With the ever increasing number of financially oriented businesses, there are a lot more assets that are of value to criminals—in addition to money. This includes retail customers’ personal data as well as competitive information. It’s all valuable. And it’s a big reason why financial firms get attacked four times more often than firms in other industries.
Multiple Attacks, Multiple Attack Methods
One study reported a staggering 21 million fraud attacks and 45 million bot attacks on the financial sector in the last quarter of 2015. More recently, the financial sector was named the most-attacked industry, ahead of the Information Technology and Retail industries. Financial services experienced 27% of all security incidents in 2017 and were the target of 54% of all phishing detections.
Bot threats—often launched to trigger a distributed denial of service (DDoS) attack—aim at crippling an institution’s ability to function. Other threats focus on data theft or gaining unauthorized access to a customer’s account.
Common attack methods including phishing, which involves tricking retail banking customers into revealing account numbers or passwords to their banking accounts. It often comes in the form of a phony email or website that looks similar to the legitimate version, and fools users into giving up their login details, enabling hackers to extract data and/or money.
More sophisticated, “spear phishing” attacks send misleading emails to specific employees who unknowingly download malware that, once within the financial firm’s network, sends internal data back to the criminal. Tricking users into downloading keyloggers is yet another tactic used by hackers to capture passwords.
Increased Regulator Scrutiny
The importance of the financial sector to economic performance has kept firms in the regulatory spotlight for a number of years. But it’s only recently that cybersecurity has become a focus of regulatory agencies like the SEC that are going beyond just issuing cybersecurity guidelines, to imposing stiff penalties on firms that fail to protect customer information. The failure of one financial advisor to safeguard customer information resulted in a penalty of $75,000.
For financial sector firms that want to protect their business and customers, understanding which regulations apply to them is key. Some agencies have issued guidance. Others, like the CFTC (Commodities Futures Trading Commission), have moved beyond simple guidance to requiring firms to conduct certain kinds of testing on a regular basis.
Firms also need to be aware of applicable state regulations. New York, for example, has proposed regulations and suggested a partnership between federal and state agencies to develop a cybersecurity framework.
Preparing to Meet the Cybersecurity Challenge
To satisfy regulators’ compliance concerns, protect themselves from penalties, and avoid losing business and data, financial firms need to take a deep look at their cybersecurity policies and technical architecture. While insider threats are significant, the most common attacks come from outside the country, mobile devices, and third party vendors and partners with access to internal data.
Protecting against these threats requires a multi layered security approach that:
- Scales to cover devices, networks and the cloud;
- Provides visibility across all users and access points; and
- Uses threat intelligence effectively to achieve genuine security.
Building a multi layered security approach requires a combination of highly specialized, network security expertise and an understanding of the risks to it and key regulatory challenges. That’s where Infogressive can help.
We can get you on the path to stronger security and easier compliance by performing a cyber threat assessment to identify vulnerabilities in your network and its biggest risks. We can then recommend and deploy best-in-class cybersecurity technology to give you a defense-in-depth infrastructure that protects data privacy and your good standing with financial regulators.
Updated on May 16th, 2018.
