Financial firms spend less on information security