{"id":180695,"date":"2026-01-22T14:28:00","date_gmt":"2026-01-22T19:28:00","guid":{"rendered":"https:\/\/testing.news-you-need.com\/index.php\/2026\/01\/22\/financial-firm-cybersecurity-lacking-bank-of-england-says\/"},"modified":"2026-01-22T14:45:09","modified_gmt":"2026-01-22T19:45:09","slug":"financial-firm-cybersecurity-lacking-bank-of-england-says","status":"publish","type":"post","link":"https:\/\/testing.news-you-need.com\/index.php\/2026\/01\/22\/financial-firm-cybersecurity-lacking-bank-of-england-says\/","title":{"rendered":"Financial Firm Cybersecurity Lacking, Bank Of England Says"},"content":{"rendered":"

Financial Firm Cybersecurity Lacking, Bank Of England Says<\/a><\/p>\n

https:\/\/thecyberexpress.com\/financial-firm-cybersecurity-lacking-boe\/<\/a><\/p>\n

Publish Date: 2026-01-22 14:28:00<\/a><\/p>\n

Source Domain: thecyberexpress.com<\/a><\/p>\n

Author: <\/a><\/p>\n

Using an unordered list, summarize the following article with between 4 and 8 key points.
\n\t\t\t\t\t\t\t\tThe Bank of England\u2019s CBEST cybersecurity assessment program found that financial organizations are failing when it comes to basic cybersecurity practices.
\nThe lengthy report doesn\u2019t specify how widespread the financial firm cybersecurity failings are, but any lack of basic cybersecurity controls in the critically important financial services sector is alarming.
\nThe \u201cCBEST thematic\u201d is based on 13 CBEST assessments and penetration tests of financial firms and financial market infrastructures (FMIs). The report details failings in areas like patching and hardening, identity and access control, detection, encryption, network security, incident response and employee training.
\n\u201cMaintaining strong cyber hygiene is not a one-time exercise but a continuous effort to reduce exposures and strengthen resilience,\u201d the BoE report said. \u201cIn today\u2019s evolving threat landscape, tactical fixes alone are insufficient. While quick remediation may address immediate vulnerabilities, it often leaves underlying weaknesses unaddressed.\u201d
\nThe report urged organizations to consider the underlying causes of cyber risk\u00a0and systemic gaps that can lead to recurring vulnerabilities, such as poor asset management, weak identity and access controls, or inadequate third-party oversight. \u201cAddressing these foundational issues will create sustainable security improvements rather than temporary patches,\u201d the report said.
\nBoE Recommendations for Financial Firm Cybersecurity
\nThe BoE report includes findings and recommendations spanning five cybersecurity areas, three on technical controls, one on detection and response, and one focusing on staff culture, awareness, and training.
\nIt also contained four broad recommendations:<\/p>\n

Patching, configuring and hardening was one. \u201cTo reduce the likelihood of severe cyberattacks firms and FMIs should look to harden operating systems, including by patching vulnerabilities and securely configuring key applications,\u201d the report said.
\nPreventing unauthorized access to sensitive systems and information can be helped with strong credential management and passwords, multi-factor authentication (MFA), secure credential storage, and network segmentation.
\nEffective detection and monitoring and alerting and response processes \u201care key to reducing the impact from cyberattacks.\u201d
\nRisk-based remediation plans with proper oversight will \u201censure the successful remediation of technical findings, including vulnerabilities.\u201d<\/p>\n

The full report also contains detailed recommendations from the UK\u2019s National Cyber Security Centre (NCSC).
\nFinancial Cybersecurity Weaknesses Detailed
\nIn the area of infrastructure and data security, the CBEST assessments found weaknesses in infrastructure security, asset management and application security. Findings included:<\/p>\n

Inconsistently configured endpoints and insufficiently hardened or unpatched systems
\nA lack of encryption of data-at-rest<\/p>\n

Identity management and access control weaknesses included weak enforcement of strong password standards and secure password storage, overly permissive access controls, and inadequate restrictions on administrator and service accounts.
\nWeaknesses in detection and response included poorly tuned monitoring or alerting for endpoint detection and response and data exfiltration.
\nNetwork monitoring weaknesses included inadequate traffic inspection for threats like attackers hiding malicious activities in seemingly legitimate traffic or enabling outbound connectivity from unmonitored devices.
\nNetwork security weaknesses included inadequate network segmentation, such as segmentation between critical assets and between development and production environments, and inadequate application of least-privilege principles.
\nStaff culture, awareness and training weaknesses included:<\/p>\n

Staff susceptible to social engineering tactics were more likely to be vulnerable to simulated attacks aimed at credentials or system access
\nUsers routinely storing credentials in unprotected locations such as in spreadsheets or in open file shares
\nInsecure protocols for helpdesks, such as limited or no authentication of users<\/p>\n

\u201cGiven the sophistication of some attackers, it is important that firms and FMIs are prepared to handle breaches effectively, rather than relying solely on protective controls,\u201d the BoE report said. \u201cIn addition to technical measures, we continue to observe challenges in staff culture, awareness, and training, highlighting that technical measures alone are not sufficient.\u201d
\nThreat Intelligence Programs Also Assessed
\nThe CBEST assessments also found \u201ca range of maturities across cyber threat intelligence management domains.\u201d Threat Intelligence Operations was the strongest area in self-assessments, while Program Planning and Requirements had the lowest self-assessed score.
\n\u201cThis suggests that although day-to-day threat intelligence operations are effective, the underlying aspects such as strategic planning, defining requirements, establishing governance frameworks, and mapping out long-term capabilities are less developed,\u201d the BoE said. \u201cAs a result, firms and FMIs may experience a disconnect between the intelligence produced and their actual business or operational needs, potentially resulting in inefficient allocation of resources, and difficulties in scaling or evolving their threat intelligence programmes.\u201d<\/p>\n

\tRelated<\/p>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

Financial Firm Cybersecurity Lacking, Bank Of England Says https:\/\/thecyberexpress.com\/financial-firm-cybersecurity-lacking-boe\/ Publish Date: 2026-01-22 14:28:00 Source Domain:…<\/p>\n","protected":false},"author":1,"featured_media":180696,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/thecyberexpress.com\/wp-content\/uploads\/pexels-alphatradezone-5833753.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[24,28,29],"class_list":["post-180695","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-cybersecurity","tag-data-security","tag-network-security"],"_links":{"self":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/180695"}],"collection":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=180695"}],"version-history":[{"count":1,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/180695\/revisions"}],"predecessor-version":[{"id":180697,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/180695\/revisions\/180697"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/180696"}],"wp:attachment":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=180695"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=180695"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=180695"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}