A month before September 11, 2001, President Bush was given his Presidential Daily Briefing (PDB), with an item entitled, “Bin Laden Determined to Strike the U.S.” The PDB didn’t contain any specific evidence of an impending attack; just that federal agencies had bits and pieces of information indicating a desire to attack the U.S. The problem, as the 911 Commission pointed out, was that the intelligence agencies failed to share with one another what they felt was insignificant intelligence.
Lack of an effective independent cyber threat information sharing puts the nation’s economic stability in grave danger.
Today, American banks and financial institutions are fighting a quite war. This war is raging on the cyber front, with attacks from foreign governments (Russia, China, North Korea and Iran); criminal syndicates; terror organizations, and so-called “lone-wolf” actors. All continually attempt to access banks’ computer networks. Fighting this war is not cheap. A 2015 MarketsandMarkets report estimated private spending on cyber-security to rise to $170 billion in 2020.
The computer networks that allow the global financial markets to communicate with one another make them vulnerable to cyber bank robbers. The only proven way to prevent these attacks it is to go back to the days when a bank’s records were maintained on stand-alone computer systems. But as the Stuxnet malware demonstrated, even “off-line” systems can be hacked.
One way to mitigate some of the risks to the country’s financial networks is deep and sustained information sharing among individual banks, as well as between the public and private sectors. Given the interconnectedness of the nation’s financial system, it makes no sense for each bank to try to “go it alone” when it comes to cyber-security.
The private sector has attempted to do this through the Financial Services Information Sharing Analysis Center (FSISAC), which describes itself as “the only industry forum for collaboration on critical security threats facing the global financial services sector.” The bigger the bank, the greater its cyber threat. Last week eight of the largest U.S. banks, have agreed to share more information on cyber-threats to their systems, under the aegis of FSISAC.
While FSISAC is a good starting point for information sharing, there are obstacles that prevent maximizing its usefulness. Private companies’ and banks’ board members and shareholders are reluctant to share all relevant information—however useful—for fear it may be used by a competitor for business advantage and lead to financial loss. And banks also face legal restrictions regarding disclosure of certain personal/proprietary information.