Hackers costing banks millions

By RICHARD PAMATATAU



New Zealand banks and financial organisations are spending millions of dollars to bolster security systems and stave off potentially expensive cyber attacks.

The world's financial and banking systems are under increasing attack from internet viruses. Many attacks, according to the Deloittes Global Security Survey 2004, have resulted in costly losses.

Despite this experience, the survey also found that 25 per cent of the top 100 companies interviewed have flat budgets for their security systems.

This month Westpac was penetrated by the Sasser virus which slowed down its information processing.

Westpac spokesman Paul Gregory said the bank's systems were purged overnight and no financial loss was incurred.

Senior IT staff in the top 100 global financial services organisations were polled on governance, investment, value, risk, responsiveness, use of security technologies, quality of operations, and privacy. No New Zealand banks were surveyed.

TSB Bank chief executive, Kevin Rimmington, refused to reveal the 'significant' sum spent on security by his bank.

He said more money was being put into this area which was fundamental to the bank's processes.

It operated a disaster recovery site which mirrored its systems.

Westpac, AMP financial Services and Kiwi Bank also said they regard information systems security and planning to be critical.

But all the local banks were cagey and would reveal little about the technical or policy details, or their security spending.

Eighty-three per cent of respondents admitted their systems had been compromised in the past year, compared with only 39 per cent in 2002.

Of this group, 40 per cent stated that the breaches had resulted in financial loss to their organisation.

Global leader of Deloitte's IT Risk Management and Security Services, Adel Melek, said the challenges were getting greater as banks fought bigger battles around security and resources stagnated.

Although more than 70 per cent of respondents saw viruses and worms as the greatest threat to their systems in the next 12 months, only 87 per cent had fully deployed anti-virus measures. This result is down from 96 per cent in 2003.

The ASB's general manager retail banking Barbara Chapman said her organisation had security as a top priority and its banking systems had never been penetrated.

Management took a very firm view that security was critical. There were significant policies, practice and adequate funding to support initiatives in this area.

She said an area where there was potential for harm for any bank was when customers accessed their accounts from unsafe environments like internet cafes.

It was the same as being aware that someone could be watching as you used your Eftpos card to get money from a hole in the wall.

While the majority of respondents (59 per cent) indicated security was a key part of their systems, only 10 per cent reported that their general management perceived security as a way to enhance business.

And although 91 per cent indicated they had a comprehensive IT disaster recovery plan in place, one-third (32 per cent ) felt that security technologies acquired by their organisations were not being utilised effectively.

Each of the New Zealand banks contacted had significant disaster recovery systems in place.

Identity management and vulnerability management are the two most common technologies that financial services intend to deploy over the coming 18 months.

These systems are a mix of advanced technology and policies that verify the identity of customers or staff using bank computers at any stage during a transaction.

Chapman said her bank was looking at boosting its systems.


VIRUS SHIELDS

Banks and financial institutions are investing heavily in technology designed to protect them from crippling cyber attacks.

A new international survey of global financial services companies found that 83 per cent of respondents experienced attacks that had compromised their systems in the past year.

New Zealand banks all say they regard security as imperative, but are cagey about the nature or scale of their measures.