Introduction
Capital markets rely on safe and secure digital systems for trading securities, managing investment portfolios, conducting transactions, and safeguarding valuable financial details. As more interconnected technologies are used to provide fast and reliable services, these are increasingly being used by stock exchanges, brokerage firms, investment managers, custodians and clearing institutions. But this digital revolution also has afforded cybercriminals the chance to wreak havoc on trading processes, steal proprietary data, tamper with accounts, and cause investor distrust. Finally, the cyber security risks to stock exchanges highlight how financial market security is not only an IT issue, but also an integral part of the stability of stock markets. If successful, the attack has the potential to impact investors, financial institutions and the economy. It is important that the capital market actors put in place effective security controls, follow the developments of new threats and coordinate their reactions to cyber incidents to ensure their operational resilience and the integrity of financial markets.
Cyber Security Threats across Capital Markets Sector
Capital markets cyber security refers to the protection of computer systems, communication networks, applications, databases and online identities used to engage in financial transactions. Those spaces are desirable targets as they handle valuable resources and information, such as account details, trading orders, investment plans, customer information, and trading records. An attacker might aim to collect money or demand a ransom, steal commercially sensitive data, or cause market disruption, for political and/or strategic motives. The impact can have a ripple effect, with financial markets requiring ongoing exchanges, brokers, clearinghouses, settlement systems and technology providers to communicate with each other. A vulnerable participatory organization can lead to vulnerability for other organizations. To build a secure environment, institutions need to know what security weaknesses exist, what the potential impact of an attack will be and what security measures will help to preserve data accuracy, maintain confidentiality and ensure that essential financial services are available.
The Top 5 Threats to Capital Market Participants
1. Phishing and Account Takeovers
One reason why phishing is still such a problem is that attackers do not attempt to crack advanced technical systems, but instead target employees and investors instead. Emails, text messages, websites, and phone calls can be fraudulent and appear to be from a legitimate financial institution to trick a customer into sharing passwords, authentication codes or any other sensitive information. If the attackers gain access to these credentials, they can be able to take control of brokerage accounts, alter account details, transfer funds or send out unapproved trading orders. Other causes of account takeover include the use of the same password, stolen session cookies or stolen personal devices. These risks can be mitigated by financial institutions using multifactor authentication, secure login processes, alerts for suspicious activity, and training their employees on the risks and how to avoid them. Each investor should have different passwords for each investment account; check out any unusual emails by themselves; and never click on a link they don’t know, or use links in emails to check their financial accounts. It is also essential that institutions have easy reporting mechanisms in place to allow suspicious activities to be investigated before it amount to significant financial losses.
2. Ransomware and Data Breaches
Ransomware attacks are attacking computer systems with malicious software to inhibit authorized parties from accessing the information they need until a ransom is paid. In capital markets, such events can cause a disruption in the order processing, delay in the reporting process, impact customer support, and delay investment management activities. Others will also steal confidential information prior to encryption, adding to the pressure as they threaten to publish that information. Personal identification information, account information, transaction histories and proprietary investment research may be exposed through data breaches. These events can result in identity theft, regulatory fines, liability claims and reputation issues. Financial institutions should keep encrypted backup copies, install network segmentation, patch software regularly and test their system’s power to rebuild critical systems. Where appropriate, backups should be kept in such a way that they are not subject to unauthorized changes, and should be kept from normal network connections. Better data categorization, limited access and regular review and monitoring can help to limit the risk and effect of data theft.
