Tag: cybersecurity
Welcome New Member – Abid Malik from Dubai
Please welcome our newest member from Dubai, Abid Malik! Abid Malik isn’t just a GRC and cybersecurity advisor—he’s a strategist who turns risk management into business opportunities. With 20+ years of experience across banking, fintech, and multinational sectors, he helps businesses strengthen security, navigate regulations, …
“What Happens to Heroes?” – EPISODE #1: The Unsung Heroes of the Digital World by Didier Annet
The Psychological Impacts of Cyberattacks
This is the first episode of a story related to individuals who, in a matter of moments, transition from “employees” to “rescuers” in the immediate aftermath of a destructive cyberattack.
What I Will Call the “Heroes”
But what is a Hero in the context of a cyberattack? And why should it matter to us or the company?
Generally speaking, the definition of a Hero that could match what we speak about is:
“A real person or fictional character who, in the face of danger, combats adversity through feats of ingenuity, courage, or strength.”
Protecting sensitive information has emerged as a pivotal concern for businesses across various industries. The ability to efficiently safeguard crucial data is now a decisive factor in achieving long-term success. It’s an endless battle, pitting skilled hackers against savvy security experts. The attackers are constantly adapting their tactics, always staying one step ahead. In contrast, security professionals must navigate increasingly complex corporate defense systems, where compromises are often inevitable. This relentless pressure has led to alarming rates of stress and burnout among IT teams dedicated to cybersecurity.
Despite their best efforts, hackers’ attacks can sometimes be successful, leading to system failures and data loss. The company then enters a crisis management mode often described as ‘war’ mode. Those managing these crises often employ language evocative of war, suggesting a fight for the company’s survival and the preservation of jobs.
In the immediate aftermath of the crisis, the company’s survival hinges on a select group of individuals who swiftly transform from regular employees into rescuers. These remarkable Heroes work relentlessly under immense pressure and stress, often for days or even weeks, with a singular focus: to prevent the company’s collapse and safeguard their colleagues’ jobs. Their dedication and tireless efforts are crucial in stabilizing the situation, ensuring that the company remains operational and that their fellow employees do not face the threat of unemployment.
Fortunately, most rescue efforts are successful, though they may take time and only partially resolve the issues. However, a more prolonged and lesser-known struggle continues, as the affected computer networks must undergo extensive cleanup and restoration while their security measures are strengthened.
Those who are hailed as heroes often face challenges adapting to their new reality, feeling misunderstood and overlooked despite their significant accomplishments. They fluctuate between feelings of frustration and neglect. Several months later, a cyberattack sparks a new round of consequences, this time directly impacting people’s well-being. Overlooked, fatigued, overburdened, and sick, these heroes may be at risk of burning out.
This Is the Fall of Heroes
The fact that these people are sick, unmotivated, or even leaving the company will inevitably have a negative impact on managing corrective measures after the crisis. While external consultants or new employees may fill the void left by these absences, the loss of knowledge will still result in collateral damage due to the lack of expertise and institutional memory.
Stay Tuned for the Next Episode
And don’t forget:
“Cyberattacks are like mosquitoes: you don’t see them coming, but they can ruin your night (and your data)!”
“And some, like tiger mosquitoes, can even ruin your life …”
About the Author
Didier Annet is an Operational & Data Resilience Specialist and a Certified Professional Coach dedicated to empowering individuals and teams to navigate the complexities of an ever-changing digital landscape.
Find him on LinkedIn: Didier Annet
Learn more in his book:
📖 Guide de survie aux cyberattaques en entreprise et à leurs conséquences psychologiques: Que fait-on des Héros ? (French Edition) – Available on Amazon
Coming soon: The English version – “What Happens to Heroes”
Cyber (In)Securities – Issue 131
Information Security News EU Looks to Tech Sovereignty with EuroStack Amid Trade War Biometric Update by Masha BorakThe European Union is making significant strides towards tech sovereignty with the development of EuroStack, a comprehensive technology initiative aimed at reducing dependence on foreign tech giants amid …
Cyber (In)Securities – Issue 130
Information Security News House Passes Bill Requiring Federal Contractors to Implement Vulnerability Disclosure Policies SecurityWeek by Eduard KovacsThe U.S. House of Representatives has recently passed a bill that mandates federal contractors to establish vulnerability disclosure policies. This legislative move aims to strengthen the security of …
The Cost of Silence: Enhancing Cyber Safety to Address Domestic Violence’s Impact on Women’s Employment and Education
Last Friday, I attended the launch of The Cost of Domestic Violence to Women’s Employment and Education at the University of Technology Sydney. Written by the renowned researcher and writer Anne Summers, this report lays bare how domestic violence and coercive control disrupts women’s financial independence and long-term security.
