NYU CCS Talk: Cybersecurity and Resilience – The Path Forward

I had the opportunity to attend a nice lecture in Brooklyn this past Thursday, as part of our AIG-sponsored lecture series at the NYU Center for Cybersecurity (CCS). The keynote speaker was Jason Harrell, Head of External Engagements at DTCC. Jason’s role at DTCC is cyber advocacy, working to help shape rules and standards to improve financial services security posture.

Such advocacy is important work for DTCC since the company is the largest post-trade market infrastructure, clears and settles the majority of the US fixed income and equities securities markets, and processes $2.5 Quadrillion of securities (which is a massive fifteen zeros, in case you are counting).

Jason’s talk focused the advancing threats to the financial services marketplace, with emphasis on nation-state actors. He covered a variety of incidents both offensive and defensive involving countries such as Estonia and Ukraine. One often hopes that perhaps some of the threat-related observations are hype – but practitioners like Jason remind us that such concerns are real.

Jason used some interesting analogies to Marvel characters to help highlight which malicious actors are sponsoring the various types of attacks. Which is how the topic of resilience was introduced. In terms of priority, Jason put this first – and from my perspective, I’ve come to agree that cyber resilience is emerging as a paramount concern.

The definition used was “the ability of a financial institution and the financial services sector to protect, detect, respond to, and recover from operational incidents,” and this seems sensible. Key aspects of resilience planning and execution are cyber incident reporting, third party risk management, and cloud technology usage.

The bottom line here is that Jason helped to highlight two main themes for consideration: First, that cyber threats to banks and related companies are meaningful and that immediate preventive action is necessary. I guess we all know this – but it really does help to have this reinforced by a practitioner in the financial services field.

And second, that cyber resilience might be the best focus area for security engineers in the coming years to ensure that our financial sector remains healthy and available for business. I’ve long felt that the term resilience might be a better moniker than security, given the threats we face – and Jason’s talk helps to reinforce that belief.

If you are interested in more information about the NYU CCS Lecture Series sponsored by AIG, contact the team here.