3. Procure Access to Data or Systems
Insider threats are those that occur when someone (employee, contractor, or trusted business partner) uses their legitimate access, either accidentally or intentionally. An aggravated staff member could share confidential trading methods, take customer information or disrupt vital systems. Another way is that by either mis-handling files, approving fraudulent requests or by being targeted in a social engineering attack, an employee can inadvertently release information. Privileged accounts are especially risky because users with this type of access can have broad access to sensitive databases and infrastructure, which could give them the power to destroy the organization. Administrators and technical specialists are other users that are potentially at risk because they may have access to sensitive databases and infrastructure, and may be able to destroy the organization. The key tenet of least privilege should be applied to capital market organizations, and they shouldn’t give anyone more authority than they need. Enhanced accountability can be achieved through segregation of duties, approval workflow for critical transactions, background checks (where permitted by law) and comprehensive audit trails. Access reviews are also highlighted as an important function and are recommended to be performed regularly including when employees move to a different role or leave an organization. Institutions can mitigate insider risks without unduly hindering legitimate business operations with the proper supervision and security policies.
4. API Attack on Trading Infrastructure
Application programming interfaces (APIs) are used to connect trading platforms with mobile investment apps, market data providers, and financial institutions to share data and complete authorized actions. But if not properly secured, poorly-structured APIs can reveal customer information, enable unapproved transactions, or provide the opportunity for hackers to take advantage of vulnerabilities in authentication and access controls. Common issues are permissions, lack of input validation, too few rate limits, and lack of monitoring. Trading infrastructure can also be attacked using distributed denial-of-service (DDoS) attacks, where the attackers send flood of traffic to the system, making it impossible for the legitimate users to access services. Attacks against third party technology providers, malicious software and compromised network devices are other threats. The incidents may hinder access to markets or put off the prices and trading information. Strong authentication, authorization checks, encryption, rate limiting and frequent security tests should be implemented to ensure the security of APIs. Trading infrastructure should also be designed through other elements to ensure service continuity in the event of disruption – including network segmentation, resilient connectivity, capacity management and tested recovery arrangements.
5. Market Manipulation and Cyberattacks on Financial Data.
Financial market data and trading systems could be the focus of attacks by cybercriminals, which could lead to price manipulation, dissemination of false information, or interference with investors’ decision making. A hacker, for instance, could infiltrate financial news Web sites, change data feeds or access a system that disseminates stock prices and market announcements without authorization. When investors are given wrong information, they may make wrong investments, and when the data is manipulated, it may cause a lack of faith in the fairness and transparency of the financial markets. Trading algorithms can also be targeted or systems that process orders can be targeted for attacks. These activities can lead to confusion, arbitrary interference in the normal trading, and even loss of investor and institutional funds. In order to mitigate these risks, participants in the capital market need to guard against the integrity of market data, cross-check data from reputable providers, adopt robust access security measures, and watch out for unusual trading volumes. The regular security testing, adequate security data verification and the coordination with regulators can assist to detect suspicious activities and maintain fair and orderly market operations.
Financial Institutions take Essential Steps in Cybersecurity
Multi Factor Authenticating and Encryption
Multifactor authentication (MFA) is a variation of two-step verification that involves a second device or process besides a password to verify a user’s identity, ensuring that the security of their accounts is increased. Passkeys that are used properly or hardware security keys can be more secure against credential theft than passwords alone, and can help with phishing prevention. Another key piece of protection is encryption, which renders information unreadable to anyone who doesn’t have the cryptographic keys to decrypt it. Financial institutions should safeguard sensitive data both in motion and at rest, securely manage encryption keys, and restrict access to these. They are especially crucial in remote access to services and when institutions share information with external service providers. But encryption and authentication should be an element of a comprehensive security plan.
Measures to Control Access and Ongoing Monitoring
Access controls help ensure that employees, applications, and external service providers can access the systems and information only needed for the systems’ authorized activities. Compromised accounts can be minimized by implementing role-based access control, least-privilege permissions and privileged access management. These controls are complemented by continuous monitoring, which can alert security teams to malicious login attempts, data transfers that don’t seem to match the organization’s typical activity, system modifications that are out of the ordinary, and unusual activity on a trading platform. Security information and event management systems can gather and analyze logs from various sources, and automated detection systems can notify security analysts to look out for potentially harmful activity. Institutions need to have unambiguous escalation protocols with the view of ensuring that “significant” alerts are acted upon promptly. By conducting regular vulnerability checks, conducting penetration testing, updating software and having secure development processes in place, vulnerabilities can be detected before criminals can exploit them. These all enhance visibility and make it easier for organizations to identify and manage threats in complex financial scenarios.