The event also featured a dynamic Q&A with Jess Hill, journalist, author, activist and advocate extraordinaire, whose expertise in domestic violence issues added depth to the discussion, highlighting the need for systemic change.
As I sat in the standing-room-only audience, one question kept running through my mind:
What tangible steps must institutions take to ensure they don’t just acknowledge this crisis, but actively intervene?
Expert Insights on a Pressing Issue
Anne delivered a keynote exposing the economic toll of domestic violence, showing how abuse limits women’s access to employment and education. Jess’s insightful questions deepened the conversation, stressing the urgent need for systemic change.
Their discussion underscored a chilling reality: leaving isn’t just about physical safety—it’s about digital and economic safety, too. If an abuser can still track a survivor through hacked accounts or control their finances, they remain trapped.
The Hard Numbers: What the Report Reveals
The report’s findings confirm what many survivors already know: domestic violence locks women out of economic independence.
- Employment Disruption: Women who have experienced domestic violence have an employment rate 5.3 percentage points lower than those who haven’t. Financial abuse and coercive control further limit their ability to secure stable income.
- Education as Collateral Damage: Many women are forced to abandon their studies due to abuse, further limiting their economic independence. The report shows that women who have experienced domestic violence are significantly less likely to complete a university degree than those who haven’t. This education gap widens throughout their 20s, and by age 25, survivors are 15% less likely to have attained a university degree. These disparities have lifelong consequences, restricting career opportunities and financial security.
- Coercive Control and Digital Surveillance: A growing number of abusers use technology-facilitated coercion to monitor, intimidate, and restrict their partners—from tracking apps and spyware to financial control and hacked accounts.
The report makes it clear: economic security is one of the biggest barriers to escaping domestic violence. And if institutions don’t take proactive steps, they are complicit in maintaining the status quo.
The Crucial Role of End-to-End Encryption
As we contemplate these challenges, the critical role of cybersecurity—particularly end-to-end encryption—becomes glaringly apparent.
Survivors of coercive control often face digital surveillance, forced account access, and online monitoring, making encryption not just a cybersecurity measure, but a life-saving tool.
Institutions must prioritise encryption in their digital safety initiatives, ensuring that survivors can:
✔️ Access support services securely, without fear of being monitored.
✔️ Communicate with legal, financial, and mental health services safely.
✔️ Regain digital autonomy in a world where abusers increasingly weaponise technology.
Survivors don’t just need protection—they need secure autonomy over their communications, finances, and digital lives.
Reflections on Actionable Solutions
This isn’t just about awareness—it’s about action. Institutions that claim to support women must walk the walk, not just talk the talk.
Here are five practical, immediately implementable steps that workplaces, universities, and unions must take to proactively combat domestic violence and coercive control:
1️⃣ Establishment of Digital Safety Clinics
Universities, workplaces, and unions should collaborate to offer regular digital safety check-ins where individuals can:
✔️ Secure their devices from tracking apps and spyware.
✔️ Review and strengthen privacy settings on work and personal accounts.
✔️ Learn about secure communication tools, like end-to-end encrypted messaging, to protect themselves from cyberstalking and coercive control.
✔️ Understand the warning signs of digital surveillance and how to respond.
Every institution must commit to making digital security a non-negotiable right. These clinics must be practical, confidential, and institutionally backed, providing survivors with the immediate tools to secure their digital independence.
2️⃣ Comprehensive Support Systems That Recognise Coercive Control
Support systems must go beyond the basics. Many institutions offer Employee Assistance Programs (EAPs) or generic counselling services, but few are tailored for survivors of coercive control. Institutions must provide:
✔️ Specialist legal assistance for women navigating financial and digital abuse.
✔️ Psychological support that understands the long-term impact of coercive control.
✔️ Emergency interventions that provide real, tangible pathways out—including financial assistance and secure housing options.
It is no longer enough to say “help is available”. That help must be structured in a way that makes it truly accessible to women facing complex, tech-enabled abuse.
3️⃣ Policy Overhaul: From Compliance to Survivor-First Protections
Policies that react to incidents are no longer enough. Institutions must proactively design out the loopholes that abusers exploit. This means:
✔️ Regular compliance reviews to ensure policies account for coercive control tactics, not just physical abuse.
✔️ Ensuring data-sharing policies protect survivors, preventing abusers from exploiting privacy loopholes.
