JP Morgan Chase 2013 Annual Report Download - page 24

22
CYBERSECURITY UPDATE
In last year’s letter, I gave a frank assessment about cybersecurity and why it is such a critical priority for the entire
company. We outlined how JPMorgan Chase had spent approximately $200 million in 2012 to protect ourselves
from cyberwarfare and to make sure our data were safe and secure, and we dedicated more than 600 employees
across the firm to the task. Despite these intense eorts, we acknowledged that the issue of cybersecurity worried
us — and, today, that worry only has continued to intensify.
By the end of 2014, we will have spent more than $250 million annually with approximately 1,000 people focused
on the eort. This eort will continue to grow exponentially over the years.
In our existing environment and at our company, cybersecurity attacks are becoming increasingly complex and
more dangerous. The threats are coming in not just from computer hackers trying to take over our systems and
steal our data but also from highly coordinated external attacks both directly and via third-party systems (e.g.,
suppliers, vendors, partners, exchanges, etc.). It appears that a large, successful attack on a major retailer last year
was the result of a third-party system breach.
We are continuing to carefully protect our perimeter from external threats, beef up our processes to detect internal
threats and monitor related third-party systems to make sure their protections are adequate. In addition, we are
moving rapidly ahead with Europay Mastercard Visa (EMV) and tokenization for credit and debit card transactions,
which we will need to do in conjunction with merchants. We also are building three state-of-the-art Cybersecurity
Operations Centers in our regional headquarters to provide points of coordination for all incoming information, the
identification of threats, the protocol around managing our responses and the security of our buildings around the
world. A major focus of these centers is the concept of intelligence fusion, which will pull together all our internal
information from Internet and systems monitoring, as well as reconnaissance from our partners in industry and
government. This approach will give us a comprehensive and consolidated view of all the threats facing our firm
and our customers, and it will help to inform our view on how best to combat them.
We’re making good progress on these and other eorts, but cyberattacks are growing every day in strength and
velocity across the globe. It is going to be a continual and likely never-ending battle to stay ahead of it — and,
unfortunately, not every battle will be won. Rest assured that we will stay vigilant and do what we need to do to
enhance our defenses and protect our company.
22