According to Mr. Le Quang Ha, Deputy Director of Viettel Cyber ​​Security Company Limited, protecting the system against the risk of cyber attacks does not only stop at detecting and preventing, but also needs to focus on the ability to react quickly, limit the scope of influence and maintain key services when an incident occurs.

• The police released an important announcement related to the VNeID electronic identification application of individuals and businesses
• Block bank accounts, stop money transfer transactions, and receive money in the following cases
• From tomorrow (November 1), the following phone lines will not be able to make transfer transactions over 10 million VND/time

Sir, what challenges is the use of AI in cyberattacks posing for financial institutions and banks?

AI brings many benefits to banking operations, but this technology can also be exploited by bad actors to carry out cyber attacks. Notably, the speed and scope of attacks are changing as AI tools are increasingly used.

Previously, organizations often had a few hours to detect and react when an attacker infiltrated the system. However, with the current attack rate, this time is almost gone. Meanwhile, traditional defense methods often go through many steps, from anomaly detection systems, analysis experts to implementing remedial measures, making it difficult to react to keep up with the speed of the attack.

When an attack occurs at a very fast pace, this process may not be able to keep up with the response requirements.

In addition, financial institutions and banks are increasingly connecting with many partners and technology providers. This expands the scope of possible attacks, posing additional challenges in protecting the entire system.

In your opinion, how do banks need to adjust their system protection strategies to limit the impact when incidents occur?

Instead of just focusing on detecting and preventing all attacks, financial institutions and banks need to consider situations where the system can be penetrated but still must protect critical services.

An important requirement is to limit the scope of influence, not allowing an attack from one area to spread to the entire system. At the same time, it is necessary to improve the speed of detection, analysis and processing to be able to respond to attacks that occur very quickly.

To do this, one proposed approach is to build the system according to the default zero trust principle (Zero Trust). This is not simply about equipping additional security tools or authentication methods, but requires the process of designing and reorganizing the system architecture, instead of just equipping additional security tools. In particular, it is necessary to divide the system into smaller areas to limit the ability of attackers to move freely between components, to avoid letting an incident in one area spread and affect critical services.

Along with system reorganization, the ability to react quickly is also a requirement that needs attention. If they still rely on human detection, analysis, and sequential processing, organizations will have difficulty dealing with attacks that take place at machine speed.

So how can banks apply AI in defense activities and what solutions should be prioritized, sir?

One approach is to take advantage of AI advances to automate defense operations in a controlled manner. Instead of just supporting analysts, systems can be developed to automatically handle and isolate attacks, helping financial institutions and banks respond faster to threats that occur at machine speed.

However, the ability to respond also depends on how security tools are organized. In a system with many separate solutions such as firewalls, security monitoring tools and endpoint protection, troubleshooting may require multiple steps. When serious vulnerabilities appear, the department in charge must identify affected systems, update prevention measures and coordinate handling on different tools. This dispersion reduces reaction speed to attacks.

Therefore, a proposed direction is to integrate security tools on a unified platform, helping banks coordinate data and operate defense operations more effectively. This does not mean that all solutions must come from the same supplier, but it is necessary to ensure connectivity and coordination between systems.

In the long term, financial institutions and banks need to shift from a strategy focusing on preventing attacks to improving resilience, with five contents including forecasting, resilience, maintaining operations, recovery and continuous adaptation to changes in the technological environment.

Thank you!