The financial system’s weaknesses were abruptly laid bare. We observed, when push came to shove, how quickly banks’ inadequately small buffers were depleted, with many institutions requiring life support in the form of government assistance. It also became instantly clear that banks’ internal control systems were no match for the complexity and interconnected nature of the risks involved.
It is important that CISO is sufficiently senior in hierarchy; understands technology well; appreciates the security aspects of all the technologies adopted by the bank; is responsive and is sufficiently enabled to stall launch of unsecure products, whenever necessary. However, ground realities do not provide the needed comfort.