It’s an unfortunate reality that any business can suffer serious financial repercussions from data breaches and cybercriminal attacks. According to a recent Kaspersky Lab survey of nearly 4,000 global IT professionals, the loss of financial data can cause up to $938,000 in total damages for a company. This figure includes costs such as improving IT infrastructure and hiring new specialists, as well as the costs of PR consultants to mitigate reputational risks and auditors, lost contracts, increased insurance premiums, etc. But the nature of the attack suffered, or the type of data stolen, can create a different set of costs and consequences for each business, and Kaspersky Lab’s survey shows that financial information stolen from a bank or a financial institution creates a particularly expensive mess. For these financial institutions, the true cost is measured in damage to their reputation, which produces a worse long-term consequence than the immediate costs of the data breach itself.
It should come as no surprise that businesses are unwilling to manage their money with institutions that have less-than-perfect reputations for security, and Kaspersky Lab’s survey confirmed that the security reputation of banks and financial institutions was a huge factor in whether or not businesses would partner with them. Banks and financial institutions may possess millions of dollars, but their reputation is their most valuable asset…and that asset can be easily damaged by the near-constant efforts of cybercriminals.
Kaspersky Lab’s survey also took a close look at business IT operations dealing with electronic banking, and published the full results in the Online Financial Fraud Prevention summary report. This survey conclusively demonstrated the importance of a strong reputation for security among financial service providers, and highlighted how easily that reputation could be damaged by general malware, targeted attacks to steal data, or even attacks aimed at disrupting service. With these points in mind, Kaspersky Lab can offer a number of tips and solution recommendations to help banks and businesses keep their financial information secure.
The Importance of Reputation
Banks and financial institutions clearly see the need to maintain the trust of their clients in the face of cyber-attacks. Almost half (47%) of banks and financial Services said “loss of credibility/damage to company reputation” was their most commonly-feared consequence of a data breach. This was the most feared outcome amongst the financial services companies surveyed.
Their fears are justified: according to Kaspersky Lab’s survey, 74% considered the strength of bank’s security reputation when choosing a financial partner for their business. IT professionals are not overly impressed with banks’ current security efforts, as only 53% of businesses felt financial organizations did enough to protect their businesses banking data.
While banks and financial organizations are responsible for maintaining their own security reputation, the survey data shows that businesses are willing to be engaged in the overall process of financial data security. More than one-third of businesses (34%) believed that financial institutions were ultimately responsible for the security of their business’s financial transactions…but even more businesses (57%) believed that their own management and IT departments were ultimately responsible. These businesses not only acknowledge their own role in securing financial transactions, they’re also likely to be receptive to any assistance a bank can provide them, giving financial institutions an opportunity to add value to their business relationship with their clients.
Threats and Outcomes of Breaches
When asked about data breaches that had been experienced and the types of data lost, bank and financial institutions had alarming news to share. Of all banks and financial institutions that reported a data breach in the previous 12 months, 41% said they lost “Financial/Payment Information,” while another 35% specifically cited the loss of “Customer Data.” This fits into the “worst-case scenario” of most businesses, since these are the top two items cited by banks when asked about the types of data the fear losing the most.
To examine these data breaches more closely, the survey respondents disclosed the types of cyber- attacks that caused the loss of this information. Targeted attacks were cited by 44% of all businesses as the cause of lost financial and banking information, with “Network Intrusion and Hacking” cited as a factor by 42% of businesses.
Maintaining the trust of their clients means not only securing secure vast quantities of personal and financial data belonging to their customers from theft, but also maintaining their customers’ ability to access this data when they need it. Any disruption in this access can damage a bank’s reputation as much as having the data stolen. This is where distributed denial-of-service (DDoS) attacks can also cause havoc with banks and financial institutions. These DDoS attacks seek only to disrupt the web capabilities of banks, typically trying to prevent customers from accessing their information, but they do not generally result in the penetration of a bank’s network or the theft of customer data.
According to the survey, 39% of banks and financial organizations experienced some form of DDoS attack in the previous year. For all respondents that experienced a DDoS attack, the most feared outcome (26%) was the loss of direct revenue and business opportunities. But these respondents see the bigger picture as well, and listed “loss of reputation amongst customers” at 23%, clearly indicating that the value of their reputation remained in their thoughts.
Recommendations for Financial Services Protection
It’s clear that cyber-criminals don’t need to breach a bank’s network and steal data to harm its business prospects. Even slowing down the bank’s network with a cheap DDoS attack is enough to cause significant damage to its reputation and hurt its bottom-line. Financial organizations require a multi- pronged approach to manage their highly sensitive threat-vectors, and Kaspersky Lab recommends a combination of advanced endpoint protection along with specialized solutions to deal with these unique challenges.
• Targeted attacks are the most common source of lost financial data, and these attacks will often penetrate a network through application vulnerabilities and software exploits. Kaspersky Lab has previously reported on the huge number of attacks on Java vulnerabilities, and how the company’s anti-exploit technology prevented 4.5 million Java exploits in a single year. That’s why it’s important to ensure legitimate applications remain updated to remove any gaps that cybercriminals are able to exploit.
• A comprehensive endpoint security solution will also secure smartphones and tablets through a mobile device management (MDM) policy, ensuring these devices are protected while accessing financial networks, ensure malware can’t steal personal information from the device, and allow sensitive data to be remotely wiped if the device is lost
• Because a DDoS attack leaves customers questioning the safety of a bank’s network, not to mention the loss of contracts and sales, and extra costs to restore the system, advanced protection from these attacks is worth the investment.
• Financial institutions might also consider a more customized solution built specifically for financial networks and transactions, e.g. providing the banks’ clients with security software to be installed on their own computers to ensure online transactions are secure. A solution customized for the needs of the financial industry can also help businesses meet their compliance and regulatory requirements.
• Any business security policy is only as strong as the employees’ knowledge of IT security. Creating an “internal culture of security” with an emphasis on thoughtful online behavior, we are inforced by regular training, is an essential investment for companies that handle sensitive financial information.
Kaspersky Endpoint Security for Business helps to protect company networks against an onslaught of malware. Financial institutions need advanced endpoint security to protect PCs as well as mobile devices and virtual machines from advanced threats.
Kaspersky DDoS Protection protects against DDoS attacks of any complexity, sophistication and bandwidth thanks to Kaspersky Lab’s intelligent anti-DDoS approach and long-term global cybersecurity experience. It helps to avoid or minimize losses – both financial and reputational – caused by downtime of critical online resources.
Kaspersky Fraud Prevention leverages the world’s most advanced global threat intelligence ecosystem and unites a number of technologies to provide “proactive” protection specifically designed for financial services companies and their clients. KFP strategically addresses the root cause of fraud, moves the protection scheme as far upstream as possible, and continuously provides protection throughout each session. It is designed to be transparent to the user and to coexist with existing security controls.
