Being Sensitive To Attacks On Banks
Elangovan, October 2, 2019The best way to live beyond every security issue in the banking sector is for you to be sensitive to omen of attacks. Once you feel it, then you swing into action before such becomes a reality. This is another way of being proactive. This is the main thrust of my manpower training. While bank authorities have invested billions of dollars into the security of the sector, the only aspect, which is however important but has been shunned, is training employees how to activate their sensitivities to occurrences. People seem to be too concerned about their primary responsibility that they fail to think of those things that might possibly hinder such.
In recent years, the advent of technology has made the threat to cyber attacks the headache of every financial institution. In fact, when we talk about threat in the 21st century financial sector that is where the mind wanders to. According to Osmanoglu, hackers targeting financial services companies typically seek out four types of information:
- Access credentials and tunnels to systems to send money from home equity line of credit, money transfer systems, and the SWIFT network.
- Intelligence about money movement, specifically bank and market activity, and access to customer accounts and information to target customer systems.
- Specific financial data that can be altered and used for trading in financial markets
- Account data like personally identifiable information, account information, credit and debit information, and sensitive transaction data (Patterson, 2016).
Hacking a bank is complex, and after a successful intrusion and exfiltration hackers possess valuable knowledge about the process, Osmanoglu said. A successful raid will result in a comprehension of how the network was compromised, data stored on the network, and competitive intelligence, like access to confidential email and trading strategies (Patterson, 2016). These are the real attacks that banks must never allow to happen. Being sensitive to attack is to understand ways in you can prevent criminals from having a successful raid.
To prepare for a hack, companies should build a response protocol that includes:
- Consulting with legal counsel around the details of the breach.
- Engaging a qualified, experienced breach response firm to help investigate the root cause of the breach and ensure that the problem is addressed and the attacker is contained.
- Establishing an internal and external communications plan about the breach.
- Learning from the breach to ensure controls are updated and processes are improved (Patterson, 2016).
Biz Tech (2018) also states plausible ways in which banks can be prepared for an attack on its systems. They are:
Identify workers with opportunity and access: Banks should identify staff members beyond the C-suite and management teams who have access to customer information and other business-critical data and systems, because cybercriminals certainly have. Attackers mine social media and public websites, among other sources, to identify key individuals, such as loan officers, before targeting them directly (Biz Tech, 2018). You need to be sensitive and cautious while dealing with this set of people. This where the fortunes of your bank lies and you handle it determines the kind of result you get at the end of the day.
Be serious about security awareness exercises: Employees who transfer funds regularly, manage sensitive data or participate in important business functions need additional training on how to spot and avoid more sophisticated phishing traps, according to experts’ postulations. Cybercriminals frequently exploit employees’ fear and anxiety to solicit a quick (or unsafe) response via email targeting. It’s a good idea for users to ask themselves these questions about any email they receive: Was I expecting this message? Does this email make sense? Am I being pushed to act hastily or out of fear? Does this seem too good to be true? What if this is a phishing email? All these questions are coined to arouse the sensitivity of the person in charge. If you can think ahead, no cyber attacker can take you unawares. Going for security awareness training other than the conventional ones is advisable. My training teaches bank workers how to be suspicious of people both in the physical and virtual realms.
Shift your attention to public-facing information: Bank and credit union technology teams should communicate with marketing and C-suite teams about the potential hazards of sharing company details on public channels such as public-facing websites or social media, Egan, a security expert, advises. That can be a double-edged sword in the banking world, where organizations strive to make it easy for customers to contact them, while still offering protection from cybercriminals and social engineers. Egan cautions that if information such as general email aliases, phone numbers, or lists of bank staff and their roles are visible publicly, cybercriminals will use the information to launch phishing attacks. IT staff should monitor all inbound email channels (even aliases) and train personnel who respond to inbound communications to recognize and avoid malicious messages (Biz Tech, 2018). Nothing confidential should be made public. In your bid to satisfy your customers always, don’t be tempted to surpass your boundaries in order not to backfire.
Be very meticulous in your analysis of malware-like behaviors: Banks should consider deploying tools such as IBM’s Trusteer Rapport, which uses advanced analytics and machine learning to analyze suspicious behavior, increasing the chances that the software will detect and remove malware before it can infect a computer or broader network, IDC’s D’Alfonso says. Many banks now offer Trusteer as a free service for users to download before continuing any e-commerce functions. In as much as I am a strong advocate of humans being at the helms of affairs, we must embrace the reality that humans cannot do everything. When software are rightly deployed, they can be invaluable to the security of the banking sector.
Make authentication a continuous process: Behavior biometric products that feature continuous authentication can detect nonauthorized users, such as a fraudster or a bot, D’Alfonso says. Such new tools help users safely authenticate and transfer money or pay bills, while continuous authentication keeps watch during every step of the process. Staying on top of phishing requires consistent training and adjustments on the part any organization looking to combat ever-evolving threats. And while new behavioral and analytics tools can help, banks and credit unions can also achieve a great deal simply by keeping better tabs on employees and offering frequent training updates (Biz Tech, 2018).
References
Biz Tech (2018). 5 Ways Banks Can Combat Phishing. Retrieved from https://biztechmagazine.com/article/2018/10/5-ways-banks-can-combat-phishing
Lohrmann, D (2014). Ten Recommendations For Security Awareness Programs. Retrieved from http://www.govtech.com/blogs/lohrmann-on-cybersecurity/Ten-Recommendations-for-Security-Awareness-Programs.html
Patterson, D (2016). How Banks Fight Back Against Cyber-attacks. Retrieved from https://www.techrepublic.com/article/how-banks-fight-back-against-cyberattacks/
© 2019 LPS Training Services All Rights Reserved.