According to cybersecurity experts, the WannaCry ransomware attack in May was "brilliantly written" but poorly executed. And like Commander Ramius said after a failed torpedo attack in "The Hunt for Red October," perpetrators "won't make the same mistake twice."
On the contrary, attackers are sharpening their blades.
Unlike the early days of cyberattacks — a mere five years ago — when firms focused on preventing mostly inconvenient software viruses, today's attacks set off severely damaging repercussions, including extortion, fraudulent wire transfers and the theft or sale of personally identifiable information. Regulators and cyber experts cite an increase in the number and severity of cyber crimes and say this trend may continue.
"Every financial business with employees and clients — which is to say every financial services firm — needs to be aware that WannaCry is just a symptom of a much bigger scourge," agrees Michael Brice, founder of cybersecurity consultancy BW Cyber Services, which recently partnered with my firm. "We expect to see far more attacks that will be far worse."
Some cyber events are existential threats that can close a business overnight. Last year, for instance, a cyberattack against one of the world's largest fund administrators resulted in a series of fraudulent wire transfers that cost a commodity pool operator (CPO) nearly $6 million in assets. This resulted in a suspension of business from which the CPO was unable to recover. The CPO and administrator are in protracted litigation, the former purportedly faulting the latter for insufficient cyber controls.
As indicated in their 2017 Priority Letters, both the Securities and Exchange Commission and Financial Industry Regulatory Authority have made cyber security a top enforcement priority this year.