✔️ Flagging high-risk patterns—such as repeated password resets or location-sharing updates—just as financial institutions flag fraud.
4️⃣ Training and Awareness: Recognising the Signs of Domestic Violence and Coercive Control
Workplaces, universities, and unions must actively train staff, leaders, and support teams to recognise the warning signs of both domestic violence (DV) and coercive control (CC). Abuse doesn’t always leave bruises—digital surveillance, financial restrictions, and psychological manipulation can be just as damaging.
5️⃣ Unions as Advocates for Digital and Workplace Protections
Unions have historically played a key role in advocating for workplace protections. This must now extend to digital safety and coercive control awareness. They should:
✔️ Ensure workplace policies account for DV and CC protections, including digital abuse considerations.
✔️ Push for survivor-first employment policies—allowing employees to change work emails, request payroll confidentiality, or flag an abuser’s interference.
✔️ Advocate for institutional commitments to survivor support, ensuring that affected employees and students are not left vulnerable.
The Time is Now to Act
This report isn’t just another study—it’s a wake-up call.
It’s not enough for institutions to acknowledge this crisis. They must act. Policies must be rewritten. Digital security must be prioritised. Support must be proactive, not reactive.
The cost of silence is too high. Inaction is complicity.
We have the tools. The only question is—do we have the will to use them?
📖 Read the full report here: The Cost of Domestic Violence to Women’s Employment and Education
About the Author:
Kim Chandler McDonald is the Co-Founder and CEO of 3 Steps Data, driving data/digital governance solutions. She is the Global VP of CyAN, an award-winning author, storyteller, and advocate for cybersecurity, digital sovereignty, compliance, governance, and end-user empowerment.
Cyber (In)Securities – Issue 129
Information Security News Latin American Orgs Face 40% More Attacks Than Global Average Dark Reading by Nate NelsonOrganisations in Latin America are experiencing a surge in cyberattacks, facing 40% more incidents than the global average. This alarming trend underscores the unique cybersecurity challenges in the …
Cybersecurity Investments in Global Banking: Comparative Analysis and Case Studies
Scope and (many) Limitations
It is essential to clarify from the outset that this analysis does not seek to establish a direct correlation between cybersecurity expenditure and measurable security outcomes, such as the successful mitigation of cyber threats or financial savings resulting from reduced attack impact. While investment in cybersecurity is a necessary component of a robust defence strategy, the complexity of cyber risk, evolving threat landscapes, and the multifaceted nature of security effectiveness preclude any straightforward causal relationship between financial allocation and security success. This study, therefore, focuses on the strategic prioritisation of cybersecurity investment within financial institutions rather than attempting to quantify its direct operational efficacy.
Furthermore, it is important to note that the financial data presented reflects cybersecurity spending over a multi-year period, albeit one from several years ago. Given that this analysis is conducted in 2025, some figures may not fully capture more recent investment trends, emerging security technologies, or shifts in cyber risk exposure. While historical data provides valuable insight into spending patterns and institutional priorities, it does not necessarily indicate present or future financial commitments.
A subsequent analysis will seek to explore potential correlations between cybersecurity investment and key security outcomes, leveraging publicly accessible data where possible. This follow-up study will critically assess available metrics—such as breach frequency, regulatory penalties, and operational resilience—to determine whether any discernible patterns emerge between financial commitment to cybersecurity and real-world security performance. However, given the inherent challenges of isolating variables in this domain, findings will be framed within the limitations of available data, temporal gaps in financial reporting, and broader contextual industry factors.
Financial Comparisons Across a Handful of Major Banks
Major global banks have dramatically increased their cybersecurity investments in the past five years, both in absolute spending and as a share of IT budgets. Table 1 below compares cybersecurity spending for several top banks (by assets) in 2018 vs. 2022, illustrating these trends. North American banks show some of the highest absolute cyber budgets (hundreds of millions of USD annually), while European banks tend to allocate a slightly higher percentage of their IT budget to security. Asia-Pacific banks historically spent less on cybersecurity (contributing to higher vulnerability rates in that region (Low investments in cybersecurity expose financial sector to threats: Experts – The Economic Times), but are now rapidly ramping up investments as cyber threats intensify globally.
Table 1. Cybersecurity Budget Trends at Selected Major Banks (2018–2022) (link here)
Regional Case Studies
Detailed case studies from different regions demonstrate how major banks are implementing significant cybersecurity initiatives. These examples show how banks tailor their cyber strategies to address region-specific threats and comply with local regulations, while investing heavily to bolster resilience.
North America: JPMorgan Chase & Co.
