Banks are investing in cybersecurity visibility. The harder question is whether every exposure can be traced to someone empowered to address it.
Banks are investing in cybersecurity visibility. The harder question is whether every exposure can be traced to someone empowered to address it.
A bank discovers a vulnerability in a building controller connected to its branch network. Security identifies the risk, but facilities manages the equipment, an outside contractor maintains its firmware, and IT controls network access. Each team owns part of the problem. None can resolve it alone.
As financial institutions expand digital infrastructure and rely on more interconnected systems and service providers, these ownership gaps become increasingly consequential.
Financial institutions rely on far more connected technology than conventional IT systems. Surveillance cameras, badge readers, environmental controls and vendor-managed appliances support daily operations, often under different management processes.
That fragmentation complicates cybersecurity asset management. An asset may appear in network monitoring but be missing from the configuration management database (CMDB). Another may have a technical record but no identified operational owner. The result can be a known vulnerability without a clear path to remediation.
The New York State Department of Financial Services (NYDFS) 23 NYCRR Part 500 cybersecurity regulation illustrates how regulatory expectations intersect with this challenge. Its definition of information systems includes industrial controls, telephone switching and environmental controls. Section 500.13 requires covered entities to maintain asset inventory policies and procedures addressing ownership, location and support expiration.
Although NYDFS Part 500 applies to covered New York-regulated entities, the underlying challenge is relevant to financial services organizations more broadly.
Source link
