{"id":37224,"date":"2020-02-07T12:09:48","date_gmt":"2020-02-07T12:09:48","guid":{"rendered":"https:\/\/www.intelligentcio.com\/eu\/2020\/02\/07\/banking-on-europe-as-the-epitome-of-cybersecurity-and-privacy\/"},"modified":"2022-09-20T10:19:20","modified_gmt":"2022-09-20T09:19:20","slug":"banking-on-europe-as-the-epitome-of-cybersecurity-and-privacy","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/eu\/2020\/02\/07\/banking-on-europe-as-the-epitome-of-cybersecurity-and-privacy\/","title":{"rendered":"Banking on Europe as the epitome of cybersecurity and privacy"},"content":{"rendered":"\n

As one of the largest financial institutions in the world, Standard Chartered Bank is under no illusion that it can\u2019t function without complete protection of its IT infrastructure. Yuval Illuz, Group CISO, COO, Trust, Data and Automation, Operations, Standard Chartered Bank, discusses what it means to operate with a secure approach, how Europe is best placed to deal with cyberthreats and some of the security implications of being such a largely established enterprise. <\/em><\/p>\n\n\n\n

\n
\"\"<\/figure>\n<\/figure>\n\n\n\n

Yuval,\nyou are the CISO (and COO) of Standard Chartered Bank \u2013 what does this mean in\nterms of the cybersecurity challenges you face? <\/strong><\/p>\n\n\n\n

Protecting\nour customers\u2019 data and privacy is a top priority at Standard Chartered and\nessential to maintaining their trust in us as we continue to live our brand\npromise to be \u2018Here for good\u2019. With the behavioural shift underway towards\ndigital banking and channels, coupled with the dynamic cyberthreat landscape,\nit is imperative to have robust security controls in place. We are committed to\nindustry best practices and compliance with applicable regulations in all the\nregions that we operate in. While we continue to deepen our cybersecurity\ncapabilities to counter threats, we also place an equal emphasis on\nstrengthening our security culture in the bank by enhancing information and\ncybersecurity awareness to build a culture of secure conduct among our\nemployees: our own human firewall, if you will.<\/p>\n\n\n\n

What\ncyber trends are looking to be the most prevalent for the year ahead?<\/strong><\/p>\n\n\n\n

The\ngrowing number of organisations moving their workloads and operations to the\ncloud presents a heightened risk for inadvertent data exposure. This oversight\ncan have severe ramifications for data security. The number of financial\ninstitutions affected in cloud data breaches has grown dramatically in the last\ntwo years. Enterprises will have to continuously\nimprove their cloud approach and strategy to avoid significant regulatory fines\nthat continue to make headlines.<\/p>\n\n\n\n

One\nof the dominating trends in the past year, which has persisted in 2020, was\ntargeted ransomware attacks. We believe that this threat continues to be highly\nvisible, as coordinated attacks by various threat\nactors could pave the way for even more destructive attacks that could paralyse\norganisations.<\/p>\n\n\n\n

How\nwould you describe Europe\u2019s current cybersecurity landscape?<\/strong><\/p>\n\n\n\n

European\npolicy in cybersecurity and privacy has undergone a paradigm shift in recent\nyears in the wake of a Digital Transformation that has enabled new business\nmodels and shaped entire industry landscapes. As\nbusinesses go digital, they are collecting more personal and financial data\nabout their customers than ever before. There is also no doubt that\nEurope remains a region of focus in terms of targeted cybercrime activity. As\nsuch, there has been a pressing need to scale up policy and regulation to\nensure that businesses operate in a secure fashion and that cybersecurity\nconcerns do not unduly impede the progress of Digital Transformation.<\/p>\n\n\n\n

With\nthe introduction of the General Data Protection Regulation (GDPR), the\nDirective on Security of Network and Information Systems, and the proposed\ndevelopment of an EU Cybersecurity Certification Framework, Europe is now considered to be the epitome of cybersecurity\nand privacy. <\/p>\n\n\n\n

Are\nthere any specific countries within the region that you think are lagging\nbehind when it comes to operating with a secure approach?<\/strong><\/p>\n\n\n\n

In the last 15 years we have seen cybercrime increasing in\nsophistication, targeting governments, institutions, business and personal\nlives – and there has been a concerted effort across Europe to ensure that\nnationwide standards, regulations and law enforcement approaches are in place\nto respond accordingly.<\/p>\n\n\n\n

Still,\nno country today is ahead of cybercriminals. Threat actors have no boundaries,\ndo not have to wrestle with policy and regulation, and freely trade information\nwith one another. With technology advancing rapidly and embedding itself deeper\ninto our lives and the ecosystem, organisations need to\nrealise the importance of continued investment in cybersecurity. The\nsecurity awareness aspect must also not be overlooked as humans can play a\nproactive role in being part of a human firewall, versus being seen as \u2018the\nweakest link\u2019 – an often repeated, but inaccurate, adage. <\/p>\n\n\n\n

How\nis Europe placed in terms of dealing with evolving cyberthreats five years from\nnow?<\/strong><\/p>\n\n\n\n

