How KBC Securities Services Protects Client Data as Cyber Threats Evolve

“When I started, the way we thought about cyber security was mainly focused on controlling access to systems. Today, that’s completely different. We now have many more factors to take into account: phishing, ransomware, hacking, data loss… We have to protect against all of those threats, while keeping our critical systems up and running 24/7. Because if those systems are unavailable, our clients can feel the consequences too.

Think about the activities they depend on us for every day. Clients need to be able to submit orders and rely on those orders reaching the market on time. They need access to digital tools, like SSO, Digital Onboarding and Digital Inbox. Keeping our systems secure and available helps ensure they can continue their day-to-day work." 

“At KBC, we opt for a multi-layered approach. I often compare it to protecting a medieval castle. A castle has strong outer walls with tightly controlled gates through which legitimate traffic can enter. That’s your main defense barrier. But it doesn’t stop there. Inside the castle, you create additional layers of protection so that everything does not depend on a single defensive barrier.

We apply the same principle to our systems. We have firewalls protecting different environments, separate security measures at operating-system level and strict user management. Systems are also separated from each other, so gaining access to one part does not automatically provide access to everything else.

We also monitor activity to identify unusual behaviour. If, for example, a user repeatedly tries to log in 10 times within a very short period, that can trigger an alert that needs to be investigated.” 

“One of the systems we rely on is IBM System i, which supports a number of our critical processes. For us, an important part of running critical processes is finding the right balance between security, stability and availability. That also affects how we manage the platform. When it comes to major releases, we’re not early adopters. We don’t automatically install a major new release as soon as it becomes available. We generally prefer to let a new version mature first. Otherwise, you run the risk of being among the first to encounter potential issues. Of course, security updates are a different matter. If a vulnerability requires a security patch, we act immediately. After all, a security issue could affect the applications our clients rely on.”

“By cooperating with others. We work closely with security specialists within KBC Group and with technology partners such as IBM and Cegeka. KBC Group continuously monitors security risks across the organisation. Our systems are checked for vulnerabilities and suspicious activity, and if a new risk is identified, we can assess whether action is needed on our side. Cegeka supports us with specific expertise around System i, while IBM provides the underlying technology and security updates for the platform.

That collaboration is important because cyber security keeps changing. A system can be secure today, but new vulnerabilities or attack methods can emerge tomorrow. Part of my job is to keep following those developments and make sure the different layers of protection evolve with them.” 

“We don’t know exactly what the next cyber threats will look like. But at KBC, we believe financial institutions need to start preparing for them now. AI is one of the developments we are following. It’s still difficult to predict exactly what the impact will be, but the technology could change the way systems are attacked. Quantum computing is another development we have to consider. One of the worries there is what it could mean for encryption. Data that is encrypted securely today could potentially become easier to decrypt in the future.

Let’s take digital certificates, for example. You can think of them as digital ID cards. When one system communicates with another, certificates help confirm that they can trust each other. But if someone manages to compromise the private key behind a certificate, they could potentially impersonate a trusted system and gain access to information they shouldn't be able to reach. For clients, that could put the security of their data and the services they rely on at risk.

That’s why we’re paying close attention to how we manage certificates. When we first started using them, they were valid for two years. Today, we renew them annually, and we’re looking at reducing that period to as little as 49 days. Renewing certificates that frequently would be difficult to manage manually, so we're working on automating the process." 

“Cyber threats will keep changing. We can't predict every risk that lies ahead. I want our clients to know that we at KBC understand our responsibility here. We have to keep earning the trust of our clients today and in the years ahead. That's what we're working towards every day.”