Security, Bookmarked: Finance (Sponsored Content)

JF Legault (0:02)

We can go back to a quote from the depression-era bank robber Willie Sutton. He had this infamous quote that said, like, I rob banks because that's where the money is.

Kate Fazzini (0:11)

Old-fashioned bank heists aren't so common today, but modern financial institutions protect more than just money. And finance is consistently in the top three most targeted industries when it comes to cyber attacks.

JF Legault (0:23)

There's accounts, but there's also a lot of strategic information with regards to transactions and the likes. And that's what continues to make financial institutions a target for this.

Kate Fazzini (0:37)

That's JF Legault.

JF Legault (0:38)

I'm Deputy Chief Information Security Officer at JP. Morgan Chase.

Kate Fazzini (0:42)

As a leader of cybersecurity operations for the bank and its clients, JF thinks constantly about every opportunity that an attacker could exploit, from software bugs to natural disasters.

JF Legault (0:53)

Whether the scenario be a technology outage, whether it be weather, a threat actor could use that as a lure. We've actually seen, you know, like fake donation sites when there's a natural disaster, right, where people are looking to donate to earthquake relief or hurricane relief. The bad guys are there.

Kate Fazzini (1:14)

And by setting up fake disaster relief websites, the bad guys can harvest any credentials that come with those well-meaning donations. This is just one scenario in a bigger trend that JF's seeing, where cyber attackers set traps to compromise team accounts.

JF Legault (1:28)

We're seeing more and more threat actors using search engine optimization to present fake websites when somebody's doing an online search. The website will come up at the top versus the legitimate one they're looking for, and then they get the ability to deliver malicious software. So that's like a really interesting trend that people should think about. We used to train people to look for phishing based on grammar and urgency and things like that. That's changing.

Kate Fazzini (2:02)

Phishing and browser-based attacks are evolving to catch us where we spend our money, our attention, and our working hours. As work itself happens more consistently in web browsers, JF sees the role of a cybersecurity leader evolving too.

JF Legault (2:16)

I've been doing this for 25 years now. That overall evolution, and we used to call it computer security, network security, was very infrastructure focused. And then there was a evolution to information security. You know, when I look at the role today, a lot of it, and most of it, is really how do you secure a business? And I think that's where strong cybersecurity leaders are evolving towards, is like, how do you interface with your business? How do you understand the practices?

There's an evolution in a variety of technologies that help bad guys sell. You also need to adapt based on the evolution of just the world.

Kate Fazzini (3:02)

From Bloomberg Media Studios and Chrome Enterprise, this is Security Bookmarked. I'm your host, Kate Fazzini. I've been a cybersecurity professional and journalist for over 20 years, and on this podcast, I'm talking with leaders in gaming, finance and manufacturing about what security looks like in a workplace that's moved to the cloud. Much of what we think of as cybersecurity was pioneered in financial services. In fact, a bank created the first CISO rule, and banks invented many of the guidelines that are now standard across a range of industries. According to the IMF, around 20% of all reported cyber incidents in the past 20 years have affected the global financial sector. So today I'm speaking with JF about what he's learned as a leader of cybersecurity in finance.

JF Legault (3:53)

Really, my role is twofold. One is to represent cybersecurity in the lines of businesses, but it's also to hear where they're heading towards from a business strategy standpoint.

Kate Fazzini (4:06)

And I'll find out why he's flipping the script on enterprise security, from simply defending the perimeter, to transforming whole teams into early detection networks. Then I'll chat with David Adrian, Security Product Manager for Chrome, about how businesses can implement this kind of strategy and set up a strong monitoring system to protect their teams. Going back to the trend of cyber attackers using fake websites as phishing lures, JF talked me through each step of their attack path.

JF Legault (4:37)

A lot of it starts with the endpoint. It starts via e-mail or web browsing. Credential theft continues to be a driver of this in phishing. Phishing from two standpoints, either the credential theft that I mentioned, but also delivery of malware via those channels is normally step one. What we continue to see in terms of exploitation is things like not having multi-factor authentication on remote access, on remote login or an element of push fatigue. There are multi-factor authentication solutions that send a pop-up and then people just end up hitting the yes button somehow because they're just tired of seeing it.