Page 87 - Cyber Defense eMagazine February 2024

Having worked closely with financial institutions, the problem with this metric is that it paints a dramatic
picture of the threats banks face but requires more context around what that number means to paint a
more factual view of the threats banks face. J.P. Morgan isn’t facing 45 billion attempts by individuals to
hack the banks; I believe that number is an aggregate of automated vulnerability scans, bots, phishing
emails, adware, credit card fraud, BEC, and other automated processes. Language and metrics can be
a minefield in cybersecurity, and it is essential that when security leaders speak to executives, they
provide the appropriate context around the threats faced and ensure they understand and can
communicate the threat clearly to media and their customers without triggering hysteria.

The cybersecurity industry has faced similar stories over the years, such as the “Cyberpocalypse” or
looming “Cyber Pearl Harbor,” terms usually used by overzealous marketing teams and the media to
instill fear in consumers and businesses to buy their tools and click links for ad revenue. These “cyber-
monsters under the bed” narratives used as scare tactics to keep CISOs up at night do little to mitigate
the real threats organizations face.

Erdoes also mentioned that the 45 billion number is twice what it was last year, that trend is telling as it
indicates threat actors are also exploiting the same adoption of automation and machine learning used
by defenders, a trend we can expect to continue. Geo-politics is also at play as many nation-state
adversaries see the U.S. financial system as a key and legitimate target to weaken our financial system
and economy. This may also play into the exponential growth of adversary activity that J.P. Morgan is
facing.

Improving the security posture of our financial system requires leaders of financial institutions and the
media to become more cyber-literate. Many financial institutions are increasingly bringing current and
former security leaders onto their boards. CISOs are increasingly reporting to the CFO or CEO aligning
them more closely with risk management, and providing better visibility to the executive team and board.
This is an opportunity for banks and regulators to get on the same page regarding language and metrics
when it comes to cybersecurity risk.

About the Author

Ken Westin is Field CISO of Panther Labs. He has been in the cybersecurity
field for over 15 years working with companies to improve their security
posture, through detection engineering, threat hunting, insider threat
programs, and vulnerability research. In the past, he has worked closely with
law enforcement helping to unveil organized crime groups. His work has been
featured in Wired, Forbes, New York Times, Good Morning America, and
others, and is regularly reached out to as an expert in cybersecurity,
cybercrime, and surveillance.

Ken can be reached online at LinkedIn (https://www.linkedin.com/in/kwestin/) and at our company
website https://panther.com/

Cyber Defense eMagazine – February 2024 Edition 87
Copyright © 2024, Cyber Defense Magazine. All rights reserved worldwide.