Finance Groups Pay 'Lip Service' to IT Security