Understand the threats
EDITOR'S NOTE: Jonathan Bilyk is a freelance writer.
In recent years, few threats have imperiled the safety and security of banks and other financial services businesses as greatly as those posed by cybercriminals.
In this Q&A, Tim Young, director of information technology and cloud operations for OnCourse Learning, outlines some of the more common types of cyber threats facing businesses today. He also discusses ways financial institutions can mitigate risks and better protect themselves and their customers.
Every minute we are seeing about half a million attack attempts in cyberspace. With the average revenue per victim increasing dramatically over the past years, this is becoming big business for threat actors.”
— Tim Young, director of IT and cloud solutions for OnCourse Learning
OnCourse Learning offers a variety of compliance and training solutions for the financial services industry.
Learn More
Q: What do you see as some of the greatest cyberthreats facing financial institutions and other businesses?
Q: Expand on what you mean by “social engineering.”
Q: What are some of the more common attacks institutions see?
Q: Are large or smaller institutions at greater risk? Are most institutions up-to-date with cybersecurity and technology?
Q: How do you foresee the cyberattack threat evolving in coming years?
Q: What steps can financial institutions take to protect themselves against cyberthreats?
Q: Should cyber training be part of a comprehensive compliance training program?
Q: What are the tips you could offer to people employed at financial institutions and other businesses to help them avoid becoming victims of an attack?
Tim Young is director of IT and cloud solutions for OnCourse Learning. Young has worked in the IT industry since the early 1990s.
A: Currently, every minute we are seeing about half a million attack attempts in cyberspace. With the average revenue per victim increasing dramatically over the past several years, this is becoming big business for threat actors. The common denominator in almost all of the cyberattacks? Social engineering.
A: It’s basically using deception to trick a conditioned person into providing key information, usually some combination of username and passwords. It can come in the form of an email that looks official, and tells you something like your account has been corrupted, and to fix it, click here. Then, it takes you to a phony site where you put in your username and password, and now the thieves have your info.
A: Some of the more common attacks are business email compromise, ransomware and availability ransomware. Availability has become the new format that attackers are using in lieu of getting access to data. They simply prevent access to services to affect revenue and generate income for the actors.
A: There are actually three sizes of financial institutions: Small, medium and large. All three types of institutions face similar threats, since they all have end users that can be socially compromised. The larger institutions usually have deeper security protections, but more endpoints, and usually a bigger reward for compromise. They typically have the teams and expertise to defend against an attack. Smaller institutions usually lack the same depth of security, but the reward is smaller, the endpoints are less in numbers, and the potential revenue per victim is much lower. Smaller institutions usually have less complex systems, but those are typically outsourced to larger service companies who have deeper security configurations. The medium institutions that have brought systems back in-house, yet lack the depth of security of the larger financial institutions, are usually the ones with the largest threat target, offering the best revenue potential for attackers. These are usually large community banks or small regional banks.
A: That’s a great question, but unfortunately, I’m not as smart as these hackers. They’re continuously working to sidestep endpoint security measures being put in place, and they’re not going to stop. Diligence is what’s important. I can’t stress that enough.
A: One of the areas that financial institutions are focusing on is the endpoint, implementing comprehensive, multi-layered endpoint protection strategies. This goes well beyond a tier 1 anti-virus/anti-malware software. There are many great tier 1 AV/AM software packages that are great foundations for developing a strong cybersecurity program. When building a program, it must contain an equal balance of tools, processes and people. Just having the greatest tools does not make for a great security platform. The endpoint protection strategy should contain a signature-based AV package, backed by a system that has ethical threat actors identifying the threats, and deploying counter measures, an algorithmic-based zero-day threat prevention, and a host intrusion prevention/detection system. Combine this protection system with intensive end-user training, and a complete defense in depth posture, and you have reduced your threat target. Another significant area of concern for financial institutions is the actual threat response/incident response readiness. Everyone has a plan, but when the doorknob is turned, and the threat actor gets in, this is usually where the plan falls short. Trying to identify the who, what, when and where can be like searching for a piece of straw in a haystack. Everything looks the same, and the actual footprints are hard to identify.
A: Yes. All financial institutions should employ an in-depth end user training system, phishing testing, social engineering penetration testing, and continue training security analysts with the latest and greatest methods and tools.
A: They need to be aware of some of the social engineering scams that are out there. Never open attachments in emails from people you don’t know, or if it’s something you haven’t requested. Check the URL before you click on it. From an institutional perspective, carry out phishing exercises meant to trick end users so people in your organization can see what a phishing attack actually could look like. These exercises will allow you to see which employees may need some more training, and can help identify additional training opportunities and strategies. But just in general, probably the best advice is: If you’re suspicious of something, or there’s even a bit of doubt about something, don’t click on it, don’t open. Call your IT help desk. Always call the help desk.
Learn ways financial institutions can mitigate cyber risks
© 2017 OnCourse Learning Corp. All rights reserved
Contact Us
20225 Water Tower Blvd. Brookfield, WI 53045
By Jonathan Bilyk
More inside this guide
Prevent cyberattacks
Banks must take proactive steps to stay ahead of cybercriminals
Phishing for trouble
Hackers use phishing emails to steal data, penetrate networks
Banks face new cyber regs
New cybersecurity standards could affect large financial institutions
Leading the way
New York establishes first-of-its-kind cybersecurity standards
What you need to know
Ways financial institutions can identify and respond to cyberthreats
Email fraud and cybercrime
Tips to identify red flags and respond to email and cyberthreats
Understand the threats
Learn ways financial institutions can mitigate cyber risks
Reduce cyber risk
OnCourse Learning webinar focuses on cybersecurity issues
Choose the right vendor
Financial institutions can be held responsible for vendor tech failures
Become cyber secure
OnCourse Learning offers cybersecurity training to meet your needs
Take cybersecurity seriously
Guide helps financial institutions identify cyberthreats
Beware of ransomware
Cyberattacks involving ransomware are a growing concern
Stop the bad actors
Terrorists and other groups threaten the financial system
Credit unions raise the bar
Agency creates cybersecurity assessments for credit unions
Cyber preparedness
Why cybersecurity should be a top priority for your financial institution
Increase cyber awareness
Federal and state agencies offer many cyber resources
Protect online payments
Agency warns of cyberthreats to bank payment networks
Training in the cyber age
Preparation is better than remediation when it comes to cybersecurity
How to Navigate
How to Navigate
Move forward or backward between articles by clicking the arrows.
Click or tap to bring up the Table of Contents.
Share articles by clicking on one of the social media icons in the upper right corner of the page.
Use your mouse wheel, keyboard arrow keys, or scroll bar to move up and down in an article.