COVID-19 Poses New Cybersecurity Challenges for Banks

The
COVID-19 pandemic has turned the banking world upside down, not the least by
requiring a significant number of employees to work remotely.

Social distancing requirements have forced many companies, banks included, to have large numbers of their employees work from home. Not only is this a stark departure from how most banks have traditionally operated, it happened very quickly; the new coronavirus swept across the country like a derecho, giving them little time to prepare.

And
while social distancing will hopefully “flatten the curve” of the pandemic’s
infection rate, to use a now common expression, it has had the unintended
consequence of increasing the industry’s cyber risk by opening banks up to new
attacks.

The “core threat,” according to Ron Buchanan, the chief information security officer at $17.6 billion Atlantic Union Bankshares Corp. in Richmond, Virginia, involves remote access platforms like virtual private networks (VPNs) and video conferencing platforms. This would include companies using VPNs for the first time, or companies that risk exposing services and sensitive or internal communications online.

“There are plenty of companies out
there that aren’t used to working remote and are in a rush to enable remote
access services and doing that without the knowledge and proper protections,”
Buchanan says. “That creates the vulnerable environment for the attackers to go
after. And that’s what they’re focused on.”

In some instances, employees who are working remotely are forced to use their home computers because they don’t have a company laptop. “[With s]ome clients of ours, not [every employee] has a company-issued laptop to take home,” says Shawn Connors, a principal in PwC’s cybersecurity and privacy practice.

In that scenario, the employee may
have to use a home computer that is operating outside of the bank’s security
framework. The bank’s challenge is to understand “what information is
potentially leaving the confines of the organization, where is it going and do
those machines that are accessing or manipulating that data, are they at the
corporate standard of what one would expect to put into appropriately managed
cyber risk?” Connors says.

Larger banks generally have had less trouble meeting the demands of a distributed workforce because they have a more robust technology infrastructure to begin with, as well as more employees working from remote locations. Many smaller banks, on the other hand, have been challenged by the sudden shift to a work-from-home policy.

“We have definitely had a number
of clients where, not only is the capacity not there, but they have a security
concern on top of it because they don’t have control of the device that’s
actually going to be accessing data in these corporate environments,” Connors
says. “Overnight, some really bad hygiene practices have been put back in
place, just because they got caught flat-footed.”

For its part, Atlantic Union has been able to handle the sudden shift to a distributed workforce in stride. “It hasn’t had too much of an impact on us because we already had a large number of laptop users with the right security protections on those laptops,” says Buchanan. “So really, it was just a slight tuning adjustment to scale up that coverage and keeping a close eye on the increased load on the VPN infrastructure.”

Buchanan has sent out
communications reminding employees who are working from home that they are
required to use the bank’s VPN and must abide by restrictions such as a
prohibition against printing out documents at home.

There has also been a surge in video conferencing, which may not be the most secure communications platform for sensitive meetings. “The biggest risk is if you’re having a confidential conversation and someone eavesdrops on that call, and they’re eavesdropping on that confidential conversation,” Buchanan says. “If you’ve turned on the security settings, which means turning on the password and all the encryption settings, it increases the security of the call. And if you don’t recognize someone and you can’t figure out who it is, then you should assume the call has been compromised and either kick that connection off or change calls.”

The Financial Services Information Sharing and Analysis Center, an industry consortium focused on cybersecurity, offers home security resources for institutions that are managing a distributed workforce.