Experts debate whether the financial industry has a leg up in terms of their cybersecurity strategy when compared to other industries.
FOR
Dave Aitel, CEO, Immunity
We see this in their annual budgets, which actually earmark a significant portion to network defense (from security executives to third-party pen-tests, etc.). We also see it in their investments in the cloud and fraud detection. They've done this because they have to – banks live or die by their image. So for them, it's not just about protecting their data, it's almost equally about protecting their reputations too.
The financial industry has really led the way in a number of areas, including intra-industry coordination (FS-ISAC and Soltra Edge are two great examples), anomaly detection, the cloud, exfiltration filters and firewalls.
CON
Joe Loomis, CEO, CyberSponse
For a long time, the assumption has been that major financial institutions are the “crème de la crème” of the IT security world. But is this really true? Recent disclosures by JP Morgan, Nasdaq and even the string of DDoS attacks on banks starting in 2012 should cast doubt on this assertion. It is true that banks spend more money on IT security than most other organizations, and that's commendable, but it doesn't mean those expenditures translate into top-notch security. Instead, they're buying all the latest tools the market can offer while not managing security incident response properly.
Financial institutions remain plagued by a number of key security problems, such as long procurement phases, a fear of change that's deeply ingrained within the management structure, not enough key decision-makers who can make the tough calls on IT security, a reliance on outdated methods of email/ticket/manual management systems, little or few frameworks or controls in place around incident response, simulations and training, etc.
