NY Fed: Capital Markets Must Be More Wary of Data Cyber Threats

Thetford told attendees that the profile of cyber-attacks has changed from lone hackers in their basements or activist groups seeking to cause reputational damage or disruption, and the biggest threat to data security is now nation states and insiders intent on deeply infiltrating firms' data architectures for financial gain.

In fact, the primary driver for this new breed of adversaries is often commercial because there is "money to be made" from cyber-crime by selling sensitive data on the black market. Information is very lucrative," Thetford said, adding that today's cyber-terrorists have unlimited time and resources to bury their claws deep within firms' architectures, and are willing to be patient in the pursuit of monetary gains. "They are much more willing to take their time and find multiple back doors before ‘exfiltrating' [infiltrating and extracting] data. If they move in, it's because they want to stay," he said.

For example, cyber criminals could steal non-public data, economic data or client information from financials firms, then sell that data on the black market for profit, he added.

To help capital markets firms using commercial-grade technology to fight military-grade attacks, Thetford encouraged firms to build simple technology stacks and flexible architectures that can be compartmentalized so that bugs can be fixed on the fly. In addition, firms should layer their security protection at every point where data is exposed, such as desktops, devices and servers.

A mature information security program also needs to have a greater focus on threats from within─such as disgruntled employees or criminal "insiders" placed within organizations with the express purpose of committing espionage by terrorist groups or nation states. "The technology to monitor insiders is lagging. There's this idea that once you're in, you're trusted-but that's not enough," Thetford said, adding that firms should consider more background checks and additional monitoring of employee activity.

In addition, firms must pay special attention to external consultants as well as outsourcing service providers. "I'm not saying bring it all in-house, but you need to think more about what you're giving them access to and whether they have the right controls and contracts in place to tell you about any data losses," Thetford said. "When it comes to outside service providers, there is very little transparency around their security controls. That scares me for you," he added.