An Inside Job: Looking For Cyber Criminals

Everybody in business, and especially in banking, embraces the need for aggressive and comprehensive defenses against hackers, right?

And then comes this report from KPMG with the discouraging headline: “12% of banking CEOs don’t know if their bank has been hacked.”

The audit, tax, and advisory firm surveyed 100 bank executives from banks that have more than $20 billion in assets.

Worse, researchers found that at these banks’ second tier of officers—including executive vice-presidents and managing directors—the level of awareness gets worse. KPMG reported that 47% said they didn’t know if their bank had been victimized by cyber-crooks. The next level—senior vice-presidents and directors—were even worse: 72% were unaware.

“Banks are under an onslaught of attacks from bad actors, so the fact that 12% of banking CEOs reported that they don’t know if they’ve been compromised is troublesome. Cyber is a business bottom-line issue: a true CEO issue,” says Charlie Jacco, financial services cyber leader at KPMG. “While CEOs may be more privy to information regarding the exact number of cyber technology deployments and hack attempts, all employees should know and be in lock-step on their bank’s greatest vulnerabilities and concerns as it pertains to how that bank views cyber security.”

Wait … what?

Before one jumps all over the C-suiters for their apparent lapse of knowledge about hacks close to home, there is this to consider: According to another recent KPMG International report, some of them might actually be the culprits.

This report analyzed profiles of 750 cyber-crooks investigated by forensic specialists across 81 countries, and produced what it calls “the new face of fraud”:

• 69% were between the ages of 36 and 55.

• 65% were employed by the company that was hacked.

• 35% were executives or directors.

• 38% had been with the company for at least six years.

• 38% described themselves as well-respected in their company.

• 62% colluded with others in their crimes.

While personal gain was the predominant overriding motivation for committing fraud (60%), the sense of “Because I can” was third at 27%, according to the report.

The exposure of being unaware

Again, you just have to scratch your head. Insiders, it seems, pose the biggest threat for cybersecurity forces to deal with. This includes not only the bad actors, but also otherwise innocent staff members who are unaware of the threats to their companies, and who don’t know what defenses their companies mount against cyber-threats.

This comes from a joint study by Experian Data Breach Resolution and the Ponemon Institute. They asked more than 600 individuals at companies that currently have a data protection and privacy training program to weigh in on the topic of negligent and malicious employee behaviors.

The study found that 55% of the companies surveyed have already experienced a security incident due to a malicious or negligent employee. Sixty percent of companies surveyed believe their employees are not knowledgeable or have no knowledge of the company’s security risks. Only 35% said senior management believes it is a priority that employees are knowledgeable about how data security risks affect their organization.

“Among the many security issues facing companies today, the study emphasizes that the risk of a data breach caused by a simple employee mistake or act of negligence is driving many breaches,” says Michael Bruemmer, vice-president, Experian Data Breach Resolution. “Unfortunately, companies continue to experience the consequences of employees either falling victim to cyberattacks or exposing information inadvertently.”

And the beat goes on …

To be sure, the usual reports about the growing magnitude of the threat and the certitude of being attacked keep surfacing. Here are just a few recent ones:

• Gartner: By 2020, 60% of digital businesses will suffer major service failures due to the inability of IT security teams to manage digital risk.

“Cybersecurity is a critical part of digital business with its broader external ecosystem and new challenges in an open digital world,” says Paul Proctor, vice-president, Gartner.

• CompTIA: Technology professionals see many steps that could be taken to improve their company’s security, according to a survey of 500 security professionals.

“Just under half (47%) say there’s a belief within their company that existing security is ‘good enough.’ For 43%, other technology needs take a higher priority than security,” according to the report.

• SANS Institute: Malware, unauthorized access, and advanced persistent threats remain the top threats, while a lack of expert staff is harming incident response.

“While automation and new tools are helping response teams,” says Matt Bromiley, SANS analyst, “65% of survey respondents see a skills shortage as an impediment to incident response efforts. Training and experience is the difference between breached and not breached.”

Does old culture not get it?

Interestingly, a recurring theme through some of these reports is the need for cultural change within the organization. That makes sense. If the threats are internal, the defenses also need to be internal.

• Gartner puts it this way: “With the acceleration of digital business and the power that technology gives individuals, it is now critical to address behavior change and engagement—from your employees to your customers. Cybersecurity must accommodate and address the needs of people through process and culture change.”

• Experian puts it this way: “Organizations need to foster a culture of security. The study found that companies are not currently implementing a number of simple incentives that could encourage positive security behaviors. Of the companies surveyed, 67% provide no incentives to employees for being proactive in protecting sensitive information or reporting potential issues.”

• CompTIA puts it this way: “The use of technology has outpaced cybersecurity literacy, so there’s also a growing need for the overall workforce to improve their knowledge and awareness of security issues.”

Banking Exchange:

« Email Scams: Criminals Try To Steal $3bn
Preliminary Agreement On Airline Cybersecurity »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

Clusit

Clusit

Clusit is the Italian Association for Information Security, a nonprofit organization devoted to promoting every aspect of information security.

DTS Solution

DTS Solution

DTS Solution delivers advanced cyber security solutions through is technology partnerships with industry leading security vendors and advanced consulting services.

RedShield Security

RedShield Security

RedShield is the world's first web application shielding-with-a-service company.

Acuant

Acuant

Acuant is a leading global provider of identity verification, regulatory compliance (AML/KYC) and digital identity solutions.

Novastor

Novastor

NovaStor® is an award-winning, international data backup and recovery software company with solutions supporting physical, virtual and cloud environments.

Department of Justice - Computer Crime and Intellectual Property Section (CCIPS)

Department of Justice - Computer Crime and Intellectual Property Section (CCIPS)

The Computer Crime and Intellectual Property Section (CCIPS) is responsible for implementing the Department's national strategies in combating computer and intellectual property crimes worldwide.

PizzlySoft

PizzlySoft

PizzlySoft is a global company that is seeking convergence of network and security / software and hardware. We put our value on creating the best security.

SoloKeys

SoloKeys

SoloKeys provides the first open-source FIDO2 security key: Protect your online accounts against unauthorized access by using the most secure login method.

Association of anti Virus Asia Researchers (AVAR)

Association of anti Virus Asia Researchers (AVAR)

AVAR's mission is to prevent the spread of and damage caused by malicious software, and to develop cooperative relationships among anti-malware experts in Asia.

du

du

du is a telecommunications service provider providing UAE businesses with a vast range of ICT and managed services.

LAVAAT

LAVAAT

At LAAVAT, our goal is to make it easy for our customers to build secure IoT devices without a need to invest considerably in embedded security and cryptography expertise.

Mirai Security

Mirai Security

Mirai Security are a cyber security company that specializes in Governance, Risk Management and Compliance, Cloud Security and Application Security.

OccamSec

OccamSec

OccamSec is a leading provider in the world of cybersecurity. We provide accurate, actionable information to reduce risk and enable better informed decisions.

SecureClaw

SecureClaw

SecureClaw offers specialized cybersecurity consultation, various products, and a range of services to meet your company's business domain needs.

Falconfeeds

Falconfeeds

Falconfeeds empowers businesses and security professionals with immediate access to the latest and historical threat intelligence data.

CERT.ar

CERT.ar

CERT.ar is the national Computer Emergency Response Team for the technical-administrative management of computer security incidents in the National Public Sector of Argentina.