Traditional bank robbing is yet another vocation that has changed shape in an increasingly digital world. Bonnie and Clyde would certainly have to re-evaluate their tactics in the era of AI and cloud infrastructure.
Today, over 75% of consumer transactions are made through electronic payment rails such as debit and credit cards. Similarly, according to the Reserve Bank of Australia (RBA), the adoption of public cloud is increasing among firms in the financial industry.
While these advances bring productivity, ease, and efficiency, the traditional target on financial institutions has shifted to a digital bullseye. Money and personal information attract criminal groups and nation-state actors like moths to an open flame, and banks, financial services, and insurance companies hold these in abundance.
In fact, Australia’s Big Four banks are under constant attack, according to National Australia Bank’s Executive for Group Investigations, Chris Sheehan, as reported by ABC News in July 2024. Some reports suggest the Big Four are being targeted by cyberattacks “every minute of every day.”
Attackers seeking ransom or espionage use methods such as distributed denial of service attacks to overwhelm security teams, “in layered attack patterns to distract cyber teams, disguise other attack operations, or add nuisance to the mitigation,” financial services security body FS-ISAC noted in its latest threat report.
To counter these threats, regulators are tightening compliance requirements to safeguard critical information. The latest regulation, CPS 230, requires APRA-regulated entities to prepare for service disruptions.
It aims to strengthen operational risk management by addressing weaknesses in existing controls, improving business continuity through proactive planning for disruptions, and enhancing third-party risk management.
There is no doubt these new measures are being implemented with security and safety in mind. However, as with physical infrastructure, the first layer of the technology stack must be secure before adding further layers, or organisations risk leaving the front door open to attackers.
From compliance to complexity
In trying to comply with new regulations and guard against attacks, some financial institutions have adopted a “more is better” approach, adding systems and services to the technology stack without ensuring they have visibility into how these affect their wider ecosystem.
The economic theory of diminishing returns is quite applicable here. This is especially true for security operations teams. More cybersecurity vendors don’t necessarily mean a more secure network. Sometimes, it just means an overwhelming number of alerts and a less productive security team.
Each platform includes its own alert system to flag unusual activity, but these often overlap, overwhelming IT teams. Whether an alert is actionable or a false positive, lacking unified observability across systems means teams waste valuable time sorting through numerous alerts to assess their importance, delaying responses to critical incidents and increasing the risk of outage.
But it isn’t just technology teams experiencing a less productive environment due to an influx of security and cloud infrastructure services. From analysts to the C-suite, an overwhelming number of vendors that don’t seamlessly work together are causing slow, unreliable, and clunky IT systems.
In essence, a lack of due diligence in the procurement phase can cause diminishing returns for the entire organisation. So how do we make sure this doesn’t happen while still adhering to compliance needs and creating a secure tech stack?
Streamlining for true resilience
Firstly, we need visibility across every cloud application. IT teams need to have a clear understanding of the number of cloud-based applications they’re working with, and what each of those applications is doing, before deciding what is and isn’t necessary.
From there, they can identify overlaps and streamline systems. Fewer applications typically lead to more efficient operations across the organisation.
When it comes to security, cloud adoption doesn’t need to create unnecessary complexity. Consolidating monitoring and management processes can help reduce noise while maintaining compliance with regulations such as CPS 230.
It’s proof that in a world where Bonnie and Clyde teams have gone digital, the smartest defence isn’t more guards at the door, it’s knowing exactly what’s happening inside the vault. When companies have insight into every system, productivity flows, compliance becomes second nature, and cybercriminals are left with nothing to steal. And in the financial sector, where visibility has gone digital, that’s the kind of trickle-down effect every business can bank on.
