Insights from a non-profit financial cybersecurity consortium highlight how APAC financial institutions can tackle diverse cyber threats and strengthen collaborative defense.
Today, cybersecurity is no longer a peripheral concern, but a central element of organizational resilience.
Building a robust cybersecurity culture is essential to safeguarding operations and data integrity, requiring active leadership and employee engagement across all levels.
How can organizations embed cybersecurity into their culture, while rethink the role of leadership and evolving investment trends to stay relevant?
DigiconAsia.net interviewed Christophe Barel, Managing Director (APAC), FS-ISAC for his perspectives from the point of view of a non-profit financial industry cybersecurity resilience consortium.
CybersecAsia: How can organizations embed cybersecurity as part of their culture and leadership mindset, moving beyond compliance to resilience?
Christophe Barel (CB): Cyber risk is increasingly recognized as a major business threat worldwide, yet it often remains treated as a mere compliance checklist.
Embedding cybersecurity into organizational culture requires:
- Adopting Secure-by-Design principles, meaning security must be integrated from the outset of business processes instead of being an afterthought. This approach calls for appropriate budgeting, ongoing cyber hygiene, collaboration to share intelligence, proactive threat detection, and regular incident response exercises.
- Clear and frequent communication about cybersecurity practices to all employees. These resilience-focused efforts help organizations minimize the impact of cyberattacks, sustain business operations if disrupted, and adapt swiftly to emerging threats.
- Leadership plays a pivotal role in this transformation by setting the tone at the top, championing security initiatives, allocating sufficient resources, and fostering a culture of accountability where cybersecurity is seen as an enterprise-wide responsibility rather than solely an IT concern.
Practical benchmarks such as timely software patching, data encryption, strong password policies, use of VPNs, secure configurations, and continual employee training should be regularly tracked and reported. These measures drive improved compliance, quicker incident responses, and stronger adherence to security standards throughout the organization.
CybersecAsia: What training and engagement methods best cultivate cyber-aware, empowered employees who act as a strong first line of defense?
CB: Real-world scenario-based cyber exercises have proven highly effective in educating employees on current cyber threats and building rapid response skills. Such exercises also improve collaboration within and across sectors, facilitating better information sharing and coordinated crisis management.
Creating a culture of shared responsibility begins with making incident reporting straightforward, encouraging employees to flag suspicious activities quickly without fear of repercussions. Also:
- Promoting open communication and teamwork fosters an environment where cybersecurity is everyone’s duty, extending beyond the IT department.
- Visible leadership support reinforces this message, motivating employees to prioritize cyber awareness in their daily workflows.
- Empowering employees includes not only awareness programs but also the provision of necessary security tools, such as antivirus software and password managers. Accessible incident reporting channels that are consistently promoted can help embed cybersecurity practices into the organizational fabric, reinforcing that maintaining strong cyber hygiene is a collective effort.
CybersecAsia: How can organizations dismantle silos between cybersecurity, IT, and business teams to achieve unified resilience and coordination?
CB: Siloed functions often hinder communication, lead to duplicated efforts, and cause missed warning signs of cyber incidents, which can have severe financial and reputational consequences.
The first step towards overcoming these barriers is recognizing the need for cross-functional communication and establishing consistent channels for information sharing.
A unified approach helps eliminate overlaps and ensures resources are deployed efficiently. Organizations can create integrated frameworks or playbooks to guide collaboration between cybersecurity, fraud, financial crime, anti-money laundering, and business teams.
These shared tools provide a common language, clearly defined roles, escalation paths, and dependencies — allowing for faster, more informed decisions and stronger collective defenses — well before incidents can arise.
CybersecAsia: How has investment in cybersecurity evolved in financial institutions across the Asia Pacific region, and what are the drivers behind this shift?
CB: Over the past decade, organizations in the Asia Pacific region have significantly increased their cybersecurity investments. Internal research indicates that nearly half of firms polled planned to boost their IT budgets in coming years with cybersecurity as a top priority. Rising cyber threats are fueling this trend, pushing financial firms to enhance their defenses continually.
One major area of concern is supply chain risk, as many institutions depend on common service providers whose vulnerabilities can affect many firms simultaneously. This risk has led to greater investment in third-party risk management infrastructure and processes.
Additionally, rigorous regulatory requirements, such as those imposed by regional financial authorities, further compel institutions to strengthen cyber risk controls and resilience measures.
In response to the increasing complexity and sophistication of cyber threats, financial firms are also exploring advanced technologies such as quantum-resistant encryption, AI for threat detection, and Zero Trust architectures. Recent strategies include boosting internal talent focused on emerging technologies to prepare for future challenges.
CybersecAsia thanks Christophe Barel for sharing his consortium’s views.
