This is a pre-event interview in the run-up to the Leaders in Finance Cyber Security Event on May 23, 2024.
Jeroen: First of all, Beate Zwijnenberg, Chief Information Security Officer at ING Group, thank you for joining us today to talk to Leaders in Finance ahead of the upcoming Leaders in Finance Cyber Security Event on May 23rd. Before we start, could you introduce yourself?
Beate: Certainly. I’m Beate, and I’ve been with ING for a considerable time, in this particular role for the past six years. Before this position, I focused on fraud management within ING, primarily on the customer side. Throughout my career, I have been involved in diverse areas such as product management, operations, and program & change management. Additionally, I am a on the board of FS-ISAC, a non-profit organization that advances cybersecurity and resilience in the global financial system, protecting financial institutions and the individuals they serve. Outside of work, I reside in Amsterdam with my family, enjoying the vibrant atmosphere of this beautiful city.
Jeroen: That is an excellent introduction, Beate, covering both your professional and personal aspects. Could you mention a couple of aspects of your job that you particularly enjoy?
Beate: Absolutely. I really appreciate working with my team, especially engaging with specialists and experts in various domains. I find our discussions on new developments and emerging threats particularly stimulating. Moreover, the dynamic nature of cybersecurity presents constant challenges that require problem-solving skills. I appreciate the balance between addressing immediate issues and strategizing for the long term.
Jeroen: It sounds like a stimulating role indeed. Considering the broader landscape of cybersecurity and its implications for financial institutions, what do you see as the major challenges, both for yourself and the industry at large?
Beate: Currently, we face several challenges. The evolving threat landscape, with an increase in ransomware attacks, the actors behind it being very resilient. Geopolitical uncertainties further accelerate the risk of disruption. Additionally, the high number of vulnerabilities, coupled with accelerated exploitation, underlines the need for swift action. We must speed up our game. Supply chain attacks and third-party compromises have also become more prevalent, warranting increased alertness. Also, when you look at DORA there is more focus on a risk based approach, supply chains and third parties. Threats of cyber and ransomware caught the attention of regulators, as well as that of senior managers and boards. Balancing the need for education and awareness with resource constraints poses a further challenge.
Jeroen: Indeed, lots of challenges. You mentioned supply chain concerns, emphasizing the importance of getting the attention of and setting quality standards of all the other players in the supply chain. Is it a lot about communication and making sure you work with the right partners?
Beate: Certainly. Selecting and working with the right partners but also maintaining oversight throughout the engagement in a specific manner is important. That takes time. Regular communication and monitoring are essential to ensure alignment with security standards and prompt action in response to any deficiencies. You must accept that it is not perfect right away. When it is unacceptable, you must act. It is crucial to get a balance between trust and accountability, addressing vulnerabilities promptly while allowing partners time to improve their security posture.
Jeroen: The nature of cybersecurity is that a lot of things you do are simply not publicly shared. Could you still share an example of a significant incident or trend from last year that particularly concerned you?
Beate: One notable incident was the ransomware attack on the New York branch of ICBC, which had broader implications for financial services beyond the targeted institution. While the direct impact on the trading market was limited, it gave insight to what might happen if a different organization had been targeted. Additionally, the persistent targeting of major tech firms, such as Microsoft, is really a concern and highlights ongoing threats. From that perspective I think it is here to stay, and we need to get used to it. What should Microsoft do differently from their perspective as they are the big cloud provider? All the financial institutions rely on them.
Jeroen: Thank you for providing those insights. Moving on to technology, there is much discussion about its dual role in cybersecurity. Could you highlight technologies that pose challenges for financial institutions, as well as those offering promising solutions maybe for a young generation also outside the financial sector?
Beate: Artificial intelligence (AI) stands out in this regard, presenting both opportunities and challenges. It is hip and trendy. But AI is used for good and bad purposes, deep fake being the latter one. On the other hand, AI-powered tools enhance threat detection and risk assessment capabilities, facilitating proactive defenses. So, there is a positive side to it, for instance, faster detecting attacks or malicious code.
Jeroen: When you talk about developing AI, is it solely for ING Group or is this AI working in close cooperation with others?
Beate: It is both. We are already using quite a few models ourselves on top of our detection capabilities using different data sources. But of course, all the vendors like Microsoft and Google have solutions where AI is embedded in their products which you can use in the security field as well.
This is a pre-event interview in the run-up to the Leaders in Finance Cyber Security Event on May 23, 2024.