Bringing you live news and features since 2006 

George Ralph, RFA

What can the financial services sector learn from the WannaCry ransomware attack?


By George Ralph (pictured), RFA​ – The aptly named WannaCry cryptoworm, is working its way around the world, encrypting data and demanding ransom payments in the cryptocurrency, bitcoin.

The attack was global in scale, and brought parts of the NHS to a standstill, along with Telefonica in Spain, FedEx, Deutsche Bahn and LATAM Airlines, to name a few.
For financial services firms, WannaCry is a wakeup call, because although the sector seems to have escaped relatively unscathed, so far, the next attack is just around the corner, and:
1) WannaCry has all the signs of an amateur attack. The relatively easy to find “kill switch” hidden in the code. The apparently manual ransom payment mechanism, whereby victims were sent an individual code generated by the hackers. Not conducive to a well organised, slick, global attack and more indicative of a trial run by some inexperienced cyber criminals. The small number of bitcoin payments received so far, which can be publicly seen by anyone. All of this points to an amateur attack, which is terrifying if you think about the damage a well-executed, professional attack could do.
2) WannaCry did not target the NHS in particular, or choose countries to attack. It was a phishing attack aimed at Microsoft operating systems, which is indiscriminate. Phishing attacks like WannaCry rely on human error. People are people across the world, so this is a stark warning to up the ante, with regular staff training on cybersecurity best practices, to update your policies and procedures regularly, and in an engaging way. However you choose to get the message across to users, make sure you do. They are your weakest point.
3) Patching alone is not the answer. By its nature, patching is reactive, not proactive or preventative. That said you should still ensure security patches are installed and maintained as a first line defence. WannaCry uses the EternalBlue exploit and DoublePulsar backdoor to spread through local networks and remote hosts that have not been updated with the most recent security updates, to directly infect any exposed systems. A patch was developed by Microsoft two months ago, but many organisations haven’t yet applied it. 
4) IT departments need to do their bit. Encourage users to back up files and data to a central location, which is managed, secured and encrypted by you, the IT department, who will of course have a multi-layered, comprehensive cybersecurity strategy in place… If the worst happens, you won’t lose any critical data, customers’ data won’t fall into the wrong hands and you won’t fall foul of the regulatory bodies.
5) Cybercrime is a profitable business. Organisations selling monthly subscriptions to vulnerabilities kits, and easy access to malicious code make it an attractive proposition, so beware.

Latest News

ETF data consultant ETFGI reports that assets invested in the global ETF industry reached a new record of USD12.71 trillion..
Calastone has published an ETF white paper which examines several of the processes that take place across the lifecycle of..
Adapting product lines to fit into changing methodologies and meet shifting demand is essential to remaining relevant in the industry..
Investors urgently need greater access to diversified investment strategies aligned with the Paris Agreement on climate change if the world..

Related Articles

Taylor Krystkowiak, Themes ETFs
Themes ETFs opened its doors in December 2023, with an introductory suite of 11 ETFs – seven thematic and four...
Konrad Sippel, Solactive
At the end of March, financial index specialist, Solactive, published its 2024 annual report on future trends.  ...
Lorraine Sereyjol-Garros, BNP Paribas
Following changes to the French Monetary and Financial Code and of the French market authority AMF’s General Regulation, it is...
Ed Rosenberg, Texas Capital
Texas Capital Bank first opened its doors back in December 1998 and nowadays offers wealth-management services, as well as commercial,...
Subscribe to the ETF Express newsletter

Subscribe for access to our weekly newsletter, newsletter archive, updates on the site and exclusive email content.

Marketing by