Hacking attacks present a bigger risk to the operation of UK banks than problems caused by the ongoing eurozone crisis, according to a senior Bank of England director.
Andrew Haldane, the BoE's director of financial stability, told parliament's Treasury Select Committee that representatives of Britain's top banks are telling him that cyber attacks have become their biggest threat over recent months.
Banks have focused on credit, market and liquidity risk over the past five years because of upheavals caused first by the sub-prime mortgage crisis and banking bailouts of 2008. These were followed by the ongoing eurozone crisis (whose latest casualty appears to be Greece's equivalent of the BBC) and a general recession across the EU.
This focus may have distracted attention away from operational risks such as cyber security, which are coming more to the fore of late, according to Haldane.
The ATM cash-out scam, which cost two Middle Eastern banks $45 million last year, happened after hackers broke into a database of prepaid debit cards. The details of the scam sent shivers across the financial industry.
There's also concerns that high-volume DDoS attacks of the type that interrupted the operations of US banks last year might easily be deployed against banks in Britain to similar effect.
"You can see why the financial sector would be a particularly good target for someone wanting to wreak havoc through the cyber route," Haldane said, according to Reuters.
"Understanding and management of this risk was still at a somewhat early stage," he added.
David Gibson, vice president at data governance software specialist Varonis, said that cyber-criminals are after any customer data they can extract from financial services institutions, in order to monetise their frauds. He added that issues around information security extend well beyond the financial services sector.
“All businesses – and not just banks – have a role to play in eradicating their bad digital habits and taking more control of their security by implementing basic security best practices: such as ensuring that staff only have access to the data they need, that all access to all data is monitored, and abuse is investigated,” Gibson said. ®