JPMorganChase, the largest U.S. bank by assets, has made cybersecurity a centerpiece of its technology strategy. In 2019, the bank spent roughly $600 million annually on cybersecurity and employs about 3,000 cybersecurity personnel (With $600 Million Cybersecurity Budget, JPMorgan Chief Endorses AI and Cloud – SecurityWeek). For perspective, this budget was a dramatic increase from preceding years (the bank’s cyber spend doubled from $250 million to $500 million in the mid-2010s (2018 Cybersecurity Market Report), reaching ~$600 million by 2019). JPMorgan’s CEO Jamie Dimon identified cyber risk as perhaps “the biggest threat to the U.S. financial system” (With $600 Million Cybersecurity Budget, JPMorgan Chief Endorses AI and Cloud – SecurityWeek), underscoring why the bank continues to pour resources into cyber defence. JPMorgan’s initiatives focus on advanced capabilities like artificial intelligence and cloud security. Again in 2019, Dimon endorsed a move “all in” on cloud and AI to enhance security, noting the cloud can improve resiliency and scale defenses.
Fast forward to 2024, and JPMorgan’s situation was laid bare by CEO JPM’s Asset Management & Wealth Mary Callahan Erdoes:
Hard numbers on the above were stated during the conference as: $15bn annual technology spend with 62,000 technologists, many of whom were/are focused on cyber specifically.
The firm has built multi-layered defenses and real-time monitoring to handle everything from routine fraud attempts to advanced nation-state threats. U.S. regulatory expectations (from bodies like the FFIEC and New York State DFS) and industry collaboration via the Financial Services Information Sharing and Analysis Center (FS-ISAC) have further driven JPMorgan’s strategy. The bank regularly works with government and industry partners to share threat intelligence and bolster critical infrastructure protection.
Europe: HSBC Holdings plc
HSBC, one of Europe’s largest banks (with a global footprint concentrated in Europe and Asia), has likewise made robust cybersecurity investments and adaptations. HSBC’s annual cybersecurity spending is estimated in the hundreds of millions (USD) – on the order of $600–750 million per year in recent years (Financial Firms Spend Up to $3,000 Per Employee on Cybersecurity). This forms a significant portion of HSBC’s roughly $6 billion overall technology budget (approaching ~10% allocated to security). HSBC’s approach to cybersecurity is heavily influenced by the cross-border regulatory landscape and evolving threats in its key markets. European regulations (think the EU’s General Data Protection Regulation (GDPR) and the PSD2 directive (mandating strong customer authentication)) have pushed banks like HSBC to achieve high standards in data security and fraud prevention. Additionally, EU supervisors (e.g. the European Central Bank) now ask banks for detailed cyber resilience metrics (such as dedicated security staffing) to ensure preparedness (THE CHALLENGE OF ORGANIZING THE BUDGETARY MANAGEMENT OF CYBERSECURITY IN YOUR COMPANY – RiskInsight).
In response, HSBC announced a series of security initiatives to stay ahead of emerging threats. For example, in 2023, HSBC announced that it had become the first bank in the UK to trial quantum cryptography for network security, partnering with BT Group and Toshiba to pilot Quantum Key Distribution for encrypting data between its London data centres (We’re fighting the cyber criminals of the future | HSBC News).
This quote is from former CEO of HSBC Europe, Colin Bell, who highlighted HSBC’s proactive stance on next-generation security. HSBC also continually upgrades more immediate defences: the bank processes 4.5 billion payments a year, and it relies on encryption and real-time threat monitoring to protect those transactions.
Asia-Pacific: DBS Bank (Singapore)
In the Asia-Pacific region, DBS Bank provides a case study in integrating cybersecurity deeply into a digital transformation strategy. DBS is a leading Singapore-based bank operating across Asia, and it has been recognised as one of the world’s most technologically advanced banks. With this digital focus, DBS’s leadership is acutely aware that cyber risk comes hand-in-hand with innovation. A quote from Seng Wei Keng in this FS-ISAC piece sets the tone nicely:
DBS has implemented a multi-layer “onion” security architecture to defend its systems (DBS’ Piyush Gupta explains how the bank deals with digital trust in an era of deep fakes and misinformation – CNA). According to CEO Piyush Gupta, DBS operates under the assumption that some attackers will penetrate outer defences, so the bank emphasises in-depth measures and internal monitoring to limit any potential damage. This includes extensive use of techniques like micro-segmentation of networks, behavioural analytics, and AI-driven anomaly detection to quickly identify and isolate threats. DBS also contracts specialised cybersecurity firms to scour the dark web for any signs of attacks targeting the bank or brand, enabling rapid takedowns of phishing sites and fake domains. These initiatives have earned DBS recognition; it was the first bank to implement an innovative “digital soft token” mobile authenticator (with a money-back security guarantee for customers) and won the regional Cybersecurity Award in 2019 for its security excellence (DBS: On Becoming the Wizard of Digital Transformation).
