How Financial Institutions Can Address Their Top Cybersecurity Challenges

Financial institutions are a top focus for cybercriminals for obvious reasons, including the value of the information they hold, and the opportunities bad actors see for large payouts.

According to Verizon’s Data Breach Investigations Report, the financial sector is consistently among the most targeted industries, and the rate of attacks is growing. Banks saw a 238% increase in attacks for 2022 alone. The average data breach in the financial sector costs $5.9 million, which trails only the healthcare sector in average cost, according to IBM’s Cost of a Data Breach Report 2023.

While the industry has made significant strides with cybersecurity, there are countless factors that still make banks and financial institutions attractive targets.

The Challenges Of Protecting Financial Data

Several issues contribute to the difficulties financial institutions face in protecting their assets. One of the most significant is the complexity of the business environment, especially for larger institutions that have undergone mergers and acquisitions. Connecting legacy networks and applications can result in misconfigurations introducing vulnerabilities that provide hackers easy entry.

Financial institutions, like many businesses, also have a more distributed workforce in the wake of the pandemic. As a result, they have had to integrate greater uses of cloud and mobile computing which increases the attack surface. And, despite the implementation of modern, outward-facing applications, it’s not uncommon for banks to have 50-year-old applications  - written in COBOL - running on the back end that are long past the point of being supported. These applications can become risky from a security perspective, but often do not make financial or operational sense to update.

Despite all these risks, most attacks hinge on the human element in the form of identities on the network. Active Directory and the Importance of Identities. User identities play a big part in many cyberattacks, whether breaches result from insider actions, external attacks, or the involvement of third-party partners.

When it comes to identity threats, a malicious insider can cause extensive damage. The most notable example being the 2019 Capital One hack. Almost four years later this particular hack is still widely recognised as one of the greatest insider threats to date. A single insider was responsible for the theft of 100 million customer records, 140,000 Social Security numbers and 80,000 bank details of customers. And a credential compromise from outside an organisation is really just another type of insider threat. Once external attackers gain access by stealing credentials, they operate like a trusted insider.

Third-party risk can also cause severe damage. Most financial institutions have dozens to hundreds of vendors, service providers, and other partners connected to their network. For savvy hackers, a breach in a third-party system can create the perfect jumping off point to enter financial environments.

What's the one similarity these attacks share? The most common avenue for these breaches is Active Directory (AD).

When someone asked Willie Sutton why he robbed banks, he replied, “Because that’s where the money is.” So, why do cybercriminals attack Active Directory? Because that’s where the privileged access is. AD is so tightly woven into most organisations that it’s involved in 9 out of 10 cyberattacks. Microsoft estimates threat actors attack 95 million AD accounts each day, and that’s on the conservative side.

Whether an attacker gains access through phishing or other means, moving to an identity-rich area like Active Directory can allow them to elevate privileges, move across networks, and steal data or launch ransomware attacks. These types of attacks can bring banks and other financial service operations to a halt, preventing access to funds, leaking customer data and causing brand damage.

Breach Preparedness & Other Best Practices

To better protect their data, banks and financial institutions should start with prioritising their risk. They need to accept that breaches will happen, so they must identify their highest-priority assets - those that would cause the most damage if compromised - and the vulnerabilities of those assets.

Breach preparedness begins with an assessment of AD security, along with reviews of an organisation’s security architecture, operational procedures and security configurations. This allows security teams to identify attack paths and develop plans for response and remediation. With thorough assessments of the environment, organisations can develop threat mitigation plans to reduce the attack surface, optimise security configurations and create a thoughtful plan for recovering from an attack that reduces downtime and disruption.

Continually monitoring user identities is also very important. If a lower-level employee suddenly has elevated privileges, is accessing sensitive data they shouldn’t be reviewing, or is operating at odd hours and not performing regular business tasks, there’s a chance their identity is compromised.

Finally, planning should have a human element, in the form of recruiting and retaining security personnel and educating users. Banks and financial institutions must attract and retain knowledgeable security practitioners, which is easier for large institutions to afford. But in organisations of any size, security is a small part of the business. Financial institutions still have hordes of people with limited knowledge of security who are accessing systems and handling sensitive data. As such, employee training and security awareness is essential, especially with an increasing number of remote workers.

The Future Of Financial Sector Security

With the pace and sophistication of attacks on the rise, institutions need to gain visibility into their environments, get control of user identities and develop clear plans for breach preparedness, response and recovery.

Looking forward, financial institutions will also have to confront the risks associated with new threats and challenges with cryptocurrency. As with all forms of security, it comes down to mastering the fundamentals of gaining visibility into and control over the enterprise. 

 Igor Baikalov is Chief Scientist at Semperis

Image: Simon Kadula

You Might Also Read: 

Operational Resilience: More Than Disaster Recovery:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

 

« Five Tips for Securing Your CI/CD Pipeline
Britain Removes Chinese Components From The National Grid »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Global Secure Solutions (GSS)

Global Secure Solutions (GSS)

Global Secure Solutions is an IT security and risk consulting firm and authorised ISO training partner for the PECB.

WIRED

WIRED

WIRED is the magazine about what's next – the people, the trends and the big ideas that will change our lives. Topics covered include cyber security.

ITrust

ITrust

French cybersecurity pure player since 2007. ITrust offers its Cyber expertise services and develops disruptive products in Cyber/Artificial Intelligence.

CERT-EU

CERT-EU

CERT-EU is a permanent Computer Emergency Response Team for the EU institutions, agencies and bodies.

Me Learning

Me Learning

Me Learning provides engaging, informative and clearly explained learning materials for complex and challenging professional environments in areas including GDPR and Information Governance.

Deep Mirror Automotive Cybersecurity

Deep Mirror Automotive Cybersecurity

Deep Mirror Automotive Cybersecurity make Cars & Infrastructures Cybersecure.

Partnership for Conflict, Crime and Security Research (PaCCS)

Partnership for Conflict, Crime and Security Research (PaCCS)

PaCCS delivers high quality and cutting edge research to improve our understanding of current and future global security challenges in areas including cybersecurity.

InsightCyber

InsightCyber

InsightCyber is on a mission to keep the world’s critical infrastructure, supply chains, and manufacturing operations cyber-safe, helping to prevent attacks that can have catastrophic impacts.

VariQ

VariQ

VariQ is a premier provider of Cybersecurity, Software Development and Cloud services to federal, state, and local government.

FAIR Institute

FAIR Institute

The FAIR Institute is a non-profit professional organization dedicated to advancing the discipline of measuring and managing information risk.

MyCISO

MyCISO

MyCISO is the World’s first SaaS application that will vastly simplify security management for all.

UK Cyber Cluster Collaboration (UKC3)

UK Cyber Cluster Collaboration (UKC3)

UKC3 has been launched to support Cyber Clusters and encourage greater collaboration across regions and nations of the UK.

RSK Cyber Security

RSK Cyber Security

RSK Cyber Security are a leading cyber security services company that uses services, consulting, and product knowledge to lower security risk across the board.

Unit 42

Unit 42

Unit 42 brings together world-renowned threat researchers, incident responders and security consultants to create an intelligence-driven, response-ready organization.

Silk Security

Silk Security

Silk is the first platform that enables enterprises to take a strategic, sustainable approach to resolving code, infrastructure and application risk.

MLSecOps Community

MLSecOps Community

The MLSecOps Community is a collaborative space for machine learning security experts and industry leaders to connect and shape the future of AI/ML security.