{"id":4582,"date":"2023-06-23T15:20:54","date_gmt":"2023-06-23T19:20:54","guid":{"rendered":"https:\/\/solutionsreview.com\/security-information-event-management\/?p=4582"},"modified":"2023-06-23T15:22:51","modified_gmt":"2023-06-23T19:22:51","slug":"overlooked-data-security-issues-facing-the-financial-services-sector","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/security-information-event-management\/overlooked-data-security-issues-facing-the-financial-services-sector\/","title":{"rendered":"Overlooked Data Security Issues Facing the Financial Services Sector"},"content":{"rendered":"

\"data<\/a><\/p>\n

Solutions Review\u2019s Expert Insights Series is a collection of contributed articles written by industry experts in enterprise software categories. John Meakin of Continuity<\/a> examines overlooked data security issues in the financial services sector, and best practices to face them.<\/b><\/em><\/p>\n

\"Expert<\/a>Data is a major part of the role of any CISO. When it comes to the financial services industry, data is even more important and valuable than in other industries. Securing storage and backup systems isn’t always obvious and isn’t always the focus of many CISOs or their teams. I admit that it wasn’t part of my focus until quite recently.<\/p>\n

So, what is the big picture of securing storage and backup? Is this a Cinderella area in the pursuit of business security? How can you prepare? And where do you go from here?<\/p>\n

Looking for a detailed guide to protecting and storing your data? Read Continuity’s Security Guidelines for Storage Infrastructure<\/em><\/strong> here for FREE<\/em><\/a>!<\/p>\n

<\/div><\/p>\n

Data Security Issues in the Financial Services Sector<\/strong><\/h2>\n
\n

All Eyes On Storage And Backup<\/strong><\/h3>\n

It\u2019s no secret that modern security is focused on data, particularly in the financial services industry. The rise and sophistication of ransomware attacks has been documented by all parties concerned.<\/p>\n

From industry publications like Bleeping Computer\u2026<\/p>\n

\u201cThe ALPHV ransomware operation exploits veritas backup exec bugs for initial access. U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds these 3 security issues to its list.\u201d<\/em><\/p>\n

\u2026to analysts like Gartner\u2026<\/p>\n

\u201cHarden the components of enterprise backup and recovery infrastructure against attacks by routinely examining backup application, storage and network access and comparing this against expected or baseline activity.\u201d<\/em><\/p>\n

\u2026to governments finally addressing the issue, like in last year\u2019s White House memo:<\/p>\n

\u201cTest the security of your systems and your ability to defend against a sophisticated attack.\u201d<\/em><\/p>\n

Ransomware is focused on data. As such, the key to mitigating (and ideally neutralizing) that threat is to secure data in storage and backup. We tend to think of backups as the final layer of protection against ransomware, though in reality they are simply another repository of data in storage, ready to be harvested if not appropriately secured.<\/p>\n

This begs the question: are we as CISOs and security leaders currently focused on the most pressing risks?<\/p>\n

The Unspoken Gap<\/strong><\/h3>\n

The value of business data is growing annually in virtually every organization. Malicious actors recognize this fact, so data-centered attacks continue to grow both in number and sophistication. Are we really rising to this challenge as CISOs and security leaders? Have we spent enough time analyzing and reinforcing those darker parts of our storage and backup infrastructure that any smart threat would target? This industry-wide oversight is exactly why so many of these attacks succeed.<\/p>\n

There are other myths that many CISOs and security leaders believe which feed the current exponential growth of attacks and further demonstrate the industry\u2019s continued failure to harden storage and backup systems. They are the greatest current oversight in cybersecurity.<\/p>\n

The Shift In Voice And Focus Of The Financial Services CISO<\/strong><\/h3>\n

The truth? In a cloud-fueled world, storage layers deserve as much attention as computing and networking layers. Cloud providers offer cloud storage as a separate service, carrying a separate set of risks– access keys in AWS S3 storage, for example.<\/p>\n

Storage security issues aren\u2019t limited to the cloud either; they spread across the full spectrum of hybrid and on-premise infrastructures. All these modes of storage constitute separate systems, but for whatever reason they haven\u2019t enjoyed the same attention from infrastructure and security experts as those on other layers.<\/p>\n

The need for change is also reflected in a recent Financial Services Research Report, which analyzed the state of storage & backup security:<\/p>\n

    \n
  • Two-thirds believe that a storage attack will have \u2018significant\u2019 or \u2018catastrophic\u2019 impacts.<\/li>\n
  • 60 percent are not confident in their ability to recover from a ransomware attack.<\/li>\n
  • Two-thirds say securing backups and storage was addressed in recent external audits.<\/li>\n<\/ul>\n

