FinSec Leadership Forum: Roundtable June 2024

 FinSec Leadership Forum

This roundtable discussion was held as part of a regular series of meetings of the FinSec Leadership Forum, brought in partnership with OccamSec, Barclays and Virgin Money.

This discussion was hosted by Barclays the their brand new state of the art campus in Glasgow.

We heard from 2 keynote speakers, followed by a group discussion.

Keynotes as follows:

1. Managing Security Risk Within Appetite

Daniel Chalmers, Operational Risk Director, Barclays

2. Effective Risk Management and Cyber Security as a differentiator and opportunity

Darren Anderson, Information Security Director, OccamSec

Key takeaways from the discussion were as follows:

1 – Good cyber security can enable growth and does not only serve to safeguard assets. 

2 – The financial services industry is in itself built on risk and reward and is ideally placed to adapt to changing cyber security threats and operate at an optimum level of risk.

3 – There is a balance to achieve between security levels and fraud rates as lower security leads to greater engagement with financial products. 

4 – Financial organisations have to define the level of risk they are willing to accept and defend this position in front of the regulator.

5 – There has been a culture shift in regulation where the focus is now on attack preparation rather than prevention.

6 – The average cost of a data breach to UK organisations in 2023 was £3.4m with over half of the country’s businesses experiencing an attack in the last 12 months.

7 – Company boards are increasingly open to exploring security investments due to the frequency and impact of cyber attacks. Demonstrating ROI and clearly communicating the business benefits of good security are key to board level buy in for security initiatives.

8 – Clear and visual communication of the risks of potential breaches was vital to get C-Suite buy-in.

9 – Large financial services organisations are now putting in measures that means their critical data can be quickly restored following a cyber attack.

10 – Every employee should share responsibility for cyber security measures so that it does not remain a siloed function.

A full report form this discussion will be published August 2024.