Banks are known for their strong security efforts and better-than-average protection from hacking. According to Autobahn Security’s previous Hackability Score calculation, banks ranks among the top three industries with the highest level of protection.
Bank security could be driven by evolution or by compliance
Banks’ security advantage has two potential root causes:
- Either banks are under increased hacking pressure and hence have more reason and opportunity to learn from hacking attempts (security evolution)
- Or banks are under additional scrutiny from their regulators, who enforce security measures that security evolution would not naturally bring about (security compliance)
The difference between these two drivers is measurable in the sub-scores of the SRLabs Hackability Score:
- Security evolution, on the one hand, would bring about a higher overall level of security as hackers are excellent at exposing weak links
- Banking regulation, on the other hand, would focus on certain areas at the expense of drawing attention away from other areas, thereby leading to an uneven distribution among the Hackability sub-scores
We find this unevenness in our measurement, confirming that compliance with banking regulation is a driver behind banks’ security advantage:
Regulation has measurable effects in skewing attention
Banks perform better than other industries in hardening their Internet-exposed assets. You can achieve asset hardening through checklists and top-down compliance.
Security operations including patching, are more difficult to achieve through checklists and compliance, making issues arising from bad security operations less responsive to regulation. As expected, banking, which faces higher regulation compared to other industries, disproportionately lacks patches.
In absolute terms, banks have fewer issues relative to other industries. However, banks also invest significantly more in information security than other industries. The resulting gap between banks and non-bank security is smaller than the differences in security budget would suggest.
There could be many additional factors contributing to the higher-than-expected Hackability of banks, but the trend is clear; while banks’ protection are better on average, something keeps their attention away from security maintenance tasks such as patching. We think that regulation is partly responsible for this attention skew.
Banking regulation does have a measurable effect, but not necessarily a positive one: Banks appear to spend their large security budgets on comprehensive hardening. Beyond this core topic of security compliance, banks have surprisingly average security levels. For example, banks’ performance around credential and authentication management, and limiting the exposure of management interfaces to the Internet is underwhelming. These weaker links of the protection chain determine the overall security level.
Our research data suggests that if banks spent their large security budgets more similarly to those in other industries who typically follow security evolution over security compliance, their efforts in lowering Hackability would be more effective.
If you are curious to learn more, you can subscribe to be notified about new blog posts, or start exploring our research data directly.
Shares to Social Media
