There is no doubt that the financial sector has become the most prevalent target for cyber security attacks over the last few years. The COVID-19 pandemic significantly increased fraudulent activity as many people became more susceptible to cyber security attacks by working remotely. Businesses, faced with challenges over diminished cash flow and revenues, applied for emergency loans or Government-backed support and many did not have sufficient cyber security frameworks in place to protect against cyber attacks and are now selecting Cyber Security partners to help manage their Cyber Security. In this blog, we will outline cyber security risks in finance and the measures needed to mitigate it.
Cyber Security Risks in finance
Personal and corporate financial customers have become a natural target for fraudsters with a reported significant increase in the number of ‘phishing’ emails connected to COVID-19 being sent to customers. These communications may look like they are from the financial institution regarding financial support available in the wake of the pandemic but are in fact require customers to provide or validate their account or identity information. Communication via email also expose customers to malware that downloads onto their system once a link is clicked.
Social Engineering victims increase
Call centre fraud has also increased. Customers become victims to social engineering where fraudsters post innocent looking ‘fun’ questions on social media platforms such as ‘what was the name of your first pet?’. This is used to garner personal information then used to impersonate the customer with their bank.
Remote working
The mass migration of the financial sector to working from home during the pandemic has had dire consequences on the exposure of risk. Financial users who accessed their data from offices regulated by sophisticated connectivity and IT systems, are now remote accessing in higher volumes with staff lacking the hardware and software to be controlled by the bank’s Virtual Private Network (VPN). In a household, multiple family members are logging in on the same network and clicking on links and content of many different kinds, potentially exposing previously secured devices to malware that could then enter the firm’s enterprise if the right endpoint controls are not in place.
Looking at a timeline of the types of risk that customers have been exposed to, phishing and fraudulent social engineering are not new; but the volumes have significantly increased since March 2020. We aim to support our financial clients to raise awareness amongst their customers and provide guidance on the basics of good security. Here is a three pillar model to keep your security perimeter safe from pertinent cyber security risks in finance.
How Cyber security Risks in finance have morphed over the last decade
Cybersecurity risks to the financial sector have grown in recent years. This is due to the cyber threat landscape worsening as financial institutions become more frequent targets of sophisticated and destructive activity. For example, in 2006, 3G was just rolling out and there was no such thing as apps. Streaming music, photo sharing, social networks were brand new concepts and so cyber security threats were very different as what was accessible to attackers was limited compared to that of today not to mention the number of remote workers accessing business data remotely due to the pandemic restrictions.
Common Cybersecurity Risks in finance
Malware
Malware is the most common and best-known type of security threat. Since the internet has been used, it has remained a consistent problem. Malware is when an unwanted piece of programming or software installs itself on a target system, causing unusual behaviour. Malware can deny access to programs, delete files, steal information, and spread itself to other systems. The best defence is having the latest anti-malware programs installed. Educating users to recognise suspicious links, files, or websites is generally enough contain most malware threats.
Password Theft
This commonly occurs when an unwanted third party manages to steal or guess a user’s password. The loss of personal data is terrifying enough but when an organisation has been exposed, they risk exposing their customer’s data and their own sensitive organisational information. Education of password security is the first line of defence against theft and social engineering. But to keep our financial organisations safe from its own users, multi-factor authentication (MFA) is the most robust protection method. MFA requires an additional device to complete any login and has algorithms to enforce complicated logins which thwarts brute force attempts. This two-factor authentication method will ensure that cyber security risks in finance are mitigated.
Traffic Interception or “eavesdropping”
This occurs when a third-party “listens” to information sent between a user and host. Log-ins or valuable data are usually stolen in this manner. Users must avoid accessing compromised websites (those not using HTML5) and organisations can encrypt network traffic via a VPN to mitigate this risk.
Phishing Attacks-cyber security risks in finance
Although Phishing Attacks are an older risk, they still work by relying on social engineering via a message or email requesting sensitive data such as a password. The victim clicks on link within the unsuspicious email and accidentally gives away sensitive information.
Whaling Attacks
Whaling attacks are when a C-level executive is targeted with the same social engineering tricks but may even be sent from inside the organisation. There are many cloud cybersecurity services for email, data, and websites that provide organisations with the ability to stop compromises before they reach the user.
Social Engineering
Social Engineering is the technique used to trick users into giving away sensitive information. Occurring via any platform, deviants are very creative and utilise social media to attack their victims. Financial customers and internal users must remain vigilant of suspicious messages, friend requests, emails, or attempts to collect user info from unknown third-parties. Appropriate measures should be implemented to curb cyber security risks in finance.
How can Infinity Group assist in preventing cyber security risks in finance?
Infinity Group, are a leading Cyber Security Company in London with clients in Finance, Retail, Care and Professional Services. Our IT Consultants provide a wide range of Cyber Security Consultancy ranging from CIS Controls, GDPR Audits, IT Security Strategy, Business IT Solutions, Disaster Recovery and Backup solutions and the Cyber Essentials Certification.
