Banking Cybersecurity: The Risks Faced by Financial Institutions – Source: heimdalsecurity.com

A data breach in the financial sector is one of the most impactful events in the cybersecurity landscape.

That is because Banking, Financial Services, and Insurance (BFSI) institutions/ financial institutions safeguard and store not only our money but also very valuable data. This includes large amounts of Personal Identifiable Information (PII).

According to a Juniper Research estimate, successful fraudsters would cost businesses around the world over $48 billion in 2023.

These are the biggest banking cybersecurity risks that financial institutions and the insurance industry are experiencing:

Open Banking

Open Banking is a system that gives third-party access to customers’ financial data through the use of application programming interfaces (APIs).

This system is built on the integration of several platforms that can all access the same data.

The “blank space” between the integrated platforms can be a security risk. If a threat actor manages to breach the API, then he has access to all the integrated apps, similar to a supply chain attack model.

In 2022, the most prevalent supply chain attacks reported by FS-ISAC were software update hijacking, malicious code signing, and open-source code compromise.

Online Banking’s UX

Online banking and User Experience (UX) in online banking are now a standard in the industry, as the financial industry shifts more and more towards digitalization.

Economist Impact’s “Banking in 2035: global banking survey report” shows that over the next three to five years, bank management will place a high priority on digital transformation (57% of respondents). This refers to customer-facing services, backend operations, and organizational culture.

The same report also shows banking cybersecurity as the biggest risk of the future.

Shifting online opens unlimited possibilities – with the use of cloud computing and AI – but also potential new threats if it is not followed through with appropriate security measures.

Business Email Compromise (BEC) Attacks & CEO Fraud

In a Business Email Compromise (BEC) attack threat actors send emails impersonating people with authority that the recipient is likely to trust.

The goal is to convince victims to supply card details and login credentials or to make a money transfer.

Such emails can be very persuasive, imitating logos, templates, signatures, etc. According to an FBI report, out of all online attack types in the US in 2021, BEC schemes generated the most revenue for thieves ($2.4 billion).

In addition, FS-ISAC members reported that BES increased by 300% between 2021 and 2022.

Fraud involving criminals pretending to be coworkers in emails is something that is expected to increase, “The Top Banking Fraud Types to Watch in 2023” says, in both businesses and governmental institutions.

This is due to the rise in employees working from home as a result of the Covid-19 outbreak and the use of less secure computer networks such as unsecured BYODs.

In a CEO fraud attempt, the threat actor impersonates somebody from within the organization, typically a manager or higher hierarchy official. The goal is to create a sense of urgency around undertaking a particular action. This will rush the employee to the wrong course of action.

This could mean asking the employee to share important credentials, provide access to systems, or even transfer funds.

Cybercrime-as-a-Service (CaaS) & More

Cybercrime-as-a-Service offers every individual the possibility to be a cybercriminal without the necessary skills – this has also led to a growth in cyberattack numbers.

Malicious individuals can choose to pay for a DDoS attack or an exploitation kit. For example, ransomware packages can be obtained for as little as $1,000 a month, on Telegram or the Dark Web.

Finance remains one of the most targeted sectors by DDoS attacks. FS-ISAC’s joint report with Akamai demonstrated that, compared to the previous year, DDoS assaults on financial institutions increased by 22% worldwide in 2022. Furthermore, the same type of attack increased by 73% in Europe in the same period.

These attacks could potentially result in compliance concerns in the context of banks and financial institutions, which operate in a highly regulated, very complicated environment.

Regarding ransomware, throughout 2022, Lockbit was the most active ransomware operator. Lockbit, such as other Ransomware-as-a-Service (RaaS) providers, indiscriminately targets both the public and private sectors by purchasing infiltrated networks from early access brokers.

Over the years, other noteworthy bands include Black Basta, BlackCat, AvosLocker, and Hive.

In the last year, according to Interpol, CaaS developed into something new, tailored for financial crimes. Financial Crime-as-a-Service offers threat actors the necessary tools to launder money, caching revenues they make from online crime.

Insider Threat

When building up security, BFSI organizations shouldn’t forget about insider threat; they won’t always have bad intent – negligence or human error can also be an opportunity for cybercriminals to exploit.

To overcome this, organizations should train members in banking cybersecurity basics, among other security measures.

The Association of Certified Fraud Examiners revealed that the banking and financial services industry was one of the top three industries affected by internal fraud, with an average loss of $100,000, in its study Occupational Fraud 2022, A Report to the Nations.

Composite Malware

Cybercriminals can use multiple types of malware to reach their targets. Combining numerous tactics or styles of attack is not a novel concept.

Attackers frequently cooperate to attain their goals and divide the loot. Because each type of malware is adept at removing a certain type of defense.

Since OpenAI made ChatGPT available to the public in November 2022, it has successfully responded to requests to create dangerous malware and convincing phishing lures, FS-ISAC says.

More generally, generative language models have already been used to develop info stealer malware, encryption tools, and automated Dark Web marketplaces.

Social Engineering & Phishing Scams

Impersonating the financial institution, a threat actor can gain access to user accounts, card details, etc. These types of attacks take advantage of human nature.

If a cybercriminal can convince even just one employee that they are someone trustworthy, then the whole organization is potentially at risk.

From breaching a single endpoint, threat actors can execute lateral movements and make their way over to more critical assets. Online financial scams can target a large number of a bank’s clients.

Research from the National Cybersecurity Centre shows that the average amount lost in phishing scams is increasing. In the period November 2020 – January 2021, the losses were £549. But the sum went up to £775 over the same period a year later, November 2021 – January 2022.

Cryptocurrency

Financial institutions across the world face several issues as a result of cryptocurrencies.

Threat groups use cryptocurrencies, among other things, in ransom demands to fund their operations.

Cybercriminals often prefer to be paid in cryptocurrencies due to the pseudonymous nature of these digital currencies.

This offers them a certain level of anonymity. Also makes it more challenging for law enforcement agencies to trace the transactions back to the perpetrators.

Additionally, cryptocurrencies provide a decentralized and borderless payment system.

In consequence, enables cybercriminals to receive payments quickly and securely from victims worldwide. All of these are without the involvement of traditional financial institutions or government oversight.

The rise in bitcoin investments shows that this asset class needs better regulation and protection, an FS-ISAC report says.

How Can Heimdal® Help?

Heimdal’s Endpoint Detection and Response combines six cybersecurity solutions in one compact agent. This is a time saver that will not delay your systems.

It offers you prevention features, threat-hunting, and remediation capabilities in an easy-to-deploy solution.

It incorporates our Next-Generation Antivirus, Threat Prevention, Ransomware Encryption Protection, Privileged Access Management, Application Control, and Email Security

This product uses Machine Learning and AI-driven intelligence to prevent advanced ransomware, insider threats, APTs, software exploits, brute force attacks, DNS and DoH Vulnerabilities, phishing and social engineering, and any other known or unknown threats.

Wrapping Up

This underscores the imperative for the financial sector to establish strong technical and organizational safeguards to mitigate cyber threats.

Given that cybercriminals frequently employ cutting-edge malware, the key challenge lies in staying abreast of the ever-evolving cybersecurity landscape.

Consequently, their security strategies must remain dynamic, promptly identify threats, and facilitate effective response to potential attacks.

If you liked this article, follow us on LinkedIn, Twitter, Facebook, and YouTube, for more cybersecurity news and topics.