How Financial Institutions Can Address Their Top Cybersecurity Challenges

Financial institutions are a top focus for cybercriminals for obvious reasons, including the value of the information they hold, and the opportunities bad actors see for large payouts.

According to Verizon’s Data Breach Investigations Report, the financial sector is consistently among the most targeted industries, and the rate of attacks is growing. Banks saw a 238% increase in attacks for 2022 alone. The average data breach in the financial sector costs $5.9 million, which trails only the healthcare sector in average cost, according to IBM’s Cost of a Data Breach Report 2023.

While the industry has made significant strides with cybersecurity, there are countless factors that still make banks and financial institutions attractive targets.

The Challenges Of Protecting Financial Data

Several issues contribute to the difficulties financial institutions face in protecting their assets. One of the most significant is the complexity of the business environment, especially for larger institutions that have undergone mergers and acquisitions. Connecting legacy networks and applications can result in misconfigurations introducing vulnerabilities that provide hackers easy entry.

Financial institutions, like many businesses, also have a more distributed workforce in the wake of the pandemic. As a result, they have had to integrate greater uses of cloud and mobile computing which increases the attack surface. And, despite the implementation of modern, outward-facing applications, it’s not uncommon for banks to have 50-year-old applications  - written in COBOL - running on the back end that are long past the point of being supported. These applications can become risky from a security perspective, but often do not make financial or operational sense to update.

Despite all these risks, most attacks hinge on the human element in the form of identities on the network. Active Directory and the Importance of Identities. User identities play a big part in many cyberattacks, whether breaches result from insider actions, external attacks, or the involvement of third-party partners.

When it comes to identity threats, a malicious insider can cause extensive damage. The most notable example being the 2019 Capital One hack. Almost four years later this particular hack is still widely recognised as one of the greatest insider threats to date. A single insider was responsible for the theft of 100 million customer records, 140,000 Social Security numbers and 80,000 bank details of customers. And a credential compromise from outside an organisation is really just another type of insider threat. Once external attackers gain access by stealing credentials, they operate like a trusted insider.

Third-party risk can also cause severe damage. Most financial institutions have dozens to hundreds of vendors, service providers, and other partners connected to their network. For savvy hackers, a breach in a third-party system can create the perfect jumping off point to enter financial environments.

What's the one similarity these attacks share? The most common avenue for these breaches is Active Directory (AD).

When someone asked Willie Sutton why he robbed banks, he replied, “Because that’s where the money is.” So, why do cybercriminals attack Active Directory? Because that’s where the privileged access is. AD is so tightly woven into most organisations that it’s involved in 9 out of 10 cyberattacks. Microsoft estimates threat actors attack 95 million AD accounts each day, and that’s on the conservative side.

Whether an attacker gains access through phishing or other means, moving to an identity-rich area like Active Directory can allow them to elevate privileges, move across networks, and steal data or launch ransomware attacks. These types of attacks can bring banks and other financial service operations to a halt, preventing access to funds, leaking customer data and causing brand damage.

Breach Preparedness & Other Best Practices

To better protect their data, banks and financial institutions should start with prioritising their risk. They need to accept that breaches will happen, so they must identify their highest-priority assets - those that would cause the most damage if compromised - and the vulnerabilities of those assets.

Breach preparedness begins with an assessment of AD security, along with reviews of an organisation’s security architecture, operational procedures and security configurations. This allows security teams to identify attack paths and develop plans for response and remediation. With thorough assessments of the environment, organisations can develop threat mitigation plans to reduce the attack surface, optimise security configurations and create a thoughtful plan for recovering from an attack that reduces downtime and disruption.

Continually monitoring user identities is also very important. If a lower-level employee suddenly has elevated privileges, is accessing sensitive data they shouldn’t be reviewing, or is operating at odd hours and not performing regular business tasks, there’s a chance their identity is compromised.

Finally, planning should have a human element, in the form of recruiting and retaining security personnel and educating users. Banks and financial institutions must attract and retain knowledgeable security practitioners, which is easier for large institutions to afford. But in organisations of any size, security is a small part of the business. Financial institutions still have hordes of people with limited knowledge of security who are accessing systems and handling sensitive data. As such, employee training and security awareness is essential, especially with an increasing number of remote workers.

The Future Of Financial Sector Security

With the pace and sophistication of attacks on the rise, institutions need to gain visibility into their environments, get control of user identities and develop clear plans for breach preparedness, response and recovery.

Looking forward, financial institutions will also have to confront the risks associated with new threats and challenges with cryptocurrency. As with all forms of security, it comes down to mastering the fundamentals of gaining visibility into and control over the enterprise. 

 Igor Baikalov is Chief Scientist at Semperis

Image: Simon Kadula

You Might Also Read: 

Operational Resilience: More Than Disaster Recovery:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

 

« Five Tips for Securing Your CI/CD Pipeline
Britain Removes Chinese Components From The National Grid »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Bromium

Bromium

Bromium deliver a new technology called micro-virtualization to address the enterprise security problem and provide protection for end users against advanced malware.

Fox-IT

Fox-IT

Fox-IT prevents, solves and mitigates the most serious cyber threats with smart solutions for governmental bodies, defense, law enforcement, critical infrastructure, banking and large enterprises.

Lacework

Lacework

Lacework brings speed, scale, and automation to cloud security and allows security and DevOps teams to collaborate on keeping data and applications safe.

Guardsquare

Guardsquare

GuardSquare is the global reference in mobile application protection. We develop premium software for the protection of mobile applications against reverse engineering and hacking.

Farsight Security

Farsight Security

Farsight Security provides the world’s largest real-time actionable threat intelligence on how the Internet is changing.

CyberMDX

CyberMDX

CyberMDX delivers proactive security built for hospital devices. 360° visibility, insight, and protection for all connected hospital technologies.

Elemental Cyber Security

Elemental Cyber Security

Elemental is a game changing cyber security compliance automation and enforcement technology provider.

Netragard

Netragard

Netragard has an established reputation for providing high-quality offensive and defensive security services.

SIRP Labs

SIRP Labs

SIRP is a Risk-based Security Orchestration, Automation and Response (SOAR) platform that fuses essential cybersecurity information to enable a unified cyber response.

Anthony Timbers LLC

Anthony Timbers LLC

Anthony Timbers is a cybersecurity consulting and penetration testing firm providing services to the Federal and Commercial sectors nationwide.

Fortified Health Security

Fortified Health Security

Fortified’s team of cybersecurity specialists is dedicated to helping healthcare providers, payers and business associates protect their patient data across the Fortified Healthcare Ecosystem.

Obsidian Security

Obsidian Security

Protect your business-critical applications by mitigating threats and reducing risk with Obsidian, the first truly comprehensive security solution for SaaS.

CERT.ar

CERT.ar

CERT.ar is the national Computer Emergency Response Team for the technical-administrative management of computer security incidents in the National Public Sector of Argentina.

Safe Data Storage

Safe Data Storage

Safe Data Storage offer a fully managed, professional, secure UK-based online backup service to businesses, education and charities.

Trovent Security

Trovent Security

Trovent was founded with a clear goal: to support medium-sized companies in significantly increasing their IT security level.

Iron EagleX

Iron EagleX

Iron EagleX deliver engineering solutions in cloud computing, big data, cyber, and machine learning technologies to US Government customers.