Regional regulations and threat trends shape DBS’s cyber strategy as well. Singapore’s regulator, the Monetary Authority of Singapore (MAS), imposes stringent Technology Risk Management guidelines, requiring banks to maintain strong cyber governance and report incidents within hours. DBS not only complies but often exceeds these requirements, serving as an industry leader in implementation of measures like secure API frameworks and zero-trust principles. Asia-Pacific has become the most targeted region for cyberattacks globally (31% of all reported cyber incidents in 2022, for example, were in APAC) (Top Cybersecurity Statistics for 2024 | Cobalt), so banks like DBS have had to rapidly elevate their defences. The bank’s investments in cybersecurity have grown annually (while exact figures aren’t public, DBS’s overall tech spending is substantial, and a healthy fraction is devoted to security efforts). By leveraging its tech-forward culture and complying with forward-looking initiatives (for example, MAS’s 2024 quantum-resilience trials with banks (MAS to commence quantum-proofing cybersecurity trials with banks …)), DBS adapts to the region’s unique challenges.
Executive Quotes on Cybersecurity Investments
Leaving the reader with these quotes gives you a sense – at least on paper and in front of the press mic – of the seriousness with which bank executives are taking the cyber threat. Leading banking executives have explicitly underscored the importance of proactive cybersecurity investment and strategy – and it’s clear that the spend, both in total volume and as a percentage of IT spend – supports their intuitions. Whilst data are sometimes a bit hard to nail down, what’s clear is that major banks, globally, are spending with vigour. (How effective spend is in reducing loss from cyber attacks is a topic for another article, although successes like that of DBS, for example, suggest risk and impact can be managed well.)
Below are selected quotes from CEOs and board-level leaders at major banks over the past years, highlighting their perspectives on cyber initiatives and commitment:
- Brian Moynihan (CEO, Bank of America): “I go to bed every night feeling comfortable that [our cybersecurity] group has all the money, because they never have to ask… You’ve got to be willing to do what it takes at this point.” (Making the Right Investment in Cybersecurity | Bank Director – thank you Emily McCormick for the nod to the quote drawn from a 2015 interview with Bloomberg in which Moynihan 2015 described giving “unlimited” budget to cybersecurity, reflecting an open-ended commitment to cyber defence. *And that was 2015!
- Jamie Dimon (CEO, JPMorgan Chase): “Cybersecurity…may very well be the biggest threat to the U.S. financial system,” he warned, while noting the growing mobilisation of industry and government to combat it (With $600 Million Cybersecurity Budget, JPMorgan Chief Endorses AI and Cloud – SecurityWeek).
- Colin Bell (CEO, HSBC Bank plc & HSBC Europe): “Our customers, clients and employees expect us to have safe and secure operations and resilient cybersecurity, so we must stay ahead of the curve… That’s why we’re already preparing our global operations for a quantum future. We’re…investing in strong, strategic partnerships to explore how we could deploy these technologies as they develop.” (We’re fighting the cyber criminals of the future | HSBC News) (Emphasising a forward-looking investment in next-generation security technologies at HSBC.)
- Piyush Gupta (CEO, DBS Bank): “Security is paramount today… There are not only state actors, but large criminal syndicates, who are always trying to get in.” (DBS’ Piyush Gupta explains how the bank deals with digital trust in an era of deep fakes and misinformation – CNA) Gupta has also noted that he operates under a “not if, but when” assumption regarding attacks, using that mindset to drive continuous investment in layered security measures. This philosophy highlights a strategic shift to persistent vigilance and resilience in cybersecurity.
Next I’ll attempt to articulate the impact of this spend…
About the Author
Nick Kelly | SecureFlag | CyAN Member
Website: www.secureflag.com
LinkedIn: Nick Kelly
Dynamic Resilience: A Framework for Synergizing Operational Agility and Economic Security in the Era of Digital Transformation by Rupesh Shirke
Abstract In today’s rapidly evolving digital landscape, organizations face unprecedented challenges that necessitate establishing a robust framework to navigate operational agility and economic security. This document delves into dynamic resilience, harmoniously integrating these vital components to foster sustainable growth, adaptability, and long-term success. Through a …