Name: DTCC at Sibos 2023 – Cybersecurity and the evolving threat landscape
Uploaded: 2023-10-11T09:23:23.462Z
Duration: 728.83

full_hd.mp4

full_hd.vtt

ENGLISH

{{00:00:06}}
This is FinTech Futures

{{00:00:07}}
at Sibos and I'm joined by
Jason Harrell from DTCC.

{{00:00:09}}
Jason, thank you so much for taking
the time out to come and speak with us.

{{00:00:12}}
Just get started, let's give
us a quick introduction to

{{00:00:14}}
yourself and your role at DTCC.

{{00:00:15}}
Yes Jason Harrell.

{{00:00:17}}
I am the head of our
External Engagements Group.

{{00:00:20}}
We're responsible for policy and advocacy
for several areas, including cyber

{{00:00:24}}
security, resilience new and emerging
technology, and financial digitalization.

{{00:00:30}}
Excellent.

{{00:00:30}}
And cyber security, obviously a big theme

{{00:00:32}}
this year, Sibos.

{{00:00:33}}
What would

{{00:00:33}}
you say are some of the most prevalent
cyber threats then at the moment?

{{00:00:35}}
How has this been evolving
over the recent years?

{{00:00:37}}
Yeah it's been great to be at
Sybos first of all, and being in

{{00:00:41}}
Toronto and enjoying the city.

{{00:00:46}}
Cybersecurity, of course, has been a top
five risk for a number of our clients,

{{00:00:51}}
so I'm not really surprised that it is
a top five risk that is being focused on

{{00:00:57}}
here, at Sibos.

{{00:00:59}}
I, think

{{00:00:59}}
that the the maturation of the
financial markets has really put

{{00:01:05}}
a lot of pressure on firms to
actually manage cybersecurity risks.

{{00:01:09}}
And then I would say the three
major things for that maturation

{{00:01:13}}
that have impacted how we look at
cyber risk is the interconnectedness

{{00:01:19}}
of the financial markets new and
emerging technology, and third party

{{00:01:25}}
and supply chain risk management.

{{00:01:27}}
For interconnectedness the financial
markets are more interconnected

{{00:01:31}}
than they ever been, have been.

{{00:01:33}}
And what you have is potential impacts
that happen in one jurisdiction can create

{{00:01:39}}
impacts in several other jurisdictions
or outside of the member states.

{{00:01:45}}
And it has an opportunity to
create a real ripple effect

{{00:01:49}}
across the financial markets.

{{00:01:51}}
For new and emerging technology.

{{00:01:54}}
We continue to use new and emerging
technology to either modify

{{00:01:59}}
existing products and services or to
develop new products and services.

{{00:02:03}}
And with those new technologies
can introduce new risks that

{{00:02:07}}
we still have to manage.

{{00:02:09}}
And then lastly, with third
party and supply chain risks.

{{00:02:14}}
What, we have is an increase in
the surface area that can be used

{{00:02:18}}
to attack financial institutions.

{{00:02:21}}
And then for commonly used third
parties across financial institutions,

{{00:02:26}}
those represent points so that
can also create impacts across

{{00:02:31}}
the financial services sector.

{{00:02:33}}
Excellent.

{{00:02:34}}
And the rate cybersecurity space
seems to be ramping up every day.

{{00:02:38}}
Do you expect this, to continue as well?

{{00:02:40}}
And what kind of new threats should
future businesses be looking out for?

{{00:02:43}}
Yeah, so when I think about the current
threat landscape and what's happening

{{00:02:49}}
in that space I feel as though, as we
continue as financial institutions to

{{00:02:56}}
adapt our controls and to understand
how we're being attacked by different

{{00:03:00}}
threat actors, then those threat
actors modify how they, in turn,

{{00:03:05}}
attack the financial institutions.

{{00:03:08}}
I, it's a cat and mouse game,
really, and I look at it as,

{{00:03:12}}
that's going to just continue.

{{00:03:14}}
I don't, see that.

{{00:03:16}}
Changing at all.

