The panelists included Greg Day, vice-president and chief security officer EMEA at Palo Alto Networks; George Zinn, corporate vice-president and treasurer at Microsoft; Vicki Gavin, compliance director and head of business continuity and information security at The Economist; and David Watson, Deutsche Bank’s global head of digital cash products. The session discussed the key issues covered in the report: why treasury is a target, the key scams, the key risks stemming from third-parties, including outsourcing and control issues, and third-party security, as well as the treasury response, particularly in relation to employee training.

The session provided a great opportunity for senior treasury and information security professionals to share their own experiences on the topics covered in the survey. The main points discussed during the session are highlighted below.

The role of employees

Mr Watson highlighted the concept of the weakest link. He noted that the problem was asking humans to control technology. This was, by definition, the flaw in the process. Mr Day echoed this view, saying that employee skills were as important as technical skills. He discussed what many believe to be the top treasury scam: phishing. He gave an example of the role that employees played in perpetuating the scam as opening up emails they shouldn’t. He then highlighted the role they can play in stopping the spread of these scams through the continuous education and training of employees. This discussion supported the results of our survey, which found that although the overwhelming majority of companies (92%) provide training for their employees, risks can emerge through the type of training given (formal v informal). Risks can also come from third-party vendors, of which only 53% provide formal training on cyber risks associated with the company for which they are working.

Working with IT

Mr Zinn mentioned how corporate treasury departments cannot just outsource the design of the security system to IT, but that they need to work with IT. This was also in line with external testing, particularly external penetration testing, another topic discussed within the report. The report noted that 33% of all companies did not conduct external penetration testing. Mr Day noted that businesses needed to be aware of how state-of-the-art cyber-security may change when general data protection regulation (GDPR) compliance is required. He noted that GDPR would require companies to respond within 72 hours of discovering an incident and that it currently takes days to respond, as there is no real-time view by businesses. He noted that businesses need real-time daily visibility to reduce risk and that they need to automate to get security in place, as manual processes cause the problems. He said that penetration testing was important because of the links between the supply chain and business processes, as third-parties hold data and make payments.

External validation

Other emerging risks from third-parties include those coming from the second Payment Services Directive (PSD2), which comes into force next year. Mr Watson noted that it would open up the market place with application programming interface (API) technology. This would require banks to strike a deal with vendors and ensure that they go through the same standards in terms of internal and external penetration testing and other controls. To not would risk reputational blow-back.

In terms of securing data, Ms Gavin noted that technology controls were important and that there shouldn’t be a single check process but rather layered permissions. She stressed that humans can be the strongest defence, while Mr Watson made clear that corporate treasurers need to “own” the systems that are being used.

For more details on the Third-party risks: the cyber dimension programme, sponsored by Deutsche Bank, click here

Also click here to read the write-up of the panel as part of the review of EuroFinance in the Deutsche Bank flow online magazine.

The views and opinions expressed in this article are those of the authors and do not necessarily reflect the views of The Economist Intelligence Unit Limited (EIU) or any other member of The Economist Group. The Economist Group (including the EIU) cannot accept any responsibility or liability for reliance by any person on this article or any of the information, opinions or conclusions set out in the article.