Financial institutions face rising cyber threats in a digital world: IMF report sounds the alarm

A groundbreaking report has revealed that cyber attacks have more than doubled since the pandemic, putting the digitally-transforming global financial sector in the spotlight. The International Monetary Fund (IMF) report titled “Cyber Risk: A Growing Concern for Macrofinancial Stability” paints a concerning picture of the increasing threats posed by cyber incidents to the financial sector.

The report highlights how the rise of digitisation, evolving technologies, and growing geopolitical tensions are creating a breeding ground for cyberattacks, potentially jeopardising global financial stability.

The report emphasises a surge in cyber incidents, particularly those with malicious intent, over the past two decades. This surge is significantly linked to the financial sector’s growing dependence on digital technologies.

According to Major Vineet Kumar, Founder of CyberPeace, a Delhi-based think tank focused on policy-making around cybersecurity, the rise of financial technology (fintech) and digital banking services has significantly increased the attack surface for cybercriminals.

While speaking to Firstpost, Kumar points to a recent Reserve Bank of India (RBI) report indicating a surge in card and internet fraud cases in the first quarter of FY24, with total damages reaching a staggering Rs. 630 crore.

These digital vulnerabilities are being exploited by cybercriminals to steal sensitive financial information, leading to substantial financial losses.

The report warns that severe incidents at major financial institutions could pose a systemic threat, causing a loss of confidence, disruption of critical services, and even spillovers to other institutions due to interconnectedness.

The report finds that while cyber incidents have not yet been systemic, the risk of extreme losses for firms – estimated to be at least $2.5 billion – has grown considerably. Moreover, indirect losses tend to be substantially larger than reported direct losses, further amplifying the financial impact.

The report also highlights that digitalisation and geopolitical tensions significantly heighten the risk of cyber incidents. Conversely, the analysis suggests that more developed cyber legislation and better cyber governance at firms can help mitigate such risks.

International threats demand international cooperation

The report underscores the importance of international cooperation in combating cyber threats in the financial sector. Financial crimes like cyberattacks often transcend national borders, making coordinated efforts crucial.

A global risk management survey focused on India by financial services firm Aon found that the threat of cyber attacks and data breach were the top risks in the global financial market as well as in India (accounting for 18.3% of the losses incurred). They also found out that this was unlikely to change in the future.

Industry experts like Advocate Siddharth Chandrashekhar, who is Standing Counsel for Income Tax at the Central Board of Direct Taxes at the Ministry of Finance, emphasise the need for information sharing, best practices, and resource collaboration to strengthen global cybersecurity defenses.

“Coordinated responses to cyber incidents involving multiple countries enhance the effectiveness of mitigation efforts and contribute to the development of international norms and regulations governing cybersecurity,” Chandrashekhar told Firstpost.

International cooperation can be particularly effective in responding to cyber incidents involving multiple countries. Collaborative efforts can enhance mitigation strategies and contribute to the development of international norms and regulations governing cybersecurity.

India, for instance, participates in various forums like the Financial Stability Board (FSB) and the Asia-Pacific Economic Cooperation (APEC) to foster such collaboration.

Countries remain largely unprepared

Despite the growing threat, the report finds that many countries, especially emerging economies, are inadequately prepared to tackle cyber risks.

The IMF survey of 51 countries revealed that many financial supervisors still lack robust cybersecurity regulations or resources for enforcement. A significant portion of these central banks and supervisory authorities lack:

• A national cyber strategy for the financial sector.

• Dedicated cybersecurity or technology risk management regulations.

• Specialised risk units within their supervision departments.

• Mandates for testing and exercising cybersecurity measures.

• Dedicated cyber incident reporting regimes.

• Cybercrime regulations.

The report avers that many financial supervisors still need cyber security regulations or resources for enforcement.

The report finds that of these central banks or supervisory authorities, 56% do not have a national cyber strategy for the financial sector, 42% do not have dedicated cyber security or technology risk management regulations, 68% lack a specialized risk unit as part of their supervision department, 64% do not mandate testing and exercising cyber security measures or provide further guidance, 54% lack a dedicated cyber incident reporting regime, and 48% do not have cybercrime regulations.

These findings paint a concerning picture of the global financial sector’s overall preparedness for cyberattacks.

India’s financial sector: A work in progress

India’s financial sector, while experiencing rapid growth, faces significant challenges in dealing with cyber threats. Kumar acknowledges this, pointing out that smaller financial entities may lack the resources and expertise to effectively combat sophisticated cyberattacks.