{{00:03:17}}
But what I will say is that, I think
there's two threats that I see really...

{{00:03:24}}
Being how would I say, more
prevalent, and what I see will

{{00:03:30}}
be more prevalent going forward.

{{00:03:33}}
One of those is the impacts of nation
state and, or state sponsored threat

{{00:03:39}}
attacks, as well as the use of AI.

{{00:03:44}}
In cyber threats for the first one
the geopolitical environment has

{{00:03:49}}
always generated significant impacts
to the, cyber threat landscape.

{{00:03:57}}
And as geopolitical
tensions continue to rise.

{{00:04:01}}
I expect that we'll continue to see
increased attacks from those threat

{{00:04:06}}
actors against financial institutions
and other critical infrastructure.

{{00:04:13}}
And it is the sophistication of
those attacks, as well as the

{{00:04:18}}
funding for those threat actors,
that creates a real problem, not only

{{00:04:23}}
for smaller institutions, but even
for some of the larger institutions

{{00:04:27}}
to be able to defend against.

{{00:04:30}}
For AI we're already using AI.

{{00:04:35}}
AI is included in a number of the
cybersecurity products that we

{{00:04:39}}
use to protect our networks so
that we can identify anomalies.

{{00:04:46}}
We can identify changes in attack
practices from different threat actors.

{{00:04:52}}
It provides us as security
practitioners with a real benefit.

{{00:04:57}}
The flip side of that is, it
also can be used to generate and

{{00:05:02}}
develop new attacks as AI learns.

{{00:05:05}}
And there's also the potential impact
that I see where the threat actors that

{{00:05:14}}
are, continuously trying to attack our
financial institutions will get better

{{00:05:19}}
and have more knowledge based on the
information that they get from AI models.

{{00:05:25}}
And so that will have the
potential to accelerate some

{{00:05:30}}
of the attacks that we see.

{{00:05:32}}
Are there any industry specific
benchmarks that financial institutions

{{00:05:35}}
can use to measure the effectiveness
of their protocols and cybersecurity

{{00:05:39}}
risk management practices?

{{00:05:41}}
Yeah, so one of the things that I want
to just make note of is that financial

{{00:05:47}}
authorities and financial institutions
have actually been partnering to,

{{00:05:53}}
one, better understand what's The
potential impacts that are facing the

{{00:05:58}}
financial services sector and potential
policy solutions that can be put in

{{00:06:03}}
place to help raise the floor on the
preparedness of financial institutions.

{{00:06:11}}
So one of the challenges that
we've had within the sector is

{{00:06:16}}
you have a cyber risk program.

{{00:06:19}}
that is run by your IT and risk
organization, and then you would have

{{00:06:24}}
all of these rulemakings that you
would need to adhere to for compliance.

{{00:06:32}}
And how do you bring those two worlds
together where you understand how

{{00:06:39}}
your cybersecurity program is actually
meeting your compliance obligations.

{{00:06:44}}
So to address that challenge one of
the activities that institutions and

{{00:06:49}}
financial authorities worked on was
the development of the Cyber Risk

{{00:06:55}}
Institute Financial Services profile.

{{00:06:57}}
And what that did was it took the
requirements and the efforts that we

{{00:07:02}}
were doing in cybersecurity and the
frameworks we're using for cybersecurity.

{{00:07:07}}
So the national Institute of Standards
and Technologies Cybersecurity

{{00:07:14}}
Framework, and the ISO's 27000 series.

{{00:07:22}}
Frameworks, and what they did was map
the regulations to those frameworks, and

{{00:07:30}}
what that did was it provided a facility
for financial institutions not only to

{{00:07:36}}
understand where they may have potential
gaps to their compliance obligations, but

{{00:07:42}}
it also them to benchmark and measure how
they how they actually meet their their

{{00:07:52}}
compliance obligations and then be able to
demonstrate to the financial authorities.

{{00:07:57}}
So it, it helped everyone all
around and so it's, one tool that

{{00:08:04}}
I, feel that financial institutions
have been able to use to improve

{{00:08:10}}
and enhance their, programs.

