While we have seen good and improving practices across many financial services firms, we also have observed material weaknesses in basic management, including patching, that need to be addressed. There are widespread and fundamental issues across the industry on identifying, detecting and protecting against cybersecurity risks.
These flaws are matched by concerning deficiencies in the capability of firms to respond and recover from cybersecurity attacks. Together with the management of legacy infrastructure risks, this creates major change imperatives. Fortunately, in the case of the recent cybersecurity incident, no bank operating in Ireland was directly affected. Nonetheless, the threats are real and are increasing in complexity and potential impact.