Why banks are hiring hackers

Hackers are targeting Toronto-Dominion Bank’s internal systems at all hours using cutting-edge techniques, but the bank’s head of cybersecurity isn’t losing sleep over them—they work for him, after all.

The bank established late last year an in-house “red team” of ethical hackers—cybersecurity professionals who attempt to hack a computer network to test or evaluate its security on the owners’ behalf—who conduct live attacks against its own networks continuously, said Alex Lovinger, TD Bank’s vice-president of cyber threat management.

“We’re doing it exactly how our adversaries would do it. […] So if we find a weakness or something like that, we can close it or address it before a real attacker,” he said.

Canada’s biggest banks are fortifying their defences by hiring their own ethical hackers to test their systems as the frequency and sophistication of cyberthreats increases.

A Senate report last month entitled “Cyber.assault: It should keep you up at night” sounded the alarm about the potential consequences of major cyberattacks in Canada.

“While some progress has been made federally in the past year, there is much more that the federal government and Canadians must do to protect ourselves,” said the report of the Standing Senate Committee on Banking, Trade and Commerce. “We must take the appropriate steps now, or soon we will all be victims.”

Bank of Canada Governor Stephen Poloz has also raised concerns about a cyberattack.

In 2017, 21% of Canadian businesses reported that they were impacted by a cyber security incident that affected their operations, according to Statistics Canada. Banking institutions, not including investment banks, reported the highest level of incidents at 47%, followed by universities and the pipeline transportation subsector, according to the agency.

New regulations that require Canadian businesses to alert their customers about privacy breaches or face hefty fines took effect at the beginning of this month.

In May, the Bank of Montreal and the Canadian Imperial Bank of Commerce’s Simplii Financial digital banking brand said thousands of their customers may have had their personal and financial data compromised.

BMO said hackers contacted the bank claiming to be in possession of the personal data of fewer than 50,000 customers, and that the attack originated outside of Canada. At the same time, Simplii also warned that “fraudsters” may have accessed certain personal and account information for about 40,000 clients.

BMO’s chief executive Darryl White said he could not comment on the details of the privacy breach, as an ongoing investigation is underway, but noted there was a “very immaterial impact from a fraud perspective” and no material financial fallout.

“We are a lot smarter as every event goes on. And there are events every day, there are events every hour of every day. […] It’s a continual improvement exercise,” White told reporters after the bank’s recent investor day.

Meanwhile, BMO is also turning to in-house ethical hackers to test their systems. According to a recent job posting, BMO is seeking a senior manager with a certification in ethical hacking and whose responsibilities include managing a team of “network penetration testing” specialists.

CIBC did not respond to questions about whether it utilizes ethical hackers.

“We leverage internal and external expertise, and work closely with industry and government to enhance cyber security resilience, threat intelligence and best practices,” a spokeswoman said in a statement.

Alberta-based bank ATB Financial in a recent job post said it was recruiting a “senior penetration tester” with ethical hacking experience. An ATB spokeswoman said the posting is to fill a recently vacated role.

The Bank of Nova Scotia also established its own in-house “red team” of hackers to test its defences, said its chief information security officer Steve Hawkins.

“Scotiabank has used and continues to use third-parties to handle this penetration testing. However, because the volume of global cyber threats has significantly risen, the Bank wanted to have its own capabilities in-house and created its own red team this year,” he said.

With the string of data breaches in recent years, what does worry TD’s Lovinger is the cumulative amount of data that has been exposed.

“Hackers now sit on a wealth of information. […] That they can now leverage to do more targeted attacks,” he said.

Royal Bank of Canada has had in-house ethical hacking capabilities for a few years now, as part of its cybersecurity program, said Adam Evans, the bank’s vice-president of cyber operations and chief information officer.

“We want to make sure that we are testing our defences to make sure they stay relevant,” he said.

RBC has been upping its cybersecurity budget and adding to its team annually. It now has roughly 400 cybersecurity professionals, up 50% from three years ago, but a talent gap looms, Evans said.

Demand for talent in Canada is climbing by 7% annually and there will be more than 5,000 roles to fill between 2018 and 2021, according to Deloitte. By 2022, the cybersecurity workforce gap is expected to reach 1.8 million, it said.

As of October, there were 1,024 cybersecurity vacancies for every million Canadian job postings, up 5% over the past year, according to Indeed Canada. That’s up 73% since the beginning of 2015, said Brendon Bernard, an economist for the job search platform.

Meanwhile, several Canadian banks have made recent investments in research or capabilities abroad or in universities at home to tap cybersecurity talent. For example, TD opened a cybersecurity-focused office in Tel Aviv, Scotiabank announced a partnership with an Israeli cybersecurity company, and RBC made an investment in research at Ben-Gurion University.

“With the talent gap in cyber, it’s something that organizations are going to have to address,” said Evans. “Because there is just not enough qualified people out there.”