Incident Response and Business Continuity
While appropriate protection is critical, no institution can completely remove any cyber risk and incident response and business continuity are integral to the security of financial markets. Some decisions about who will take control in case of a security incident, how security incidents will be categorized, and which teams will be notified of any compromise of systems should be determined in an incident response plan. Response activities can range from isolating any impacted devices and disabling compromised accounts to preserving forensic evidence, notifying tech providers and notifying authorities depending on the incident. Recovery procedures should be held for critical applications, transaction records and communications systems by institutions as well. Periodic drills can identify problems in these preparations and educate the employees on their duties in case of emergency. Dependencies to exchanges, brokers, cloud services, payment service providers and other third parties should be considered when developing recovery plans. Through testing of restoration processes and alternative operating arrangements, capital market participants can minimize downtime, minimize financial losses and restore services in a controlled manner.
Regulatory Risk Management and Shared Responsibility
Governance is essential and part of the solution for cybersecurity in capital markets. Financial institutions need to know the laws, regulatory and supervisory expectations that apply in their jurisdiction, such as obligations for data protection, incident reporting, etc., and operational resilience obligations and the obligations that apply to third party risk. Boards and senior management must have their eyes on cybersecurity strategy, provide adequate resources and integrate technology risks into the broader enterprise risk management. Organizations need inventories of critical systems, to evaluate suppliers prior to contracting, and to regularly audit the security of cloud services and outsourced technology. However, regulatory compliance is insufficient to ensure resilience as threats are constantly emerging and controls can become ineffective. The implementation of compliance activities needs to be complemented, however, by a variety of practical testing, employee training and frequent risk assessments. Sharing of information between the financial institutions and financial regulators, and trusted cyber security organizations, can also aid in the detection of new threats and action planning on matters that could impact multiple players in the financial market.
Technology providers have a part to play, as vulnerabilities in software, cloud, data services or outsourced platforms can impact multiple financial institutions at once. Providers will practice good development hygiene, report any vulnerability quickly and responsibly and have a good system of incident communication. Investors also need to take steps to safeguard their assets by using trusted devices, implementing multifactor authentication, not sharing their passwords and ensuring requests they don’t anticipate for funds and account information are legitimate. They should check transactions alerts, keep track of transactions that happen and immediately reach out to their brokerage firm if they believe they have been accessed without their consent. Financial institutions, on the other hand, need to ensure that security advice is easy to comprehend, and that there are easy ways to report suspected fraud. This collaborative approach acknowledges that cyber security is not a task for any one organization or product. However, it needs cooperation between market operators, service providers, the regulators, employees and customers to minimize vulnerabilities in the financial system.
Conclusion
In today’s digital era, cybersecurity plays a crucial role in ensuring the stability, efficiency, and credibility of capital markets. Fraud can impact investors through phishing, account takeover, ransomware, insider threats, API weaknesses and data breaches, or from attacks on trading infrastructure. There are several layers of defence to ensure that the protection is effective: Multifactor authentication, encryption, access controls, constant monitoring, proven incident response strategies and suitable regulatory risk management. Third-party dependencies must also be evaluated and support for recovery put in place to meet the challenges of disruption by financial institutions. Both technology providers and investors need to be proactive about creating secure services and about safely using digital tools and reporting any suspicious activity promptly. While no single solution is capable of stopping all attacks, multi-layered risk management can greatly minimize the risk of attack, and its impact. Capital market participants can safeguard sensitive data, ensure market integrity, and maintain investor confidence in the evolving connected capital market by adopting a shared responsibility and investing in ongoing operational resilience.
Get more well researched information about Cybersecurity in Capital Markets here.