{{00:08:13}}
And just to finish off how is the
regulatory landscape then around

{{00:08:16}}
cybersecurity and third party
risk management been evolving

{{00:08:18}}
recently in financial services?

{{00:08:20}}
As the threat landscape changes
and, we find ourselves in a, in

{{00:08:26}}
an environment where we're in
increase, we have increased threats.

{{00:08:30}}
And we have to react and respond.

{{00:08:32}}
Of course the regulatory environment
also has to then review its rules and

{{00:08:37}}
guidance that it provides to us as
financial institutions to make sure

{{00:08:42}}
that they're aligned and are there
things that we should be doing as a

{{00:08:49}}
financial services sector that aren't
included in the current rulemaking.

{{00:08:55}}
Again, there's a number of activities that
are being worked on between the financial

{{00:09:01}}
authorities and financial institutions.

{{00:09:04}}
through their public and
private working groups.

{{00:09:08}}
There's probably more than I
have to count, but I, I will

{{00:09:12}}
talk about three of them.

{{00:09:15}}
One is the European Union's
Digital Operational Resilience Act.

{{00:09:20}}
And what that...

{{00:09:23}}
ACT did was create a consistent
minimum requirements for cybersecurity

{{00:09:31}}
controls across the European Union
and really eliminate the ability to

{{00:09:41}}
have arbitrage and hey, I'm going
to operate in this member state

{{00:09:47}}
because they have less cyber security
requirements in this member state.

{{00:09:52}}
There was a lot of partnership that went
in with working with the commission,

{{00:09:55}}
the parliament, and others to get to
a place where the digital operational

{{00:10:00}}
Resilience Act was enacted, which
happened earlier this year, and now

{{00:10:06}}
we're working through the technical
standards that will be used to actually

{{00:10:11}}
outline the exact controls that financial
institutions have to put in place.

{{00:10:16}}
The second I'll bring up is the Financial
Stability Board's third party toolkit.

{{00:10:24}}
for financial institutions
and financial authorities.

{{00:10:28}}
This is really being put in place so that
one, it can lift where we are currently

{{00:10:35}}
from managing our third party risks.

{{00:10:38}}
And then...

{{00:10:40}}
Expand the coverage of what we may need
to do when we're not just looking at

{{00:10:46}}
third party, but also the supply chain.

{{00:10:49}}
So those fourth and fifth party
risk, how do we actually have

{{00:10:53}}
better insights into the risk that
we may have there from the, use of

{{00:10:59}}
particular fourth and fifth parties.

{{00:11:01}}
And then lastly the U.

{{00:11:03}}
S.

{{00:11:04}}
interagency guidance.

{{00:11:06}}
In the U.

{{00:11:07}}
S.

{{00:11:07}}
we used to have.

{{00:11:09}}
The third party guidance from the
Fed, we had third party guidance

{{00:11:13}}
from the OCC, we had different
third party guidance from the FDIC.

{{00:11:19}}
They're all very similar, but
they have their differences.

{{00:11:23}}
Instead of having three different
guidances, we work together to

{{00:11:28}}
have one set of guidance that both
combine what the minimum requirement

{{00:11:34}}
used to be to those added controls
that we need to put in place.

{{00:11:39}}
For third party and third
party risk management.

{{00:11:41}}
And so that's been very helpful as
firms try to streamline the number of

{{00:11:49}}
regulations that they have to adhere to.

{{00:11:52}}
Excellent Thank you so much for
taking the time out to speak to

{{00:11:54}}
Jason and share your insights.

{{00:11:55}}
It's been a, pleasure.

{{00:11:56}}
Ah, it's been a pleasure.

{{00:11:57}}
And it's great to be here at Sibos,
and thank you to Fintech Futures for

{{00:12:00}}
the opportunity to talk about it.

{{00:12:02}}
Thank you so much.

at Sibos and I'm joined by
Jason Harrell from DTCC.

Jason, thank you so much for taking
the time out to come and speak with us.

Just get started, let's give
us a quick introduction to

I am the head of our
External Engagements Group.

