Over the past couple of decades, the nature of the threats facing security professionals have changed. The stakes are higher and there is a greater potential for criminal gain or malicious disruption. Like any enterprise, the more money you make, the more you can invest in making money. Which is why today, cyber criminals have become so incredibly well resourced, sophisticated, and organised.

But there is one type of target that’s uniquely attractive to attackers, because of the huge potential financial gains by successfully compromising their defences. Financial institutions such as banks hold a massive amount of consumer data that can be sold on the black market for a healthy return. 

Alongside the value of consumer data that can be compromised, banks are also exposed to risks through weak points in their IT infrastructure. To get an idea of the impact from exposed weak spots, the Lazarus FASTCash operation saw cash withdrawn simultaneously from ATMs in over 30 different countries in 2017 and from ATMs in 23 separate countries in 2018. To date, this specific activity is estimated to be responsible for the theft of tens of millions of dollars—and that’s just the work of one attack group.

There’s a big difference, of course, between being a target and being vulnerable; and banks remain vulnerable to cyber threats—despite the advances in security technologies and compliance. So why is this?

Legacy challenges

Banks were early adopters of IT systems from the late 60s as technology modernised book-keeping practices and automated other manual processes. 

As computer technology became more ubiquitous and indispensable, the result was new systems were being repeatedly layered upon incumbent and legacy systems.  This resulted in complex interdependencies, and the necessity for legacy systems to be maintained. Maintaining these interdependencies can fall short of the bank’s priorities over time.

Older systems eventually reach their end-of-life without being suitably replaced, leaving the organisation vulnerable to new zero-day threats and emerging malware. As a result, these decaying and unprotected systems are attractive areas for criminal organisations to target.

Complex relationships

All mergers and acquisitions introduce a degree of uncertainty to the enterprise. For context, there were 697 merger and acquisition deals in global banking in 2017.

The acquiring organisation must understand the risk presented by the acquired business. This includes everything from how endpoint and network access is controlled, and how the cloud extends on that network infrastructure. This is complex enough, without the recent introduction of regulatory compliance with legislation such as GDPR and the NIS Directive, while balancing the playing field of different security postures and risk appetites.

IT teams face the additional strain of integrating and standardising security controls across both organisations. In this way, each M&A becomes a kind of digital transformation project, except with potentially twice as much complexity and disruption. At this scale, some of those vulnerabilities can be missed or deprioritised for more business-critical matters—leaving banks blind to entirely new threat vectors after the M&A.

The data mystery

Accounting for an organisation’s data estate can be tough—where it lies, the type, and where in the organisation it touches. These undefined data flows are even more complex and problematic for large banks that have overlapping legacy systems and a sprawling organisation extended through M&A deals.

For example—one project to upgrade user web browsing for a large multinational bank involved a brief planned outage. It emerged that this outage affected one of the business processes for approving loans—which used the browser system to function.

It’s because of unexpected connections like this that clear visibility and an accurate understanding of organisational processes and the IT estate are fundamental principles for building a robust security strategy. When system integrations and data flows are not fully understood then it’s much harder to protect all your data, which leads an increased risk of a bank being compromised.

Time for a platform led approach

When you consider the breadth of these issues, and the legacy headaches that lead to banks juggling more and more point solutions from different vendors—as they seek to bolt on new protections for new kinds of threats—the scale and complexity of the challenge is laid bare.

Banks must manage their cyber-defences holistically—with fewer vendors and centralised tools that match the bank’s security ecosystem. In short, banks need to an integrated platform-led approach.

The ideal platform should offer tools with reporting and shared telemetry across each layer of defence. Due to the fast-moving nature of the threat landscape and the practicalities of managing complex systems across large financial services organisations, the platform should also be extremely adaptable—it must be able to rapidly deploy new modules, plug in legacy systems, and integrate continuously evolving intelligence and threat detection.

Cybersecurity professionals in this sector face a challenge distinct from any other. Throughout history, banks have served as institutions of trust and responsibility – and in today’s digital economy, that responsibility takes on entirely new forms

The post Why are banks the most vulnerable to cyber threats? appeared first on International Finance.

