Banks Take Military Approach To Cybersecurity

In an effort to combat cyberattacks, banks are taking a military approach to their online security.

“This is not that different from terrorists and drug cartels,” Matthew Nyman of Mastercard said, according to The New York Times. “Fundamentally, threat networks operate in similar ways.”

As cybercrime is one of the world’s fastest-growing issues — with at least $445 billion lost last year — it makes sense that banks and payment companies are treating the threat like a war.

At Mastercard, Nyman oversees the company’s new fusion center, a term that comes from the Department of Homeland Security, which set up fusion centers to coordinate federal, state and local intelligence-gathering after the attacks of September 11.

Now, at least a dozen fusion centers have been created at major financial institutions like Citigroup and Wells Fargo, as well as regional banks such as Bank of the West. In addition, Fifth Third Bank is building a fusion center in its Cincinnati headquarters, and Visa, which created its first two years ago in Virginia, is developing two more in Britain and Singapore.

Fighting off cyber threats has become priority one for banks, with Alfred F. Kelly Jr., Visa’s chief executive, telling investors that he is “completely paranoid” about it. And Bank of America’s Brian T. Moynihan said his cybersecurity team is “the only place in the company that doesn’t have a budget constraint.”

The financial sector is responding to the threat by creating it own military-style drill — Quantum Dawn, which is a simulation of a catastrophic cyberstrike.

The most recent exercise last November had 900 participants from 50 banks, regulators and law enforcement agencies role-playing their response to an industry-wide infestation of malicious malware that corrupted, and then blocked, all outgoing payments from the banks. Over two days,  new threats were added every few hours, such as denial-of-service attacks.

The end result is a system called Sheltered Harbor, which went into operation last year. Now, if one member of the network has its data compromised or destroyed, others can retrieve its archived records if needed and restore basic customer account access within a day or two.

While the system has luckily not yet been needed, nearly 70 percent of the country’s deposit accounts are covered by it.