We're responsible for policy and advocacy
for several areas, including cyber

security, resilience new and emerging
technology, and financial digitalization.

And cyber security, obviously a big theme

you say are some of the most prevalent
cyber threats then at the moment?

How has this been evolving
over the recent years?

Yeah it's been great to be at
Sybos first of all, and being in

Cybersecurity, of course, has been a top
five risk for a number of our clients,

so I'm not really surprised that it is
a top five risk that is being focused on

that the the maturation of the
financial markets has really put

a lot of pressure on firms to
actually manage cybersecurity risks.

And then I would say the three
major things for that maturation

that have impacted how we look at
cyber risk is the interconnectedness

of the financial markets new and
emerging technology, and third party

For interconnectedness the financial
markets are more interconnected

And what you have is potential impacts
that happen in one jurisdiction can create

impacts in several other jurisdictions
or outside of the member states.

And it has an opportunity to
create a real ripple effect

We continue to use new and emerging
technology to either modify

existing products and services or to
develop new products and services.

And with those new technologies
can introduce new risks that

And then lastly, with third
party and supply chain risks.

What, we have is an increase in
the surface area that can be used

And then for commonly used third
parties across financial institutions,

those represent points so that
can also create impacts across

And the rate cybersecurity space
seems to be ramping up every day.

And what kind of new threats should
future businesses be looking out for?

Yeah, so when I think about the current
threat landscape and what's happening

in that space I feel as though, as we
continue as financial institutions to

adapt our controls and to understand
how we're being attacked by different

threat actors, then those threat
actors modify how they, in turn,

I, it's a cat and mouse game,
really, and I look at it as,

But what I will say is that, I think
there's two threats that I see really...

Being how would I say, more
prevalent, and what I see will

One of those is the impacts of nation
state and, or state sponsored threat

In cyber threats for the first one
the geopolitical environment has

always generated significant impacts
to the, cyber threat landscape.

And as geopolitical
tensions continue to rise.

I expect that we'll continue to see
increased attacks from those threat

actors against financial institutions
and other critical infrastructure.

And it is the sophistication of
those attacks, as well as the

funding for those threat actors,
that creates a real problem, not only

for smaller institutions, but even
for some of the larger institutions

AI is included in a number of the
cybersecurity products that we

use to protect our networks so
that we can identify anomalies.

We can identify changes in attack
practices from different threat actors.

It provides us as security
practitioners with a real benefit.

The flip side of that is, it
also can be used to generate and

And there's also the potential impact
that I see where the threat actors that

are, continuously trying to attack our
financial institutions will get better

and have more knowledge based on the
information that they get from AI models.

And so that will have the
potential to accelerate some

Are there any industry specific
benchmarks that financial institutions

can use to measure the effectiveness
of their protocols and cybersecurity

Yeah, so one of the things that I want
to just make note of is that financial

authorities and financial institutions
have actually been partnering to,

one, better understand what's The
potential impacts that are facing the

financial services sector and potential
policy solutions that can be put in

place to help raise the floor on the
preparedness of financial institutions.

So one of the challenges that
we've had within the sector is

that is run by your IT and risk
organization, and then you would have

all of these rulemakings that you
would need to adhere to for compliance.

And how do you bring those two worlds
together where you understand how

your cybersecurity program is actually
meeting your compliance obligations.

So to address that challenge one of
the activities that institutions and

financial authorities worked on was
the development of the Cyber Risk

FinTech Futures

Expert Insight

At the Sibos 2023 conference in Toronto, FinTech Futures sat down with Jason Harrell, Managing Director, Operational and Technology Risk and Head of External Engagement at DTCC, to discuss the emerging cyber threats financial institutions should be prepared for and how they can stay one step ahead of the fraudsters.

Watch the video to discover:
•	The most prevalent cyber threats that financial institutions face today and how the space has evolved over the last few years.
•	The best practices for financial institutions in terms of prioritising cyber threats, and for updating and testing their cybersecurity policies and protocols.
•	How the regulatory landscape governing cybersecurity and third-party risk management is evolving in the financial services industry.

