The New Target for Cybercriminals

Businesses both large and small, across industries, fall victim to data breaches every day. One of the top targeted industries remains financial services. Top financial institutions have made headlines in a string of cyber-attacks against major U.S. banks. While the headlines may not shock anymore, a closer look at why might raise a few eyebrows: employees might be the weak link.

A fraud alert was released by the Federal Bureau of Investigation, the Financial Services Information Sharing and Analysis Center and the Internet Crime Complaint Center warning banking institutions of a trend of cyber criminals targeting bank employees versus the customer. Cybercriminals are targeting employees through spam, phishing, key loggers and remote-access Trojans to intercept bank employees’ login credentials to access an internal network, and schedule illegal wire transfers and payments from the banking institutions.

According to a recent study ‘Managing Cyber Security as a Business Risk: Cyber Insurance in the Digital Age’ released by Experian Data Breach Resolution, conducted in partnership with the Ponemon Institute, more than 50 percent of financial services have experienced a data breach or material security exploit in the past 24 months. The same study also found that 45 percent of those breaches were a result of negligence or mistakes that resulted in the loss of business confidential information.

While it is vital for an organization to have a data breach response plan and the right type of cyber insurance for the organization to mitigate potential damage, it is equally important to provide employees education about data breaches and what policies a company has in place.

When developing cyber security policies, it’s important to include the following advice:

Teach employees to recognize phishing attempts. Additionally, employees should learn not to click on suspicious links or open attachments from unsolicited or unknown emails. Even emails that include personal details about them or comes from an official-sounding organization or employee should be viewed with skepticism.

Do not allow employees to use work computers for personal use. Compromises happen when employees visit sites or use services that are known to host malware that if downloaded from a work computer can get onto the network. Many Next Generation Firewalls also provide some technical protection against employee use of unsanctioned programs or web applications.

Implement a strict BYOD (bring your own device) policy. Decide if your organization is going to allow corporate devices to the network, and manage connections appropriately. If you decide not to limit employees from using their personal computers, tablets and smart phones, require mobile device management software be installed on the devices to protect and control corporate information.

Remind employees to keep track of USB devices that contain work information. Loss of sensitive information, even if not to a hacker, is still a breach and presents liability. Make sure that if sensitive data is being carried through these devices, employees know the responsibility they have to protect that information.

Monitor employee log-ins for suspicious activity, such as unusual log-in times and file access. These are often the best indication that there was a compromise. Regularly checking security logs and configuring network identity and access controls to protect against anomalous login activity will significantly improve security.

As technology evolves, it is imperative for an organization to implement policies to protect their business and brand from potential negative consequences, such as loss of customers, regulatory fines and class action lawsuits.

Bruemmer is vice president with the Experian Data Breach Resolution group.