to business objectives, while also maintaining a tolerable level of risk. By taking an integrated approach to the broad objectives of cybersecurity management, organizations can achieve these business and security-focused goals, while also achieving regulatory compliance in an effective and efficient manner.

Ultimately, cyber resilience which is the ability to defend, respond to, and recover from a breach, should be the end goal for organisations. Although compliance is rightly prioritized in the highly regulated financial services industry, being compliant should be viewed as a result of having good security practices rather than as a check-the-box exercise that is expected to guarantee security. The focus should be shifted toward conducting good cyber due diligence and assessments, implementing proper detection controls, having effectively enforced third-party risk and insider risk programs and conducting testing such as red teaming in order to simulate the organisation's response in the event of a serious attack. If such practices are implemented, organisations can stay ahead of industry regulations and embrace innovation, because their response to any new cybersecurity requirement is less likely to demand a dramatic overhaul of their current program.

The world today is remarkably different from the world we were living 20 years ago. The world is fast converging in aspirations and ideals because of globalization and technology, and with that comes different risks. These forces of change present equal measure of challenges and opportunities but are exciting. I would like to share some open questions for everyone to ponder upon. What is the top cyber security concern for innovation in financial inclusion which we face today? Have we allocated enough resources to properly address the most significant cyber security threats? What specifically have we done? What is our plan for identifying and addressing cyber threats? Is it current? And what does your organization need to do to ensure continuous cybersecurity vigilance moving forward?

May we keep these questions in our mind as we have fruitful discussions and take home great lessons in order to keep pushing the boundary of what we could achieve.

With that, I hope you will have an engaging, successful and fruitful discussion in the next 2 days. I strongly believe this forum would be a valuable platform for members to learn and share their knowledge and experiences as well as generate new ideas, approaches and innovations as take-aways that could be emulated in your respective countries.

Thank you.