The finance sector experiences 35% of all data security breaches, earning it the unfortunate title of the ‘most-breached’ sector. The spoils from a successful breach can be worth the effort. The industry is known for its wide array of interconnected systems and the processing of millions of transactions—all good reasons why hackers focus on financial systems vulnerable to attack.
As the threat, frequency and impact of these attacks increase, new regulatory, legal and compliance risks emerge, including litigation and steep regulatory fines. In fact, according to a Forbes Insights/K&L Gates survey, the trends that present the most potential for legal risks include dealing with data (69%), cybersecurity (47%), a changing regulatory environment (46%), fraud protection (39%) and digital transformation (39%).
Regulators are reacting quickly. Both Australian and U.S. regulators recently issued new guidance calling for institutions to be transparent when disclosing cybersecurity risks, even before a breach or attack occurs. Financial institutions are being forced to step up to increase information security, alignment to standards and mandatory compliance. In Australia, APRA’s CPS234 comes into force in July as a mandatory standard.
But getting ahead of hackers requires knowing the dangers that lurk both inside and outside an organisation. There are the top primary threats facing businesses in the financial services sector:
Web Application Attacks
Financial institutions rely on, often outdated, business-critical web applications to serve customers, promote their services and connect to back-end databases. However, many of these applications are exposed to the internet, making them easily accessible to hackers. The volume and types of web application attacks are enormous, automated and varied, ranging from buffer-overflows to SQL injection attacks, in which a hacker injects SQL statements into a data-entry field, tricking the system into revealing confidential data. Web application firewalls are finding their way into more and more financial services applications to mitigate the risks around old web-facing applications.
Distributed denial of service (DDoS) attacks aim to take web-based applications offline, or simply reduce the performance of websites and applications to the point where they slow down or crash. Angry customers who are unable to access critical financial services, can cause immeasurable reputational damage when they cannot access funds when they need them most. For financial services firms, the repercussions usually include disrupted business flows, stolen data, damaged reputation and lost revenue.
After hackers, employees and contractors are the top cybersecurity threats to financial institutions. Unwitting workers fall victim to phishing scams or accidentally download malware. However, disgruntled employees may collude with hackers by sharing passwords or ignoring cybersecurity protocol. Either way, insider threats can take months—sometimes years—to detect.
Mitigating the Risks
With hackers developing smarter and more automated techniques for exploiting vulnerabilities in exposed systems, coupled with increasing quantities of data exposed to these risks, financial institutions are being required by the regulators to take measures to ensure greater data security and minimize risk.
The following mitigations are the most common:
Tighter internal access and logging policies, coupled with more detailed procedures and contractual provisions regarding the discovery, investigation, remediation and reporting of breaches.
Institutions are reviewing their insurance coverage, adding insurance coverage for various types of cyber risks and considering the adequacy of existing insurance programs.
The finance sector is increasingly partnering with third-party cybersecurity teams, outsourcing and retaining consultants, operation centres and intelligence providers that can help manage internet security risk while adding security control frameworks to prevent cyberattacks and data breaches.
In today’s hyper-connected, technology-driven financial services sector, data security breaches, DDoS attacks and insider threats are on the rise. However, executives in the industry can take action by educating themselves on the dangers ahead and taking the right steps to mitigate risk.