National CERT Issues Advisory on AI Cyber Risks to Banks

The National Cyber Emergency Response Team (National CERT) has issued an advisory on cybersecurity risks to banks and critical national infrastructure from AI and automated bots. It urges institutions to take precautions, including security audits, multi-factor authentication and stronger emergency response arrangements.

Sectors Covered

The advisory covers several sectors:

• Banking and finance: core banking systems, digital banking platforms, payment networks and financial transactions.

• Energy: oil and gas installations, refineries, pipelines, power plants, and power generation and transmission systems.

• Water: water supply networks and systems.

• General: industrial control systems and internet-connected IoT devices.

Risks Highlighted

The advisory says hackers could gain unauthorised access to systems and tamper with critical operations. In banking, they could access customer accounts and alter balances. Funds may remain secure, but customers could be shown incorrect balances. Attackers could also use internet-connected IoT devices and remote access facilities to enter critical networks.

Recommended Precautions

• Banks: assess the security of core banking, digital banking and payment systems, conduct security audits, adopt multi-factor authentication, and continuously monitor suspicious transactions and unusual online activity.

• Critical infrastructure operators: audit industrial control systems and networks, restrict direct internet access to key operational systems, and separate IT and operational technology (OT) networks.

• All organisations: improve emergency response arrangements, ensure business continuity, and be able to restore affected systems quickly.