Chilean banks ordered to tighten cybersecurity

Chile's banking watchdog Sbif has ordered the country's principal lenders to beef up their cyber defenses.

The move comes in the wake of an attack on heavyweight Banco de Chile which led to service disruptions and US$10mn being stolen from the bank's own digital vaults.

Sbif chief Mario Farren (pictured) met with the CEOs of Santander, Banco de Chile, BancoEstado, Bci, Itaú CorpBanca, Scotiabank, Banco Falabella, Banco Ripley, BBVA, Banco BICE and Banco Security.

The bank representatives were told to "analyze and adopt effective measures to strengthen the IT security of their operations," Sbif said in a statement.

"This is an opportunity for banks to take concrete measures in the short term to increase security of this channel," Farren said. "Notwithstanding the fact that users should use these [banking] products in a responsible manner, we believe that banks must tell them, as quickly as possible, about these measures so that we not only have a safer environment but also ensure that users receive the message that the industry is on the case."

In parallel, the finance ministry is working on a series of initiatives to overhaul and strengthen associated regulations and protocols.

Last week consumer watchdog Sernac said it had received about 140 bank fraud complaints from consumers regarding Itaú CorpBanca. Consumers had reported different types of suspect transactions, among them operations involving credit card advances and loan applications, Sernac said. Group arbitration proceedings have been launched.

ALSO READ: Chile's 7 biggest profit generators in 2017

Last month delegates at a conference co-hosted by US higher education institution MIT and Banco de Chile were told that completely stopping cyberattacks is currently an impossible task.

MIT professor John Williams said: "If they decide to attack, they are probably going to succeed. The cost of attack has increased, and the cost of defense has gone up."

A key solution is using distributed ledgers, as there is no central database or repository for a criminal to hack, the conference was told. However, the efficiency of blockchain solutions needs improving to make them viable, Williams said.

Chile has adopted a risk-based supervision model, the key focus of which is not on avoiding occasional operational incidents but reducing the probability of them occurring. Banks are required to monitor risks they are exposed to and implement corresponding risk-management and mitigation measures.

A banking bill in congress that brings industry rules and regulations in line with that of Basel III provides better tools to manage operational risk and requires banks to set aside additional capital for use in the event of an operational incident, the finance ministry said earlier this month.

HOW MUCH ARE BANKS ARE INVESTING IN IT AND CYBERSECURITY?

In a presentation to lawmakers, Farren outlined how much banks have been investing in IT and cybersecurity. Sbif based its figures on data provided by the country's 17 principal banks. Twenty currently operate.

He said that the industry, following the Banco de Chile attack, was "forecasting an important increase in spending on cybersecurity," local paper La Tercera quoted him as saying.

The banks aim to invest about 735.265bn pesos (US$1.144bn) in the areas of IT and cybersecurity this year, up from 486.416bn pesos in 2015, 562.120bn pesos in 2016 and 634.994bn pesos in 2017.

Of the forecast 2018 total, 60.961bn pesos is due to be spent on cybersecurity, with the bulk (17.057bn pesos) on perimeter protection, followed by 14.398bn pesos in the area of application security. Spending on cybersecurity was 27.161bn pesos in 2015, 34.784bn pesos in 2016 and 38.968bn pesos last year.

This year, gross operating income is forecast to come in at 8.033tn pesos.

Last year Chile's banks reported net income of 2.24tn pesos, up 11.9% compared with 2016.

ALSO READ: Cyberattacks expose Mexican bank sector's scant data security awareness