As both consumer and commercial banking clients shift to primarily utilize online banking, they still have high expectations that their financial assets will be secure. In 2021, the banking industry reported 703 cyberattack attempts per week — a 53% increase from 2020. And the cost of cyberattacks in the industry has reached $18.3 million annually per breach.
Security has never been more important to ensure that your customers’ financial data is both inaccessible to fraud yet accessible to the right people. What are the main vectors of attack, and how can you protect against these?
1. Supply chain vulnerabilities
Cyber criminals often target a specific vendor or software provider by offering your customers or supply chain partners malicious products or updates. Once they’ve successfully compromised distribution systems, malicious actors then enter supplier’s customers’ networks, allowing breaches to further spread.
But, distribution channels within supply chains aren’t the only area vulnerable to exploitation. Threat actors often access customer assets by exploiting your partners’ vulnerabilities. In 2020, the New Zealand Stock Exchange suffered from an extended distributed denial of service (DDoS) attack on a network provider. The stock exchange was forced to halt trading for two days.
Before you contract with a third-party partner, it’s important to evaluate their security structure to make sure they are not a security risk. Review all vendor and partner relationships and networks for vulnerabilities, and mitigate supply chain risk by implementing a Zero Trust network architecture.
2. Employees and social engineering
It may be hard to believe, but employees are the most vulnerable point in your security chain, with human error accounting for over 90% of security breaches. Though rarely malicious, many employees are uninformed or aren’t trained in security awareness. This means they are attractive targets to social engineering attackers. Why? It’s often easier to take advantage of people than a network or software.
Common social engineering techniques can include baiting, phishing, whaling, scareware, old-fashioned dumpster diving, and on-premise theft. Using these approaches, employees can be tricked into handing over sensitive details and credentials such as personally identifiable information (PII), or unintentionally downloading malware.
It is imperative to educate staff through frequent security awareness training, and to keep your employees informed about ever-evolving social engineering tactics and security best practices. In doing so, you can prime your employees to act as the first line of defense against attacks, reducing cyber risk and decreasing the loss of PII, revenue, and brand reputation.
3. Mobile devices and apps
As the world shifts to mobile and online banking, banks are faced with a new set of challenges. Issues you must contend with range from a lack of server security, insecure or ineffective data storage, data leakage, and even ransomware installation.
When the Ecuadorian Pichincha Bank was hit by a cyber attack in 2021, their ATMs and online banking were rendered inoperable. The bank was forced to shut down portions of their network to prevent the attack’s spread.
Your customers expect round-the-clock mobile access to their accounts. Strong mobile security systems can help you provide that. Having these systems in place can help you avoid a breach requiring you to shut down your services, causing disruption and reputational damage.
Mitigating risk requires an understanding of who every user is and where they are coming from. This proactive, Zero-Trust or ‘least privilege access’ approach challenges the user to prove they’re not an attacker. Methods like multi-factor authentication (MFA) and encryption can stop attackers before any intrusion occurs.
4. Ransomware
The abundance of sensitive data held by your bank, including customers’ Social Security numbers (SSN), banking details, and PII, make you an attractive target for ransomware attacks.
Ransomware can cripple systems and expose customers’ data, and malicious actors expect banks to pay inflated ransoms to recover sensitive data and avoid costly downtime. In 2021, vulnerabilities in a file-sharing server used by Flagstar Bank were exploited, resulting in a ransomware ‘gang’ extorting the bank and publishing personal details of the bank’s customers on their leak site. This data included names, SSNs, addresses, tax records, and phone numbers.
It’s critical you prevent these kinds of attacks from hitting your systems, and threat detection and response tools can help you be prepared. Avoid costly downtime and hefty ransoms and maintain your reputation and client trust.
How to proactively prevent attacks
Leverage cyber threat intelligence in near real-time to shield your bank from all known threats.
By inspecting all network traffic, our service also helps safeguard your network, supply chain, and employees from ransomware and other attacks, whilst improving threat visibility. Learn more about how you can proactively strengthen your cybersecurity posture here.
