Confinement has been a challenge for financial institutions. In a few days they have had to turn their work habits around, and go from some face-to-face positions to, in a few days, send the majority of the workforce to their homes to telework. In the case of BBVA, 98% of the employees coincided by teleworking, after the closure of 70% of the branch network. Customers have also changed their relationship with the bank and have become more digital.
The experience has been a success, but it has not been without risks, among which the technological ones stand out. Cybersecurity, in fact, has become a challenge for banks during the pandemic. “Digitization and teleworking have made the perimeter to be protected at BBVA have expanded exponentially,” they explain from the entity.
Álvaro Garrido, responsible for BBVA’s cybersecurity, declares that the statistics with which the bank works “say that the level of materialization of cyber attacks has been sustained. We are in the same ratios as the previous year or even a tad lower. But it is also true that the level of dedication and resources that we are throwing at the problem is higher ”.
This telecommunications engineer has been leading the responsibility to safeguard BBVA’s security for almost three years. His role as chief security officer (CSO) combines physical and digital security and the fight against fraud. He has worked for years in the Middle East, Asia, and Scandinavia.
Garrido affirms that during the confinement “what we have noticed is that the packaging of these (technological) attacks has come in a different color, with another approach, closely associated with the health crisis. What is changing is the type of bait clearly, but now it begins to be seen that they return to the attacks with the style previous to the Covid ”. He maintains that one of the things that “we have discussed with other banks, companies or the regulator is the importance of user awareness.” BBVA has trained 14,230 people in cybersecurity in two months.
Covid has started talking about establishing a great alliance between banks to jointly confront cyber attacks, an idea that has already been done in other parts of Europe. “In Spain we collaborate a lot at the operational level on a regular basis, always within the limits set by the legislation. We share information about threats and about the temperature of what is happening out there. But not only with other banks. We are present in many forums and we try to contact the entire ecosystem, including the state security forces and bodies, to have a complete photo of what is happening and to know where the attacks come from. We are happy with our collaboration with other companies, but there is always room for more. I think we are now on the path to expand that collaboration, ”explains Garrido.
These organized mafias are highly focused on specific attack vectors where they deploy all their power. These actors “are tremendously sophisticated in their organizational model and invest large sums in R&D and technical experts,” says this executive, adding that a new wave, the third, of cyberattack is already beginning to be perceived. “In it the impact is much more global and adds objectives such as destabilization or industrial espionage beyond a mere short-term financial interest.”
He explains that the legislation, depending on the country, penalizes physical robberies of branches more than a digital robbery. In addition, in many countries “we see how society is using less cash, therefore, we are seeing a gradual movement from physical to digital crime, but the situation depends a lot on each country,” he stresses.
The key to artificial intelligence
The criminals. Álvaro Garrido maintains that we can imagine “a future where criminals use artificial intelligence models to try to detect a bank’s weaknesses and automatically build tailored attacks. Or quantum computing that will decrypt the encryption algorithms with which transactions are currently protected. ”
Discipline. This expert explains that cybersecurity “is always surrounded by mystery, technology, hackers, information management, etc., and the reality is that it is that, but at the same time it is a very systematic discipline. It has a lot of process management, systematization in execution, risk assessment and prioritization and implementation of a very strict governance system ”.
–
–
–