    Heading For A Better Future\u2026 But How? 4 Steps For Success<\/strong><\/h3>\n

    Now that we understand the problem, what\u2019s the solution?<\/p>\n

    Many CISOs already follow the steps below when faced with a new threat. While I\u2019m not here to deliver a tutorial on how to teach a fisherman how to fish, it\u2019s nonetheless critical to revisit the fundamentals to ensure we\u2019re covering the increasing storage & backup security problem in the correct and thorough way it deserves. At this point we\u2019re playing a game of catch-up, and can ill-afford missteps.<\/p>\n

    Use the following four steps to form the foundation of your storage and backup security approach:<\/p>\n

      \n
    1. Education.<\/strong> The first step is to understand the capabilities of your storage and backup devices. In your real environment, what do you have (not just in theory): which vendors do you use, how are their technologies deployed, and how are roles and responsibilities defined? An excellent place to begin in this phase is to perform an initial assessment of your storage and backup security. This assessment will detail any risks identified and include the corrective steps for remediation.<\/li>\n
    2. Definition.<\/strong> Once you get the lay of the land, you should define \u2018secure enough\u2019 baselines of your storage and backup environments. It needs to be detailed since these environments are complex and the attack surface is convoluted. For instance: what kind of roles are needed? What kind of controls do we want to have? What level of auditing do we expect? Once you define these baselines, it\u2019s much easier for the storage admins to ensure they\u2019re fully implemented, audited and monitored. We also need to define threats and robust security protocols.<\/li>\n
    3. Implementation.<\/strong> With knowledge accrued and threats defined, the rubber needs to meet the road. Now comes the stage of implementing the controls that were previously defined. Please note: usually when the initial gap analysis is done (remember Step 1), you end up with a long list of deviations. Now\u2019s the time to iron them out. Implementing automation in performing these changes is key to wrap it close to the attack surface. Another practice I recommend here is to build KPIs and automatic measurements for the predefined baselines, in order to make sure they are always met. So, in essence, at this stage security leaders must:\n
        \n
      1. Harden storage<\/li>\n
      2. Implement controls<\/li>\n<\/ol>\n<\/li>\n
      3. Ongoing risk management.<\/strong> Storage and backup security demands active, ongoing risk management. As threats continue to evolve, so must we. In order to keep up, lean on:\n
          \n
        1. Measurement<\/li>\n
        2. Reporting<\/li>\n
        3. Automation<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n

          While the above steps might seem obvious, until now their implementation within the area of storage and backup has been less so. CISOs need to be in dialogue with the IT infrastructure teams to ensure that this set of risks is being taken as seriously as it needs to be.<\/p>\n

          Final Thoughts on Data Security<\/strong><\/h3>\n

          Data is the bread and butter of the 21st century. And just as these valuable resources have always been securely stored and protected, so must an organization make significant investments in data protection, and storage and backup hardening. CISOs have the skill to do it; many simply lack the know-how. The problem needs to be reframed in the minds of security experts, and fast, as the problem of ransomware is already beginning to become a runaway train.<\/p>\n


          Widget not in any sidebars
          <\/p>\n","protected":false},"excerpt":{"rendered":"

