Financial Sector Breaches Soar Despite Heavy Security Spending

Banks and other financial firms have disclosed three times as many breaches so far this year than they did in 2016, Bitglass says.

The preparedness of banks to deal with threats, such as a recently reported plan by criminals to launch mass attacks on ATM machines worldwide, would appear to be shaky at best considering the number of data breaches in the financial sector this year.

Security vendor Bitglass recently analysed data breaches disclosed by banks, insurance companies, investment firms, and other financial services institutions thus far in 2018 and compared it with the same data from two years ago.

Between January and August this year, financial firms disclosed three times as many breaches as they did in the same period in 2016. There are103 in 2018 compared to 37 two years ago. The top three breaches alone this year compromised more records than the 64,512 records exposed in all of 2016, Bitglass said.

Hacking and malware were once again the primary causes like they were in 2016, and accounted for 74% of the data breaches that financial companies have disclosed so far this year. Nearly 15% of the breaches resulted from accidental data disclosures. 

Among the financial institutes that have disclosed breaches this year is RBC Royal Bank, Goldman Sachs, Fidelity Investments, Sallie Mae, and Dun & Bradstreet. 

The biggest incident involved an employee at SunTrust Banks who stole the names, addresses, phone numbers, and account balances of some 1.5 million of the banks' customers. In another instance, attackers managed to gain access to the Royal Bank of Canada's travel rewards website and steal payment card data belonging to some 66,000 individuals.

The breach numbers suggest that while financial services companies spend more on cybersecurity than most other organizations, and are more heavily regulated than others, the sector as a whole doesn't appear to becoming a whole lot more secure over time.

One of the reasons, of course, is that cyber-criminals target banks and financial institutions more heavily than organisations in most other industries (with the exception of government and healthcare). Banks and other financial firms have significantly better defenses against malicious activities, but precisely for that reason they also tend to be targets of much more sophisticated threats.

Just one example of the constant and rapidly evolving threats that banks face is a new global campaign that cybercriminals are reportedly preparing to conduct large-scale theft from ATMs worldwide. The FBI has supposedly warned banks to be on the lookout for the attacks in coming months.

Another reason is that financial services institutions, like organizations in other sectors, have a tendency to over-rely on the tools they already have in place, says Jacob Serpa, product marketing manager at Bitglass. 

Companies often tend to stick with their existing tools because they have invested significant funds in them, and because they overestimate the ability of the products to deal with current and emerging threats, he says.

Regulations such as the Gramm-Leach-Bliley Act and PCI DSS have been useful in getting financial companies to pay more attention to security, but many continue to treat compliance with these regulations as the end goal of their security efforts.

"Companies should consider compliance with regulations like GLBA and PCI DSS as the bare minimum for cybersecurity, while understanding that much more needs to be done to be truly secure," Serpa says.

Not Just About the Money

Market research firm IDC expects that enterprises worldwide will spend north of $91 billion on cybersecurity this year. Banks, the federal government, and discrete manufacturers will be the biggest spenders, with more than $27 billion in spending.

While such spending might indicate banks are getting better at security, that is not always the case. Deloitte's cyber risk service practice earlier this year surveyed CISOs from 51 organisations in the financial services sector including banks, insurance companies, and investment management firms about their cyber risk management strategies.

Deloitte's study showed that the amount of money an organization spends on cybersecurity doesn't automatically translate to better security. 

Deloitte found that many financial companies with below average security spending had a better risk posture than companies that spent a lot more. Factors that did affect security were top-level accountability, a culture that emphasized shared responsibility for security, and a risk-focused approach to mitigating security threats.

At the same time, Deloitte also found that larger financial companies are not allocating enough resources to cybersecurity, with budgets ranging between 5% and 20% of the total IT budget, and the average hovering around 12%.

Dark Reading:

You Might Also Read:

US Banks Face A Growing Threat

« Secret Military Technology Now On Your Smartphone
Blockchain Tech Promises Better Security For IoT »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Chatham House

Chatham House

Chatham House is an independent policy institute based in London. Topics cover foreign affairs and defence including cyber security.

Palo Alto Networks

Palo Alto Networks

Palo Alto Networks, the global cybersecurity leader, is shaping the cloud-centric future with technology that is transforming the way people and organizations operate.

Karamba Security

Karamba Security

Karamba provide an IoT Security solution for ECUs in automobiles which ensures that all cars are protected (not just autonomous cars).

SecurePay

SecurePay

SecurePay is Australia's premier payment gateway, with a range of secure online payment solutions for online retailers, SMEs and enterprise businesses.

Bit4id

Bit4id

Bit4id provides software and systems for security and identification based on PKI technology.

TÜV Informationstechnik (TÜViT)

TÜV Informationstechnik (TÜViT)

TÜViT is a leading service provider in the IT sector offering unbiased and independent tests and certifications of IT products, hardware, software, systems and processes.

Newtech Recycyling

Newtech Recycyling

Newtech Recycyling specializes in the removal and disposal of IT infrastructure which has reached the end of its life cycle.

CyPhyCon

CyPhyCon

CyPhyCon is an annual event exploring threats and solutions to cyber attacks on cyber-physical systems such as industrial control systems, Internet of Things and Industrial Internet of Things.

Gytpol

Gytpol

Gytpol is a leader in Endpoint Configuration Security (ECS) solutions, providing validation, remediation & securing of IT Policies and IT Infrastructure on-premise and in the cloud.

Cyber Security Cloud (CSC)

Cyber Security Cloud (CSC)

Cyber Security Cloud provides web application security services worldwide using world's leading cyber threat intelligence and AI technology.

Cubro Network Visibility

Cubro Network Visibility

Cubro network visibility solutions remove network monitoring ‘blind spots’ to provide enhanced visibility and control of all data transiting a company’s network.

TopSOC Information Security

TopSOC Information Security

TopSOC Information Security provide a wide range of security consultation, implementation and training services.

BlockAPT

BlockAPT

BlockAPT, empowering you with an advanced, intelligent cyber defence platform. We protect our customers digital assets by unifying operational technologies against advanced persistent threats.

MedSec

MedSec

MedSec is the only company of its type focused solely on cybersecurity for hospitals and medical device manufacturers, offering both a cybersecurity software solution and consulting services.

X-Analytics

X-Analytics

X-Analytics is a cyber risk analytics application to create a better way for organizations to understand and manage cyber risk.

Rebellion Defense

Rebellion Defense

Rebellion Defense is a technology company developing advanced software to ensure mission-critical organizations stay ahead of emerging threats.