City of London firms are struggling to master the basics of effective cyber security and the sector lacks the skilled professionals to help them fix this problem, the Financial Conduct Authority's expert in the field has warned. Speaking at the Financial Information Security Network in Luton today, Nausicaa Delfas, the FCA's acting chief operating officer who previously led its approach to IT and cyber resilience, outlined the cyber threats to financial services firms. She said: "We have witnessed some interesting changes over the last 12 months, with the re-emergence of some old foes (such as ransomware) and the development of some innovative and dangerous criminal networks." Against this backdrop, she said financial services firms need to have "good detective capabilities" and the ability to recover and respond. But she added that the regulator's work "has shown us that firms continue to struggle to get the basics right". She pointed to the 2016 Verizon Data Breach Investigations Report, which analysed 2,260 breaches and 64,199 security incidents across 61 countries. It found that just 10 vulnerabilities accounted for 85% of security breaches. In most cases, Delfas said, these were well-known and had fixes available at the time of attack. "Tools to enable effective management of vulnerabilities are well established, and yet organisations either don’t use them, or don’t use them effectively," she said. In addition, Delfas called on the UK finance sector to develop its pool of cyber security expertise. The government has identified 13 Academic Centres of Excellence in Cyber Security Research but financial services firms also need to play a role: She said: "It is no longer sustainable to rely on experienced hires attracted by ever larger compensation packages – we need to grow the talent pool." The EU's new General Data Protection Regulation, coming into force in May 2018, will require firms to appoint a data protection officer. But Guy Cohen, strategy and policy lead at data software startup Privitar told FN earlier this year: "There aren’t enough people, and to the people that are [qualified] it may not be an appealing job." Delfas said firms need to ensure existing employees are better educated and train them so that they become "security focused individuals". Organisations also need to share information about cyber security threats — the FCA has set up Cyber Coordination Groups for this purpose — because they cannot be tackled in isolation, she warned. "We have to expect the unexpected," Delfas concluded.
The UK financial sector is struggling to master basic cybersecurity and lacks the skills required to address the problem, a review from the Financial Conduct Authority has warned. Nausicaa Delfas, the FCA's acting COO who previously led its approach to IT and cyber resilience, said that the re-emergence of ransomware and the development of innovative and dangerous criminal networks have been particular features of the past 12 months. Although tools to manage vulnerabilities are well established, many organisations either don't use them or use them ineffectively, she added. The FCA advised that organisations share information about cyber threats and better educate employees.