          Solutions Review\u2019s Expert Insights Series is a collection of contributed articles written by industry experts in enterprise software categories. John Meakin of Continuity examines overlooked data security issues in the financial services sector, and best practices to face them. Data is a major part of the role of any CISO. When it comes to the […]<\/p>\n","protected":false},"author":731,"featured_media":4583,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[551,1],"tags":[],"acf":[],"yoast_head":"\nOverlooked Data Security Issues Facing the Financial Services Sector<\/title>\n<meta name=\"description\" content=\"John Meakin of Continuity examines overlooked data security issues in the financial services sector, and best practices to face them.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/security-information-event-management\/overlooked-data-security-issues-facing-the-financial-services-sector\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Overlooked Data Security Issues Facing the Financial Services Sector\" \/>\n<meta property=\"og:description\" content=\"John Meakin of Continuity examines overlooked data security issues in the financial services sector, and best practices to face them.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/overlooked-data-security-issues-facing-the-financial-services-sector\/\" \/>\n<meta property=\"og:site_name\" content=\"Best Information Security SIEM Tools, Software, Solutions & Vendors\" \/>\n<meta property=\"article:published_time\" content=\"2023-06-23T19:20:54+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-06-23T19:22:51+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/06\/Overlooked-Security-Issues-Facing-the-Financial-Services-Sector.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"400\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"John Meakin\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"John Meakin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/overlooked-data-security-issues-facing-the-financial-services-sector\/\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/overlooked-data-security-issues-facing-the-financial-services-sector\/\",\"name\":\"Overlooked Data Security Issues Facing the Financial Services Sector\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/overlooked-data-security-issues-facing-the-financial-services-sector\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/overlooked-data-security-issues-facing-the-financial-services-sector\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/06\/Overlooked-Security-Issues-Facing-the-Financial-Services-Sector.jpg\",\"datePublished\":\"2023-06-23T19:20:54+00:00\",\"dateModified\":\"2023-06-23T19:22:51+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/00cd4f7300a9e86715d1cfc85def8a8b\"},\"description\":\"John Meakin of Continuity examines overlooked data security issues in the financial services sector, and best practices to face them.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/overlooked-data-security-issues-facing-the-financial-services-sector\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/security-information-event-management\/overlooked-data-security-issues-facing-the-financial-services-sector\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/overlooked-data-security-issues-facing-the-financial-services-sector\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/06\/Overlooked-Security-Issues-Facing-the-Financial-Services-Sector.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/06\/Overlooked-Security-Issues-Facing-the-Financial-Services-Sector.jpg\",\"width\":800,\"height\":400,\"caption\":\"data security\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/overlooked-data-security-issues-facing-the-financial-services-sector\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Overlooked Data Security Issues Facing the Financial Services Sector\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\",\"name\":\"Best Information Security SIEM Tools, Software, Solutions & Vendors\",\"description\":\"Buyer's Guide and Best Practices\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/00cd4f7300a9e86715d1cfc85def8a8b\",\"name\":\"John Meakin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/84bbb69fb8dfbc7b5233efbe28876254?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/84bbb69fb8dfbc7b5233efbe28876254?s=96&d=mm&r=g\",\"caption\":\"John Meakin\"},\"description\":\"John Meakin is a seasoned and experienced CISO with more than 30 years of experience in various financial services companies, such as RBC, Standard Chartered, and Deutsche Bank. He is also a member of Continuity\u2019s advisory board.\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/author\/jmeakin\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Overlooked Data Security Issues Facing the Financial Services Sector","description":"John Meakin of Continuity examines overlooked data security issues in the financial services sector, and best practices to face them.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/security-information-event-management\/overlooked-data-security-issues-facing-the-financial-services-sector\/","og_locale":"en_US","og_type":"article","og_title":"Overlooked Data Security Issues Facing the Financial Services Sector","og_description":"John Meakin of Continuity examines overlooked data security issues in the financial services sector, and best practices to face them.","og_url":"https:\/\/solutionsreview.com\/security-information-event-management\/overlooked-data-security-issues-facing-the-financial-services-sector\/","og_site_name":"Best Information Security SIEM Tools, Software, Solutions & Vendors","article_published_time":"2023-06-23T19:20:54+00:00","article_modified_time":"2023-06-23T19:22:51+00:00","og_image":[{"width":800,"height":400,"url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/06\/Overlooked-Security-Issues-Facing-the-Financial-Services-Sector.jpg","type":"image\/jpeg"}],"author":"John Meakin","twitter_misc":{"Written by":"John Meakin","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/overlooked-data-security-issues-facing-the-financial-services-sector\/","url":"https:\/\/solutionsreview.com\/security-information-event-management\/overlooked-data-security-issues-facing-the-financial-services-sector\/","name":"Overlooked Data Security Issues Facing the Financial Services Sector","isPartOf":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/overlooked-data-security-issues-facing-the-financial-services-sector\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/overlooked-data-security-issues-facing-the-financial-services-sector\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/06\/Overlooked-Security-Issues-Facing-the-Financial-Services-Sector.jpg","datePublished":"2023-06-23T19:20:54+00:00","dateModified":"2023-06-23T19:22:51+00:00","author":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/00cd4f7300a9e86715d1cfc85def8a8b"},"description":"John Meakin of Continuity examines overlooked data security issues in the financial services sector, and best practices to face them.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/overlooked-data-security-issues-facing-the-financial-services-sector\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/security-information-event-management\/overlooked-data-security-issues-facing-the-financial-services-sector\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/overlooked-data-security-issues-facing-the-financial-services-sector\/#primaryimage","url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/06\/Overlooked-Security-Issues-Facing-the-Financial-Services-Sector.jpg","contentUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2023\/06\/Overlooked-Security-Issues-Facing-the-Financial-Services-Sector.jpg","width":800,"height":400,"caption":"data security"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/overlooked-data-security-issues-facing-the-financial-services-sector\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/security-information-event-management\/"},{"@type":"ListItem","position":2,"name":"Overlooked Data Security Issues Facing the Financial Services Sector"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website","url":"https:\/\/solutionsreview.com\/security-information-event-management\/","name":"Best Information Security SIEM Tools, Software, Solutions & Vendors","description":"Buyer's Guide and Best Practices","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/00cd4f7300a9e86715d1cfc85def8a8b","name":"John Meakin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/84bbb69fb8dfbc7b5233efbe28876254?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/84bbb69fb8dfbc7b5233efbe28876254?s=96&d=mm&r=g","caption":"John Meakin"},"description":"John Meakin is a seasoned and experienced CISO with more than 30 years of experience in various financial services companies, such as RBC, Standard Chartered, and Deutsche Bank. He is also a member of Continuity\u2019s advisory board.","url":"https:\/\/solutionsreview.com\/security-information-event-management\/author\/jmeakin\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/4582"}],"collection":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/users\/731"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/comments?post=4582"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/4582\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media\/4583"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media?parent=4582"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/categories?post=4582"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/tags?post=4582"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}