The merged unit will have €3.34 trillion assets under custody and €1.83 billion assets under administration, with Agricole taking lion’s share of its holdings. The bank will own 69.5 percent of the unit and Santander 30.5 percent, retaining the brand name of Agricole’s existing asset management arm CACEIS. Also, Santander’s S3, securities services arm in Spain and Latin America will combine with CACEIS.

Santander Chairman Ana Botin, said: “S3 and CACEIS are highly complementary businesses, and by working together we can create a custody and asset servicing platform that leverages our collective scale and global presence, and offers clients a comprehensive service that can support their ambitions and help them to prosper.”

Swiss investment bank Credit Suisse advised Santander on the deal, and Morgan Stanley for Agricole, Reuters reports.

Joint ventures created by collaborating in business operations is an easier option for European banks to benefit through M&A. Clairinvest fund manager Ion-Marc Valahu, said: “S3 and CACEIS are highly complementary businesses, and by working together we can create a custody and asset servicing platform that leverages our collective scale and global presence, and offers clients a comprehensive service that can support their ambitions and help them to prosper.”

The post Crédit Agricole, Santander take innovative route to M&A for cost savings appeared first on International Finance.

Intertrust is a global leader in providing expert administrative services to clients operating and investing in the international business environment.

It surveyed over 500 executives to identify how firms are responding to increasing regulation and their use of technology.  Four-in-ten (38%) said they had invested in new technology solutions, with the same proportion increasing their use of external advisors and consultants.  Only 17% of firms said they had taken the step of simplifying their business operations to reduce the regulatory burden, preferring to dedicate extra resources to ensure compliance.

With corporates adopting a range of measures to respond to regulatory obligations, respondents believed that technology will play a pivotal role in maintaining compliance with new regulations, with 87% of firms predicting that demand for RegTech solutions will increase in the next two years.

Here, the leading driver was acquiring off-the-shelf products, cited by 63% of corporates, followed by hiring technology experts (50%), investing in research and development into proprietary technology solutions (33%), and undergoing M&A / JV activity to acquire new solutions (20%).

Jan Willem van Drimmelen, global head of corporate services at Intertrust Group, said, “Disruptive technology is playing an increasingly significant role in the development of corporates across all sectors for both compliance and day-to-day business operations. This presents a number of challenges for corporates that must decide how best to adapt to a changing environment and acquire the necessary technology and skills through M&A, off-the-shelf products, research and development or external support.”

The post Corporates to tackle regulatory burden using technology: Intertrust survey appeared first on International Finance.

• Global EMU activity in Q1 2018 saw $170.3bn worth of deals over 311 transactions. Deal value is down 4.6% compared to the same period last year, but in line with the global trend of less activity – with the US enacting steel and aluminium tariffs and in the early stages of a trade war with China, geopolitical uncertainty has left many dealmakers cautious across the board.
• The sector’s top transaction was Germany-based E.ONs $46bn acquisition of innogy and its customer retail and network businesses. Such moves have been examples of Germany’s Energiewende – the country’s policies attempting to move past carbon-based energy consumption patterns.
• On the horizon is UK-based SSE’s proposed acquisition of nPower, a local subsidiary of innogy, currently in review by the Competition and Markets Authority.
• Though oil and gas continues to drive some activity through consolidation in the near term, on the horizon, renewable energy might be the way consumers choose to power their lives. In March, Japan’s SoftBank Group and the Saudi Arabian government pledged to invest in a 200GW solar farm project in Saudi Arabia worth approximately $200bn.
• Demand for gold as the usual safe haven during periods of geopolitical instability is likely to go up, particularly in Europe, the Middle East, and Africa. The European renewable space is seeing an uptick in activity as the market matures and moves past government subsidies dependence with technology and market economies helping renewable energy assets find buyers’ interest.

“Energy, Mining & Utilities, like many sectors over the past year, has undergone a bit of a structural shift. Long dominated by oil and gas transactions, EMU now appears to be edging closer toward the power and utilities space. Though countries such as the US have, of late, tended to favour policies that benefit the oil, natural gas, and coal industries, the rest of the world has begun to invest more heavily in renewable sources of energy, such as solar, wind, and geothermal, led, incidentally, by Europe’s oil majors,” said Elizabeth Lim, Senior Analyst & Research Editor–Americas at Mergermarket.

The post Energy, mining and utilities sector leans green as M&A activity dips appeared first on International Finance.