'A team sport:' Responding to cyber threats in the age of AI

• Key insight: Bank risk and security leaders are growing more concerned about the use of AI in fraud and cybersecurity.
  
• Expert quote: "When Microsoft releases a patch, it's basically telling the world where the vulnerabilities are. As a bank and as an institution, now we're even further exposed because now the criminals know where the vulnerabilities sit."—Ally Financial Chief Risk Officer Stephanie Richard

Artificial intelligence is redefining both fraud and cybersecurity risks for banks in real-time. The question of who holds responsibility for AI at its worst is challenging bank leaders across the industry."
According to bank cybersecurity executives at American Banker's Most Powerful Women in Banking Conference, breaking down institutional silos and active collaboration across departments and companies is important for fighting cybercrime.

Processing Content

"I always say cyber is a team sport," U.S. Bank Chief Information Security Officer Ann Barron-DiCamillo said during a panel at the Most Powerful Women in Banking Conference on Tuesday. "It takes all of us to collectively defend our bank."

Barron-DiCamillo said that threat actors don't respect institutional boundaries when they attack. 

"We need to work across those boundaries as a collective," she said. "It's also a collective responsibility to defend. We all have responsibilities to stop before we click on something. Don't let somebody else's urgency become yours."

Fighting malicious uses of AI, according to Ally Financial Chief Risk Officer Stephanie Richard, is a new and difficult challenge for banks that have used siloed structures to mitigate risk.

"Fighting cyber criminals, hackers and fraudsters who use AI is tough," she said. "They don't care about organizational structures or risk taxonomies. They don't think about things in silos like the way that we as banks have organized ourselves." She encouraged bankers to "break down" more traditional ways of thinking about risk and instead think about how AI risk connects across the banking system.

Richard also noted that there is "really no expert" in AI for the banking world, but that internal AI governance may become as ingrained into daily operations as internet or e-mail governance.

"In the maturity of AI, from birth to death, we are still babies in this space," she said. "What we're trying to do is manage AI and manage the cybersecurity risk and fraud risk that comes with an AI world. Down the road we're going to be in a situation where AI governance just becomes part of the business. The sooner we can embed that ownership and that accountability for AI and the risks associated with that with the business, the better they'll be."

Barron-DiCamillo said that banks can, and should, look for ways to use AI to fight AI.

"AI is used for offense by bad actors, and you have to use AI to counter that," she said. "I think it's important to use a number of different types of tools. You want to make sure you understand how threat actors are leveraging these tools so you can defend with that same capability internal to the network."

Read more:

• As fintechs nab bank charters, what's happening to BaaS?
• Overheated data center knocked 23 credit unions offline
• Chris Britt still says banking is broken, but Chime can fix it
• Credit unions bulk up a business that banks long dominated

One key risk for bank cybersecurity that is being magnified by AI, according to Barron-DiCamillo and Richard, is what a recent J.P. Morgan report called "Patchmageddon." The report found that the average time between disclosure of a vulnerability and its first exploitation has now fallen to zero days, even as the amount of time it takes for institutions to "patch" a software vulnerability has risen to an average of almost 100 days.

AI, in particular, has been finding vulnerabilities — "a security flaw, glitch or weakness found in software code that could be exploited by an attacker," according to the National Institute of Standards and Technology — in software programs used by banks at an unprecedented rate.

"Record patches are [being] released every month from Microsoft and from other software vendors, record meaning 10x" Barron-DiCamillo said. "I've never seen anything like this in my 27 years in cyber."

"When Microsoft releases a patch, it's basically telling the world where the vulnerabilities are," Richard added. "As a bank and as an institution, now we're even further exposed because now the criminals know where the vulnerabilities sit. It becomes very imperative to fix those and patch those vulnerabilities as quickly as possible before the criminals can basically find their way into your front door."