# Hiding in plain sight – Finance as Critical National Infrastructure
Author:  Pal Sinha, Barnali 
Author URL: https://financedigest.com/author/pal-sinha-barnali
Published: 2022-07-26
Category: FINANCE
Category URL: https://financedigest.com/category/finance
Meta Title: Protecting UK Finance: Risks to Critical National
Meta Description: Discover the latest cyber threats facing the UK's Critical National Infrastructure, with a focus on the finance sector. Learn how financial institutions can proactively protect against attacks.
URL: https://financedigest.com/hiding-in-plain-sight-finance-as-critical-national-infrastructurehtml

![undefined](https://prod.superblogcdn.com/site_cuid_cm5qst7v3003gwirgwqtxn8i8/images/istock-1266958849-1736815538844-compressed.jpg)

![](https://prod.superblogcdn.com/site_cuid_cm5qst7v3003gwirgwqtxn8i8/images/simon-mullis-1736815538783-compressed.jpg)

_By_ **_Simon Mullis,_** _Chief Technology Officer at_ [_Venari Security_](https://venarisecurity.com/)

The tense political climate means mounting cyber threats and increasing challenges to cyber defences– particularly with new methods of attack making it even harder to detect threats on their network. For critically important sectors in the UK including finance – known as the UK’s [Critical National Infrastructure](https://www.ncsc.gov.uk/section/private-sector-cni/cni) (CNI) – having a grip on the attacks that might be hiding in plain sight, such as threats sitting in encrypted traffic on the network, is vital.

The National Cyber Security Centre outlines 13 CNI sectors in the UK – defined as the critical systems, processes, people and information upholding UK infrastructure, the loss or compromise of which could have severe and widespread economic or social consequences as a result. While it’s our basic utilities, such keeping the lights on and the water running, that might immediately come to mind when thinking about critical infrastructure, the [finance sector comprises many organisations](https://www.financedigest.com/cyber-threats-for-finance-organisations-to-watch-in-2023.html "Cyber threats for finance organisations to watch in 2023") providing essential services too. From cash withdrawals and deposits, to digital wire transfers, loan applications and investments – citizens and [businesses rely on financial](https://www.financedigest.com/setting-the-pace-cognitive-financial-planning-and-analysis-for-business-agility.html "Setting the pace – Cognitive financial planning and analysis for business agility") interactions every day. The responsibility for banks and [financial institutions to maintain secure](https://www.financedigest.com/post-brexit-uk-workers-can-have-financial-security.html "Post Brexit – UK workers CAN have financial security") systems is huge, and the consequences for failing to do so even more significant.

But with attacks on CNI on the rise, how can [financial institutions](https://www.financedigest.com/3-ways-financial-institutionscan-leverage-live-engagement-on-social-media.html "3 ways financial institutions can leverage Live Engagement on social media") ensure they are doing everything possible to guard against them? Let’s explore what some of the risks to CNI include, and how the [finance sector](https://www.financedigest.com/finance-is-the-next-big-sector-to-be-ubered.html "Finance is the next big sector to be Uber’ed") specifically can be proactive in protecting its customers, their data, and overall trust in its institutions.

**The consequences of CNI attacks**

One of the most recent high-profile CNI attacks that the [finance industry must](https://www.financedigest.com/2019-year-must-re-build-public-trust-finance.html "2019 is the year we must re-build public trust in finance") analyse and ensure is guarding against is the Colonial Pipeline ransomware incident, which took place in May 2021. The pipeline operator reported that a cyberattack had forced the company to [temporarily shut](https://www.financedigest.com/exclusive-kazakh-mcdonalds-shut-outlets-temporarily-after-halting-supplies-from-russia-sources.html "Exclusive-Kazakh McDonald’s shut outlets temporarily after halting supplies from Russia – sources") down all business functions.

What is particularly significant about this attack is that it was simply an exposed username/password that allowed the attackers to gain access. Once in, their activity was end-to-end encrypted – [_just like all the other traffic_ style=”font-weight: 400;”>. Vast swathes of the US were affected – with 45% of the East Coast’s fuel operations halted as a result.](https://www.financedigest.com/traffic-management-systems-growing-at-a-cagr-of-22-5-for-2022-28.html "Traffic Management Systems growing at a CAGR of 22.5% for 2022 – 28")

 [Traffic Management Systems growing at a CAGR of 22.5% for 2022 – 28](https://www.financedigest.com/traffic-management-systems-growing-at-a-cagr-of-22-5-for-2022-28.html "Traffic Management Systems growing at a CAGR of 22.5% for 2022 – 28")

[In this case, despite the](https://www.financedigest.com/traffic-management-systems-growing-at-a-cagr-of-22-5-for-2022-28.html "Traffic Management Systems growing at a CAGR of 22.5% for 2022 – 28") [organisation protecting](https://www.financedigest.com/protect-your-organisation-from-fraud.html "Protect your organisation from fraud") its data with strong encryption standards, attackers were able to enter the network through a legitimate, encrypted path and thus rendered many of the counter measures ineffective. With the [operators unaware of any anomalous activity on their networks](https://www.financedigest.com/how-can-network-operators-monetise-television-quickly-and-effectively.html "How can network operators monetise television quickly and effectively?"), the intruders had all the time they needed to assess the system and get organised.

This presents a dilemma for CNI sectors, especially finance, where interactions and operations have to be encrypted.