The\nEU Cybersecurity Act is an excellent opportunity to define a common and\nunifying set of cybersecurity regulations and develop an efficient\ncertification landscape by building on existing initiatives, harmonising\nprocesses and leveraging on the profound expertise of national cybersecurity\nprofessionals. The proposed development of an EU Cybersecurity Certification\nFramework can be a key instrument to enhance public trust in digital services.\nThe need for security and privacy is no longer limited to governmental\napplications or payment systems.<\/p>\n\n\n\n

Staying\nvigilant and constant monitoring of the threat landscape must also be part of\nthe governance. As threats and attacks need to be communicated and properly\nhandled across all sectors, the EU should encourage the\nadoption of industry-wide cybersecurity incident simulation exercises, which\nwill strengthen the overall cyber-resilience of Europe.<\/p>\n\n\n\n

What\nare some of the security implications of being such a largely established\nfinancial institution?<\/strong><\/p>\n\n\n\n

As\nStandard Chartered continues to embrace new and emerging technologies, we will\nneed to enhance security in our design methodologies. For instance, as\ninstitutions such as ours continue to connect more gadgetry and services to the\nInternet, the logical endpoint of our infrastructure will be extended\naccordingly. Threat actors are increasingly exploiting application programming\ninterfaces, especially the legacy ones, which were designed without\nconnectivity to the cloud in mind. For established financial institutions, such\nattacks will continue to mount. <\/p>\n\n\n\n

Given\nour scale and size, we have a diverse team which we are very proud of. It\u2019s\ncrucial to create a culture, across all regions and countries, where we are\nable to position the issue of cybersecurity in a way that it doesn\u2019t mistakenly\nget considered as just a \u2018technology issue\u2019 when it fundamentally involves the\nbusiness and people. To ensure that our employees and clients stay abreast of\ndevelopments in cybersecurity and take the necessary measures to defend\nthemselves, we will continue to achieve this via sustained, targeted security\nawareness initiatives. Continuous learning is constantly being matured to make\nit more engaging and impactful via gamified techniques that incentivise secure\nbehaviour and encourage employees to take a proactive role in maintaining our\ncustomer\u2019s trust. <\/p>\n\n\n\n

How\nimportant is the protection of consumer data and what safeguarding practices do\nyou have in place to ensure this?<\/strong><\/p>\n\n\n\n

The\nprotection of consumer data is a top priority for us. We use technology to\nprovide a borderless, reliable and efficient service, and are committed to\nprotecting our customers\u2019 and the bank\u2019s data and assets from cybersecurity and\nresiliency threats. We regularly update our policies, standards, guidelines and\ntools to protect our information assets. These ensure that cybersecurity risks\nare identified and managed in a consistent way across the group. Our framework\nalso incorporates comprehensive control requirements set out by key regulators\nin the regions we operate.<\/p>\n\n\n\n

We\nalso continually upgrade our security capabilities to respond to the evolving\nthreat landscape by partnering with leading cybersecurity providers and\nexpanding our security technology, recognising that everyone plays a role in\ncybersecurity defence. <\/p>\n\n\n\n

What\nbest practice advice would you give to someone looking to become a cyber\nprofessional in a role similar to yours?<\/strong><\/p>\n\n\n\n

To succeed today, one must be in a constant state of\nadaptation, continually unlearning some old rules (but do learn from the\npast) and relearning new ones. That requires continually questioning\nassumptions about how things work and challenging old paradigms. It is the\npeople who have proactively worked to expand and diversify their skillsets who\nwould be the most well placed. The choice is simple: act\nor be acted upon.<\/p>\n\n\n\n

Collaboration\nand sharing is just as important as any technical role. Build your connections,\ninspire a knowledge-sharing culture and it will come full circle. Be receptive\nto change and adopt the new way of working, reduce risk by shortening the\ndelivery cycles. Most importantly, do not shy away from mistakes as the\nchallenges we have to solve often take several attempts because they are some\nof the toughest in any industry.<\/p>\n\n\n\n

What\nis the most important lesson you\u2019ve learnt as a CISO?<\/strong><\/p>\n\n\n\n

Collaboration\nby all means. Firstly internally, to collaborate with the business to\nunderstand their needs, priorities and strategy and align our strategy to be an\nenabler of their vision.<\/p>\n\n\n\n

Secondly,\ncollaborate externally, including sharing data. Collaborate with the\nregulators, peers, governmental agencies and anyone that can help in protecting\nthe ecosystem. <\/p>\n\n\n\n

Overall,\nthe CISO needs to hold executives\u2019 attention and build trust among the board of\ndirectors and the leadership team.  <\/p>\n","protected":false},"excerpt":{"rendered":"

As one of the largest financial institutions in the world, Standard Chartered Bank is under no illusion that it can\u2019t function without complete protection of its IT infrastructure. Yuval Illuz, Group CISO, COO, Trust, Data and Automation, Operations, Standard Chartered Bank, discusses what it means to operate with a secure approach, how Europe is best […]<\/p>\n","protected":false},"author":21,"featured_media":76552,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[42,205,57,1489,93],"tags":[],"class_list":["post-37224","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-banking-finance","category-case-studies","category-enterprise-security","category-insights","category-top-stories"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/37224","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/users\/21"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/comments?post=37224"}],"version-history":[{"count":9,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/37224\/revisions"}],"predecessor-version":[{"id":76553,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/37224\/revisions\/76553"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media\/76552"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media?parent=37224"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/categories?post=37224"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/tags?post=37224"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}