A December 2023 report by the RBI revealed that the Indian financial sector was confronted with more than 13 lakh cyber-attacks between January and October last year.

“It is imperative that developing nations like India must establish a more robust mechanism for cyber security than is currently in place,” Kumar told Firstpost.

The government, along with relevant agencies like the Ministry of Electronics and Information Technology (MeitY), Reserve Bank of India (RBI), National Payments Corporation of India (NPCI), and the Indian Cyber Crime Coordination Centre (I4C), have taken several measures, including:

• A meeting in November 2023 by the Department of Financial Services (DFS) under the Ministry of Finance to examine the rising threat of digital financial fraud, attended by representatives from public and private banking institutions.

• Bringing all financial institutions under the ambit of the Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS).

• Renewed focus on facilitating seamless coordination between law enforcement agencies and financial institutions for real-time tracking and blocking of defrauded money.

• Considering new legislation like the Banning of Unregulated Lending Activities (BULA) Act.

India’s policy landscape: Emerging but evolving

India’s policy framework to address cybersecurity challenges in the financial sector is gradually taking shape. Experts highlight initiatives like the Digital Personal Data Protection Act, 2023, and the RBI’s cybersecurity framework, which outlines requirements for banks and other financial institutions to establish robust cybersecurity practices.

These practices include risk assessment, incident response, and information sharing mechanisms. Additionally, the RBI has introduced initiatives such as the Cyber Security Operations Center (C-SOC) and the Cyber Crisis Management Plan (CCMP) to enhance the resilience of the financial sector against cyber threats.

While speaking to Firstpost, Chandrashekhar highlights the importance of the C-SOC as a centralised hub for monitoring and responding to cyber incidents. The CCMP provides a structured approach for managing cybersecurity crises and coordinating response efforts among stakeholders.

“India’s financial sector, is still considered to be in its nascent stage as compared to its international counterparts,” added Chandrashekhar.

However, the report also cautions that continual adaptation and enforcement of these policies are necessary to effectively mitigate cyber risks and ensure the security and stability of the country’s financial sector.

Third-party IT service providers: Strengthening the chain

The report emphasises the growing reliance of financial institutions on third-party IT service providers. These dependencies introduce additional vulnerabilities, as a cyberattack on a single service provider could potentially impact multiple financial institutions.

The report recommends that third-party IT service providers prioritise robust cybersecurity measures. This includes implementing strong encryption protocols, conducting regular security audits, and adhering to best practices for data security.

Financial institutions, in turn, should conduct thorough due diligence when selecting third-party vendors and ensure contractual obligations regarding cybersecurity are clearly defined and enforced.

Report calls for global action

The IMF report concludes with a call for global action to address the rising threat of cyberattacks on the financial sector. Here are some key recommendations highlighted in the report:

• Strengthening National Cybersecurity Frameworks: Countries need to develop robust national cybersecurity strategies specifically tailored to the financial sector. These strategies should include clear roles and responsibilities for government agencies, financial institutions, and other stakeholders.

• Enhancing Regulatory Frameworks: Regulatory frameworks for cybersecurity in the financial sector need to be strengthened and consistently enforced. This includes mandating minimum cybersecurity standards for financial institutions and service providers.

• Building a Capable Workforce: There’s a pressing need to invest in building a skilled cybersecurity workforce. This includes training and education programs to equip professionals with the necessary expertise to identify, prevent, and respond to cyber threats.

• Fostering International Cooperation: As highlighted earlier, international cooperation is crucial for effectively combating cyber threats. Countries should collaborate on information sharing, best practices, and joint investigations to disrupt cybercriminal activities.

• Promoting a Culture of Cybersecurity Awareness: A strong cybersecurity culture within financial institutions is essential. This involves raising awareness among employees about cyber threats and best practices for protecting sensitive information.

The report serves as a stark reminder of the growing cyber threats facing the financial sector in an increasingly digital world.

Anmol is a Senior Sub-Editor with Firstpost. He likes to cover stories that amuse him, generally revolving around international polity, Indian foreign policy, human interest, environment and even the politically-charged election cycles in India. He has far too many disparate interests with a constant itch for travel. Having visited fourteen states in the Indian subcontinent, he is always on the lookout for opportunities to add more to the list. He enjoys watching Football, Tennis and F1 purely as a sports enthusiast. see more