Cybersecurity threats are a major concern for many. Over 143 million Americans were affected by Equifax's breach and the number is still growing. It is also one the many cybersecurity threats being experienced by financial institutions. The main reason behind this is failure to keep updated with respect to the latest cybersecurity practices. Often, financial institutions feel burdened trying to keep up with these threats as they are constantly changing.
On top of that, cyber-attackers are prepared to counterattack these steps, as they're continuously adopting new techniques to stay ahead of any threat mitigation tools which a financial institute can possibly choose. This ongoing cat and mouse game has brought cyber-threats to the top of all business executives’ minds, with IBM’s CEO, Ginni Rometty calling cybercrime the “greatest threat” to every business in the world today. This is because experts believe that ransomware costs $5 billion alone in 2017 – an increase of 15 times since 2015 when it only cost $325 million. These costs include business disruption, data loss, lost productivity, reputation damage, employee training, and disaster recovery.
It's important to understand that ransomware isn't the only type of network security threat that businesses must watch out for. There are other imminent threats, such as trojans, against which financial agencies must develop an understanding and invest their money to ensure protection against. Recently, South American banks have faced the cybersecurity threat of a trojan virus which attempted to steal their credentials. In light of these threats, one has to be aware about the source of these malware types.
Increased Risk Comes from Third-Party Agreements
Many financial institutions rely on partnerships to reduce costs associated with compliance of regulations (i.e. rather than building solutions to help them meet compliance in-house, they source them from cloud vendors or other partners). However, it’s important to understand that a business is only as strong as the weakest third-party vendor. This means that if a vendor faces a threat, you could also be vulnerable. With this in mind, it's time to review all of your third-party contracts, keeping cybersecurity threats in mind throughout the process. Consider the following:
- Who's responsible for protecting your data?
- What regulations do you need to follow to remain in compliance?
- Who could cause something to go wrong?
Failure to think about these things can cost dearly, more so than just damage of reputation. This is why there is a need to think through your cloud-based vendors. Although using cloud-based vendors is really convenient, your ability to keep important data safe is still at stake. Lack of oversight is a number one so, before using cloud-based technologies for protecting data, some of the following things have to be kept in mind:
- Where's your data stored?
- Who can access the physical facility where your data is stored?
- How does the cloud-based service provider protect your data, especially when it's being transferred and stored?
DDoS Attacks via the IoT
Cloud-based technology is only one example of how emerging technology brings new threats with it. This is something that a lot of companies finally realized in 2016 when the largest Distributed Denial of Service (DDOS) attack via the Internet of Things (IoT) occurred. In this attack, unsecured IoT devices were hacked and the resultant botnet wreaked havoc online, causing outages on popular sites like Twitter and Amazon. These threats are growing more complex today thanks to the proliferation of IoT devices, which include things like fitness monitors, tablets, and smart home devices.
As a financial institution, you must take these threats very seriously because they can send your customers into a state of panic. This can occur when an IoT hack brings down the website via a DDoS attack that prevents customers from logging into their bank accounts or prevents them from using an app to do so. During this time, customers can't access their money until you bring the attack under control. This could be a nightmare for your firm's reputation.
This is just one of the many reasons why senators introduced bipartisan legislation that aimed at decreasing the cyber-risk in the IoT. In doing so, they've mandated that device manufacturers must meet minimum cybersecurity requirements (e.g. enabling device patching to address vulnerabilities, allowing users to change the default password). While this legislation should reduce the risk of IoT devices being used maliciously, it doesn’t eliminate the responsibility of a financial institution to protect their assets. You should have a disaster recovery plan and may want to consider a third party DDoS protection service. Get more tips for defending against DDoS here.
Threats from Inside Your Business Itself
Besides, looking outward for external risks, it's equally important to look inwards. In fact, according to IBM's 2016 CyberSecurity Intelligence Index, this is where one can find 60% of the threats to an institution. This is the same report that indicated that the financial industry is one of the top three industries that cybercriminals target. Of these threats, three-quarters were intentional, implying that these were carried out by a disgruntled employee who wanted to harm the business. The other one-quarter were caused by human error (e.g. an employee who unknowingly downloads a suspicious file and unleashes malware throughout the banking system).
This type of threat is so harmful because it comes from inside your financial institution, which is an area where your threat mitigation tools don’t really work. For this reason, these threats often go undetected for a long time, allowing them to cause a lot of harm. Understanding this should make you want to put stricter security policies in place. However, this can backfire too because it can lead to a decrease in employee satisfaction which results in reduced productivity.
As such, the best course of action here is to focus mainly on your most valuable assets. Consider which employees actually need access to these resources and systems and implement access control policies to limit exposure. Employee cybersecurity training is also extremely important. Phishing attacks are one of the most common entry points for attackers; arm your employees with tips for spotting imposter emails or websites and run simulation tests to help protect against this.
Cybersecurity Never Sleeps
These threats are serious and you must treat them as such. Cyber-attacks are constantly evolving and staying on top of the latest threats is half the battle. Of course, you can’t stop there though. Make sure to follow through and get some protection in place too.
Remember, it's a matter of when not if, you'll be attacked.
About the Author
Known for his boundless energy and enthusiasm. Evan works with MWR Infosecurity as a Network Security Manager, an avid blog writer, particularly around technology, cybersecurity and forthcoming threats which can compromise sensitive data. With a vast experience of ethical hacking, Evan’s been able to express his views articulately.
Note: This blog article was written by a guest contributor for the purpose of offering a wider variety of content for our readers. The opinions expressed in this guest author article are solely those of the contributor and do not necessarily reflect those of GlobalSign