How Network Vulnerabilities Can Impact Operational Resilience

Operational resilience remains the top priority for those in financial services. From the U.S. Federal Reserve’s study into “Sound Practices to Strengthen Operational Resilience” and “Principles of Operational Resilience” from the Basel Committee to the Bank of England’s upcoming rule changes for financial organizations in the UK, the intent is to create financial services institutions that are geared towards managing digital disruption. The goal is that financial service businesses can continue providing mission-critical services in the event of disruptions such as IT glitches, outages, and cyber-attacks.

With the network at the heart of the IT infrastructure, identifying and eliminating vulnerabilities that can cause disruptions, downtime, increased operational costs, reputational damage, and fines for non-compliance is critical.

Identifying Network Vulnerabilities

Vulnerabilities can be found across hardware and software, as well as staff members – according to the ICO, “human error is the leading cause of reported data breaches.”

Common causes of network vulnerability include:

• Misconfigurations: Device misconfigurations can lead to outages and downtime, as well as present a security risk. Often, it’s down to human error. A typo that prevents traffic from accessing servers. Accidentally removing security policies that certain apps rely on. Miscommunication between teams leads to the wrong configurations for the wrong devices. And rectifying those mistakes can cause greater headaches if, for example, your solution leaves ports open and vulnerable to attack. The top area of concern is firewalls. Acting as your line of defense, any misconfiguration (or legacy configuration) leaves the network seriously exposed to risk.
• Outdated software and systems: Outdated software and systems don’t always have the latest security updates, and even when patches drop, they don’t always work on older versions, meaning the dev team’s time is spent on constant custom fixes. Typically, this vulnerability is an investment issue – hardware upgrades are costly – or a result of a comfortable, if inefficient routine; “We’ve always done it this way…”.
• Ineffective network disaster recovery processes: Even with all of your security defenses in place, your organization must be prepared if the worst happens. This is especially important for financial firms, where losing data or experiencing outages that drive operations to a halt breaches almost every global compliance standard there is while inflicting untold damage on the customer experience and your trusted reputation. Rapid action is needed to get the system back online. And yet, because disaster recovery takes time to plan, configure, test, and maintain, some organizations still don’t have effective processes to rapidly regain the use of critical infrastructure.

Building Network Resilience

Auditing Your Current Network

Before you can start taking strategic precautions, you need to know the health of your current setup. Regular vulnerability assessments should be a full audit across the system to meet operational resilience and compliance standards.

Every device, every network, every access point needs to be placed under the spotlight.  At the end of the assessment, you should be able to quickly identify existing vulnerabilities, compile accurate reports for key stakeholders and determine the next steps. It takes time and skill – with the size of networks increasing all the time, finding, and tracking risks is an inefficient resource drain that’s completely open to error.

Securing Your Data

Core to any audit for FS institutions is assessing data use against compliance standards. On data, most of these standards focus on:

• Collection
• Encryption
• Storage and backup
• Accuracy and integrity

For example, PCI DSS compliance dictates that ‘all companies that process, store, or transmit credit card information maintain a secure environment’ where access to sensitive data is restricted and audit trails are kept.

Financial institutions, perhaps more than any other sector, demand data integrity. Not only as a legal requirement under FISMA, NIST, and GDPR, but from an operational standpoint. To thrive, firms need accurate data to make accurate decisions.

At the most basic level, inaccurate data might be an incorrect account number or the wrong balance. Even that can cause an impact on business operations – replicated across too many accounts and it’s game over.

Gaining Greater Visibility

With greater oversight comes greater power. By increasing visibility across the network, once your initial assessment is complete, you can continue monitoring and maintaining the network. Pre-empting security risks and fixing flaws before they become unfixable.

Centralizing network configuration is integral to limiting exposure to risk and stopping cyber-attackers in their tracks, with accessible reports for all key stakeholders. Like any report, it’s about making accurate data meaningful, to make informative decisions.

Many companies exhibit change management deficiencies. In other words, they don’t have a system in place that can track changes, such as an authorized device connecting to the network, causing ongoing issues where threats are not eliminated in a timely manner. The damage is done.

Preparing for Future Vulnerabilities

Maintaining operational resilience in the face of network vulnerabilities is a challenge for FS firms often swamped by highly particular finance laws and compliance standards. Without implementing the right technology and tools, it can be a costly undertaking, requiring a lot of time and staff that few can spare just to keep things ticking over – and before a cyber-attack or data breach even occurs.

The SolarWinds breach, still fresh in the minds of business leaders, offers a timely opportunity to review your current security operations. If the worst happens, are you ready? How long until you recover? And how do you prevent similar attacks from happening?

Restorepoint helps financial organizations improve their operational resilience and achieve compliance with the new regulations by strengthening network resilience. Customers such as Deloitte, Societe Generale, Fidelity International, Unicredit, and Luxembourg Stock Exchange use Restorepoint to dramatically shorten audit cycles, reduce network downtime and meet internal compliance standards by automating critical network processes.

Book a live demo and see how you could use Restorepoint to drive network efficiency, eliminate time-consuming manual processes and achieve operational resilience.