Financial firms are one of the top industries to be targeted for cyberattacks. The speed at which a financial firm detects and contains a cyberattack can significantly impact the extent of damage and also any potential regulatory breaches for not having adequate controls in place. But the question is, how quickly should a cyberattack be detected and contained?

It’s not surprising financial services are one of the fastest, as they spend more money than anyone else on cyber security and must conform to strict regulations.

What is a cyberattack and what do we mean by detection and containment?

A cyberattack aims to steal, expose, modify, disable, or destroy information by gaining unauthorised access to systems. Motivations of attackers include financial gain, political agendas, or personal vendettas.

Detection involves identifying a cyber incident through monitoring and tools like IDS and SIEM. Rapid detection minimises damage.

Containment limits the attack’s spread and impact by isolating affected systems and applying security measures, protecting data, systems, and reputation.

What is the importance of speed? The 1-10-60 rule.

The faster a cyberattack is detected, the less time attackers have to inflict damage. Reducing this time is crucial for minimising damage.

The 1-10-60 rule in cyber security is a guideline for effective cyber incident response management. It emphasises the importance of quick and efficient response times to detect, analyse, and mitigate cyber threats. Here’s a breakdown of the rule:

1. Detect: Identify a breach within 1 minute.
2. Investigate: Analyse the breach within 10 minutes.
3. Remediate: Contain and fix the breach within 60 minutes.

However, achieving this standard is very challenging for most firms. According to a CrowdStrike survey, only about 5% of companies believe they can regularly meet the 1-10-60 benchmark.

What are your regulatory obligations?

Financial Firms are under strict deadlines to notify authorities of cyber incidents.

• The Financial Conduct Authority (FCA) requires firms to notify them immediately upon becoming aware of a cyber breach or any information suggesting a breach may have occurred.
• The U.S. Securities and Exchange Commission (SEC) requires companies to report material cyber security incidents within four business days after determining that the incident is material.
• Under the EU Digital Operational Resilience Act (DORA), financial entities must adhere to initial notification within 4 hours of determining the incident is major, but no later than 24 hours from detecting the incident. Intermediate notification within 72 hours of classifying the incident as major and submitting a final report no later than one month after classifying the incident as major.

So how fast should a financial firm detect and contain a cyberattack?

Firms need to weigh this one up themselves, however, they should consider regulators’ views which expect them to operate their firms with due care, skill and diligence and maintain adequate risk management systems. The regulator is very clear that they expect financial services firms to operate according to best practices. We believe the following is considered best practice currently for the vast majority of firms:

• Mean time to detect: Aim to detect incidents within minutes to hours.
• Mean time to contain: Strive to contain incidents within hours to a day.
• Response mean time to respond: The total time from detection to full resolution should ideally be within days.