Financial Services

The 2017 Eurofinance conference brought together leading corporate treasury to discuss third-party risks and cyber-security

November 21, 2017

Global

November 21, 2017

Global
Renée Friedman

EMEA

Renée Friedman joined The Economist Group in July 2016 as a Managing editor for EMEA.  Her work focuses on thought leadership programmes for the financial services sector.

Prior to joining The Economist Group, Renée worked in a variety of roles: in Economic and Political risk consulting, in finance in the City of London as an Economist, a Macro strategist and a Bond fund manager,  in the  international and UK domestic policy spheres as an Economist to the Treasury Select Committee at the House of Commons and as Senior Economist and Chief Technical Advisor for the UN Development Programme’s (UNDP) Regional Bureau for Europe and the CIS,  and as an academic, designing and teaching economics courses at universities across London.

Renée has spoken on a variety of panels  and events focused on Russia, Ukraine and other emerging market economies including those for BNE Intellinews, IHS Global Insight, the IMF Poverty Reduction Strategy meetings, and for the UNDP. She has also appeared on CNBC.

Renée holds a PhD in Economics from London Business School, a Masters in Russian and East European Studies from the University of Birmingham, and a Bachelors in International Trade and Development from the London School of Economics & Political Science.  She is also a Prince 2 certified project manager. In addition to her native English, Renée speaks Russian.

Contact

The recent EuroFinance annual flagship conference, International Cash & Treasury Management, in Barcelona, Spain, provided a fantastic platform to launch a new Economist Intelligence Unit report, Third-party risks: the cyber dimension, sponsored by Deutsche Bank. The session was part of the main afternoon programme and brought together leading corporate treasury experts and information security experts to discuss the key issues around data protection, cyber-security risks for the corporate treasury function and the type of response needed to protect the corporate treasury function.

The panelists included Greg Day, vice-president and chief security officer EMEA at Palo Alto Networks; George Zinn, corporate vice-president and treasurer at Microsoft; Vicki Gavin, compliance director and head of business continuity and information security at The Economist; and David Watson, Deutsche Bank’s global head of digital cash products. The session discussed the key issues covered in the report: why treasury is a target, the key scams, the key risks stemming from third-parties, including outsourcing and control issues, and third-party security, as well as the treasury response, particularly in relation to employee training.

The session provided a great opportunity for senior treasury and information security professionals to share their own experiences on the topics covered in the survey. The main points discussed during the session are highlighted below.

The role of employees

Mr Watson highlighted the concept of the weakest link. He noted that the problem was asking humans to control technology. This was, by definition, the flaw in the process. Mr Day echoed this view, saying that employee skills were as important as technical skills. He discussed what many believe to be the top treasury scam: phishing. He gave an example of the role that employees played in perpetuating the scam as opening up emails they shouldn’t. He then highlighted the role they can play in stopping the spread of these scams through the continuous education and training of employees. This discussion supported the results of our survey, which found that although the overwhelming majority of companies (92%) provide training for their employees, risks can emerge through the type of training given (formal v informal). Risks can also come from third-party vendors, of which only 53% provide formal training on cyber risks associated with the company for which they are working.

Working with IT

Mr Zinn mentioned how corporate treasury departments cannot just outsource the design of the security system to IT, but that they need to work with IT. This was also in line with external testing, particularly external penetration testing, another topic discussed within the report. The report noted that 33% of all companies did not conduct external penetration testing. Mr Day noted that businesses needed to be aware of how state-of-the-art cyber-security may change when general data protection regulation (GDPR) compliance is required. He noted that GDPR would require companies to respond within 72 hours of discovering an incident and that it currently takes days to respond, as there is no real-time view by businesses. He noted that businesses need real-time daily visibility to reduce risk and that they need to automate to get security in place, as manual processes cause the problems. He said that penetration testing was important because of the links between the supply chain and business processes, as third-parties hold data and make payments.

External validation

Other emerging risks from third-parties include those coming from the second Payment Services Directive (PSD2), which comes into force next year. Mr Watson noted that it would open up the market place with application programming interface (API) technology. This would require banks to strike a deal with vendors and ensure that they go through the same standards in terms of internal and external penetration testing and other controls. To not would risk reputational blow-back.

In terms of securing data, Ms Gavin noted that technology controls were important and that there shouldn’t be a single check process but rather layered permissions. She stressed that humans can be the strongest defence, while Mr Watson made clear that corporate treasurers need to “own” the systems that are being used.

For more details on the Third-party risks: the cyber dimension programme, sponsored by Deutsche Bank,

Also to read the write-up of the panel as part of the review of EuroFinance in the Deutsche Bank flow online magazine.

 

The views and opinions expressed in this article are those of the authors and do not necessarily reflect the views of The Economist Intelligence Unit Limited (EIU) or any other member of The Economist Group. The Economist Group (including the EIU) cannot accept any responsibility or liability for reliance by any person on this article or any of the information, opinions or conclusions set out in the article.

Enjoy in-depth insights and expert analysis - subscribe to our Perspectives newsletter, delivered every week