Financial cyber crime is on the rise, says Cat Allen, Product Marketing Manager at cyber firm Forcepoint.
Imagine logging into a trading app only to find that all your positions have been sold and the subsequent funds siphoned out of your account. This was a reality for some Robinhood users last year when cyber-criminals gained access by breaching personal email accounts. The attack unleashed a huge amount of complaints on social media, where investors complained of their attempts to call the company about the attack with no success. As a result, many victims of the breach had to wait to be contacted by the company to understand the fate of their funds.
This type of situation is a nightmare for any management team, regardless of industry. By not responding swiftly and effectively, businesses risk revenue loss, customer churn and negative brand reputation.
The scale of the problem
An internal investigation of the Robinhood breach revealed nearly 2,000 accounts were compromised, with concern that the number may be much larger. For a company that reported $150 billion total transactions in 2019 alone, with 4.3 million daily average revenue trades, the potential for compromised accounts to wreak havoc on financial markets is a real possibility (Gamestop, anyone?). It’s not just Robinhood. Other fintech companies found themselves in hackers’ crosshairs in 2020:
•In March, Finastra, one of the largest fintech companies in the world that works with 90pc of the world’s 100 largest banks, suffered a ransomware attack due to a compromised network. The cause? An accelerated digital transformation in response to COVID-19. The intrusion led to compromised employee accounts and the installation of backdoors throughout their critical network infrastructure. Fortunately, they were swift with their response and able to pivot without being forced to pay the ransom.
•In July, digital banking app and “tech unicorn” Dave.com admitted to a security breach that impacted 7.5 million users’ data. That data ended up available for download in a public hacking forum. The breach was caused by the compromised network of a third-party service provider.
Crimes of opportunity
For bad actors, when it comes to the financial industry, the motives are clear. According to Verizon, 71pc of all data breaches are financially-motivated and could cost up to $18.3 million per company in the financial sector, according to Accenture and the Ponemon Institute.
According to PwC’s latest Global Economic Crime Survey, 56pc of UK businesses stated they have been impacted by financial fraud in the last year, which is higher than the global finding of 47pc. The study also revealed that cyber criminals love uncertainty and disruption, and the COVID-19 pandemic has created a huge opportunity for criminals to target unsuspecting individuals. In fact, a recent survey by Forcepoint reveals over half (52pc) of UK employees are under increased pressure due to remote working and as a result are undertaking risky behaviours that expose organisations to cyber threats.
Security versus convenience
Think of security and convenience at two opposite ends of the technology scale. When there is more emphasis on the side of security, businesses are inevitably sacrificing some level of convenience. The more secure a product, often the less convenient it is to use. For example, with two-factor authentication there is an additional layer of added security, meaning an additional step that individuals must complete before gaining access to a service. Such additional steps may deter users from using the service if it’s too time consuming or cumbersome to manage.
The opposite is also true: the more convenient a product is to use, the less likely it will be secure. This is largely attributable to how corporations have traditionally approached software design, with many businesses focusing on creating good user experience rather than a secure one. The more convenient the user experience is, the more likely the user is to return to use the same service or product.
Changing paradigms
Traditional infrastructure-centric security is failing to address challenges posed by the new work environments and people working from anywhere while accessing critical organisational data. As part of this transition, it is no longer enough for organisations to just know how data is being accessed, but it’s important to know who is accessing that data and what they are doing with it.
Forward-thinking companies are now leveraging new team structures, such as DevSecOps, to integrate security into the software development lifecycle. This is with the aim of exceeding compliance standards to stop known threats that come with being connected. However, there is no such thing as cybersecurity silver bullet, as humans will inevitably find new and innovative ways around, or through, any given system.
Ensuring network security teams have enough free time to not only manage fleets of firewalls, but to also threat hunt and monitor anomalous network activity is also key. The human element of cybersecurity plays an integral role. After all, the SolarWinds breach was discovered by a routine security hygiene task. Enabling anytime, anywhere, any device access is crucial to business success, but so is continuous monitoring of data interactions. The best cybersecurity defence will encompass three key areas: people, processes and technology.
There is hope on the horizon. By leveraging the power of automation to restrict and prevent data exfiltration, by equipping NetSec teams with battle-tested edge protection solutions and by adopting the Zero-Trust approach of “Never Trust, Always Verify” across the three key areas of cyber defense, businesses can arm their organisations with a superior approach to security and begin to effectively shift left of the breach.