**The issues with relying on encryption**

As happened in the Colonial Pipeline incident, the use of end-to-end encryption enabled attackers to conceal themselves in legitimate traffic.  While [critical to support](https://www.financedigest.com/keysource-to-provide-critical-facilitiesmanagement-support-for-leeds-city-council.html "KEYSOURCE TO PROVIDE CRITICAL FACILITIESMANAGEMENT SUPPORT FOR LEEDS CITY COUNCIL") data privacy and security in the event of breaches, end-to-end encryption renders many established means of detection ineffective.

Most defence methods still rely heavily on decryption and relatively rudimentary [analysis to detect when traffic might be “known-bad” or deviating from expected](https://www.financedigest.com/analysis-china-property-financing-tweaks-fall-short-of-investor-expectations.html "Analysis-China property financing tweaks fall short of investor expectations") patterns. The volume and speed of encrypted data now passing across [networks means that it is impossible to detect](https://www.financedigest.com/closing-the-door-before-the-horse-bolts-developing-a-proactive-network-detection-and-response-ndr-strategy.html "Closing the door before the horse bolts: Developing a proactive network detection and response (NDR) strategy ") everything with processes and techniques requiring this type of inspection.

And indeed, this is not a cutting-edge approach by cybercriminals. [In the first three quarters of 2021 alone, threats over encrypted channels increased by 314% on the previous year](https://www.zscaler.com/press/zscalers-2021-encrypted-attacks-report-reveals-314-percent-spike-https-threats). If [organisations continue to use the same inadequate detection techniques to uncover malicious activity on their network](https://www.financedigest.com/6-steps-to-organising-an-introvert-friendly-networking-event.html "6 Steps to organising an introvert-friendly networking event "), the rate of attacks using encrypted traffic will continue to grow at this rate or higher.

The [security industry](https://www.financedigest.com/application-security-in-the-finance-industry-what-you-should-know.html "Application Security in the Finance Industry: What You Should Know") has long understood that breaches are “not if, but when” scenarios. And the current [global climate](https://www.financedigest.com/global-climate-talks-open-to-cries-of-betrayal-blame.html "Global climate talks open to cries of betrayal, blame"), sparking a rise in nation-state attacks, undoubtedly increases the threat level further for CNI – and especially for sensitive sectors such as finance.

**Better visibility** [holds the key](https://www.financedigest.com/ai-holds-the-key-for-both-competitive-advantage-and-risk-mitigation-in-2022.html "AI holds the key for both competitive advantage and risk mitigation in 2022")

[Financial institutions must strike a careful balance when it comes to security](https://www.financedigest.com/5-steps-to-strengthening-your-online-financial-security.html "5 Steps to Strengthening Your Online Financial Security"). On the one hand, it is vital they gain back visibility of their networks that end-to-end encryption might be at risk of concealing; on the other, it’s a necessity that they maintain a level of encryption in the first place.

Decryption is a too cumbersome and time-consuming approach now that our entire networks are encrypted – both data-at-rest and in motion – and organisations can only [hope to keep](https://www.financedigest.com/sas-bridge-financing-keeps-survival-hopes-airborne-shares-climb.html "SAS bridge financing keeps survival hopes airborne, shares climb") up if they monitor for aberrant behaviour and malicious activity in their traffic without having to rely on decryption.

The solution? Security teams [need to look towards using behavioural analytics to detect what is happening](https://www.financedigest.com/what-needs-to-happen-to-improve-the-landscape-for-smes-trying-to-access-finance-options-in-the-uk.html "What needs to happen to improve the landscape for SMEs trying to access finance options in the UK") within encrypted traffic flows. A combination of [machine learning and artificial intelligence](https://www.financedigest.com/transforming-insurance-through-artificial-intelligence-and-machine-learning.html "Transforming Insurance Through Artificial Intelligence and Machine Learning"), behavioural analytics can analyse encrypted traffic in near real-time without decryption. By accurately understanding the abnormalities between normal and anomalous behaviour, it significantly increases the rate and speed at which malicious activity concealed in encrypted traffic can be detected, whilst ensuring [data remains](https://www.financedigest.com/european-bourses-steady-as-focus-remains-on-key-economic-data.html "European bourses steady as focus remains on key economic data") private.

Security teams can then react immediately to contain the threats it identifies – rather than responding after the fact, when [banks might only realise that an attack](https://www.financedigest.com/attacking-banking-and-fintech-fraud-head-on-through-ai-infused-strategies.html "Attacking Banking and Fintech Fraud Head-On Through AI-Infused Strategies ") has taken place after a customer has experienced a breach.

**Keeping a critical eye on** [finance security](https://www.financedigest.com/top-fintech-trends-for-2021-enabling-smart-and-secure-finance.html "Top Fintech Trends for 2021 Enabling Smart and Secure Finance")

Ongoing geo-political conflicts and the ever-increasing interconnectedness of all [things mean](https://www.financedigest.com/the-bank-of-things-bot-has-arrived-but-what-does-it-mean-for-banks-2.html "The Bank of Things (BoT) Has Arrived: But What Does It Mean for Banks?") that attacks to critical infrastructure are hardly likely to go away, but in fact, become more frequent.

[Financial services](https://www.financedigest.com/4-ways-high-performance-analytics-powers-financial-services.html "4 ways high-performance analytics powers financial services") sit as an obvious target, meaning security teams need to quickly wake up to the reality that the threat isn’t just incoming, but that there may already be malevolent presences on their network already concealed within encrypted traffic. And the longer they wait to identify it, the greater [risk it poses](https://www.financedigest.com/omicron-poses-very-high-risk-but-data-on-severity-limited.html "Omicron poses ‘very high’ risk but data on severity limited") when the actor decides to strike.


---
This blog is powered by Superblog. Visit https://superblog.ai to know more.
---