A war is being fought in cyberspace with “ones and zeros” instead of bullets and too-big-to-fail banks are major targets, experts with cyber security and intelligence backgrounds have told Business Insider.
“It’s not a hypothesis. It’s unequivocally been proven, the next war will be fought in the cyberspace. And I actually would go as far as saying it’s already being fought,” said Justin Fier, director for cyber intelligence and analysis at Darktrace, formerly US government intelligence.
US and European authorities are concerned about a possible “armageddon” event caused by a successful cyber attack on western banks and other critical areas of infrastructure by hostile nation-states and other actors.
A successfully coordinated attack on a too-big-to-fail bank could have “cataclysmic” consequences for the global financial system and deal significant damage to the national security of the west, experts said.
“Let’s say you hit one of those banks that’s too big to fail, you’ve got global economic ramifications when that happens and I kind of worry then what the follow on from that would be. So now we’re talking national security, if not global security ramifications,” said Tim Rees, cyber strategy lead at Willis Towers Watson UK, and formerly British military intelligence.
Major threats originate from groups like hackers, hacktivists, organised criminals, terrorists and nation states like Russia and China, but attribution is notoriously difficult in the cyber world.
Dr Victor Madeira, a senior fellow at the Institute for Statecraft, and former strategic advisor on national security reform said that Russia and China have been aggressively developing and using their cyber capabilities against the west.
“The true battleground is usually the boardroom, it’s not the battlefield,” said Madeira.
“Russia and China would look to undermine or even outright paralyse the international financial system if push came to shove. That’s really what’s underpinning a lot of this, it’s economic and financial competition, and two very different and competing worldviews, as to what those systems should be,” he added.
There has also been concern in the west surrounding the use of Russian and Chinese electric equipment such as phones and routers which could potentially compromise national security.
Chinese company ZTE was accused in a US court of being used solely to spy on other countries, and Britain’s GCHQ is currently analysing the dangers of allowing Huawei’s products to be used across the UK’s digital infrastructure.
Looking at a strategic geopolitical level a successful attack on the financial sector would have “second and third order effect ramifications that are just not known, at this time,” said Rees, adding, “The financial institutions are extremely well developed, in terms of technical resilience for exactly that reason.”
“But this is exactly why here in London as I know the government works closely with financial institutions to ensure that they are as robust as possible. It is clearly an essential part of our national security in terms of protecting our economy.”
As technology develops more critical systems become electronic and interconnected, making cyber attacks increasingly potent in their potential, experts told Business Insider
The scale of the conflict is hinted at by the ballooning value of the cyber insurance industry which helps companies manage risk and resilience against major attacks. According to Statista the value of cyber insurance worldwide has increased by around $2.8 billion since 2014 and is projected to inflate by another 2 billion by 2020.
The consequences of weak cyber defences in critical infrastructure like water, wastewater, energy transport and financial services are severe if there’s a breach.
“If you’re not securing your life support sectors from a cyber attack, cyber security becomes real in a very different way. It’s no longer about stolen data and passwords or health information. It’s about not being able to feed your family or go to work or turn the lights on, and we want avoid that kind of armageddon scenario,” said Tom Finan, WTW cyber strategy lead in the US, and a former senior cyber strategist at the Department of Homeland Security.
Banks are particularly vulnerable to attack because of the speed that trades are made, the amount of cash and data they hold, and the extreme sensitivity of financial markets.
As corporate spending on cyber defence has increased the dominant threat now comes from “insiders”who are employees or other trusted parties that either negligently or purposefully use privileged access to breach an organization’s cyber defences.
Security of the banks is treated as national security issue because ” economic security is national security,” said Finan. That’s why the US Department of Homeland Security is responsible for protecting 16 pillars of critical infrastructure which includes water, energy, transport and finance.
In Europe, the Network and Information Security Directive (NISD), a sibling act to GDPR was made enforceable law on May 9. It is designed to prevent the “armageddon” scenario by boosting cyber defences of the banks and other critical infrastructure through legislation. Similar measures have also been passed in the US.
“Without doubt it as an absolute current concern,” said Tim Rees. The fact that the EU has managed to pass a regulation on this is probably a good litmus test as to how seriously they’re are taking this as an issue.”
Leave a Reply
Leave a Reply
This site uses Akismet to reduce spam. Learn how your comment data is processed.
