Doha

Cyber crime was a rapidly growing concern and cost the world an estimated $400bn in 2014, said HE the Minister of information and Communications Technology Dr Hessa al-Jaber.

“This is a figure that is greater than the GDP of more than 84% of countries across the globe,” she said at the QCB Cyber Security Conference at the Ritz Carlton yesterday.

“As recent events have shown, cyber-crime in the financial sector is a pervasive, worldwide problem, and one from which Qatar and our country’s diversified global financial assets are not immune,” al-Jaber said.

Additionally, the number of threat actors are proliferating, to include not just individuals, but international criminal elements, terrorist organisations, and nation states. Broadly available and inexpensive criminal tools are now enabling low-capability threat actors to use sophisticated techniques once limited to nation states and large criminal enterprises.

“Staying in front of the problem is growing more and more difficult,” she said.

Criminals are finding new and sophisticated tools and techniques to commit fraud and steal money or personal information for exploitation. The criminals and other cyber threat actors are collaborating and working in concert.

Meanwhile most of the prevention focus is on purely technological fixes, which are having limited effectiveness and for only for a limited period of time. The evolution of technical defenses are struggling to maintain a pace of continuous evolution needed to keep up with the criminals.

The minster noted that the modern geopolitical landscape was rapidly shifting, and hacktivists and terror organisations are actively seeking opportunities on a much broader scale, to include Qatar and the GCC. These threat actors, which previously had focused on US and European-based multinational entities, have increasingly turned their attention and activities to financial services institutions in the Middle East.

Economic prosperity and exponential growth in mobile banking in GCC countries have bypassed many regional and local financial organisations’ ability to manage the threats to these new technologies. As a result, attacks to these vital technologies are no longer the sole concern of “Western” or multi-national financial firms. Industry research shows the GCC region experiencing an increasing number of cyber threats, including widespread banking malware across the region.

“While Qatar has made great strides in developing and implementing Cyber security standards and requirements, it is important for the financial services community to understand cyber security isn’t solely concerned with compliance with financial regulations or government and industry regulations and standards. Meeting these standards represents a starting point rather than a destination,” she said.

Al-Jaber said, “Cyber security is a bigger problem than just what you own, third-party risk has to be managed as well, and enforcement of standards and compliance is difficult to manage across so many entities. The financial services industry is a mesh of intertwined capabilities, which increases opportunity for cyber criminals. Companies need to be keenly aware of the potential cyber risks associated with partners, vendors and other third parties, such as retailors and payment processors.

“Knowledge of the whole ecosystem is as important as an organisation’s awareness of the risks present to their own systems. Focusing solely on internal compliance will never address the whole of potential threat vectors that are part of an integrated global financial services sector.”

The minister said it was increasingly obvious that stopping all attacks across the financial sector was an “unrealistic” task. The latest and most audacious cyber-attacks against the financial services sector demonstrate the attackers have breached the systems months, if not years ago, and went undetected until completing their task.

Changing the industry mindset from stopping all attacks to one of mitigating the impact will do more to thwart cyber-crime than one focused solely on prevention technologies.

"This is not to say that technology does not play a significant role, but we must also realise that cyber security is not just a technical problem and does not have a complete technical solution," al-Jaber said.