The bank's chief information security officer shared why it took so long for the hackers to get in, what worked during the exercise and what didn't.