Financial Firms Hit with Million Dollar Losses per Cybersecurity Incident

The costs associated with cyberattacks on the financial sector are rising as organizations face increasingly sophisticated threats. New research by Kaspersky Lab and B2B International reveals the scale and impact of attacks, with financial firms facing losses of nearly a million dollars ($926,000) on average for each cybersecurity incident they face.

The staggering figure is revealed as part of Financial Institutions Security Risks 2016, a survey of finance professionals highlighting the main security challenges for banks and financial institutions around the world and the financial costs of specific cyberattacks.

The most-costly type of incident for financial organizations are threats that exploit vulnerabilities in point-of-sale (POS) systems, in which an organization typically loses $2,086,000. Attacks on mobile devices are the second most costly ($1,641,000), followed by targeted attacks ($1,305,000).

Compliance is the main driver for increasing investment in IT security in banks and financial institutions. However, the study found that 63% of organizations believe that being compliant is not enough to be secure.

Another significant reason for spending more on security is growing infrastructure complexity. For example, an average financial firm adopts virtual desktop infrastructure (VDI) and manages approximately 10,000 end user devices with roughly a half of them being mobile smartphones and tablets.

Insufficient internal expertise, top management directives and business expansion are also among the top reasons for a budget increase.

In general, investing more in security appears to be inevitable to a clear majority of financial firms as 83% of them expect an increase in their IT security budgets.

“Given the substantial monetary losses from cyberattacks, it is not surprising that financial organizations are looking to increase spending on security. We believe successful security strategies for financial organizations lie in a more balanced approach to allocating resources — not just spending on compliance, but also investing more in protection from advanced targeted attacks, paying more attention to personal security awareness and getting better insights on the industry-specific threats,” commented Veniamin Levtsov, Vice President, Enterprise Business at Kaspersky Lab.

The study shows that financial firms seek to address security challenges by getting more threat intelligence and conducting security audits, with 73% considering this measure effective. However, organizations from the financial sector are less inclined to use third-party security services with only 53% of those surveyed perceiving it as an effective approach.

Kaspersky Lab’s experts recommend five key considerations for security strategies adopted by financial organizations in 2017.

1. Beware of the targeted attacks 
Targeted attacks on financial organizations are likely to be conducted through using third parties, or contractors. These companies can often have weaker or no protection at all and can be used as an entry point for malware or a phishing attempt.

2. Do not underestimate less sophisticated threats
Fraudsters can strike at mass and benefit from the scale using simplest tools. Social engineering might contribute to 75% of fraudulent incidents while only 17% could be caused by malware.

3. Do not pick compliance over protection
Budgets are usually allocated in favor of compliance, but strengthening security and introducing new protection technologies requires a more balanced approach to the allocation of resources.

4. Do regular penetration testing: 
Unseen vulnerabilities are real nevertheless. With implementation of sophisticated detection tools and penetration testing, vulnerabilities and incidents will emerge. Ensure your eyes are open to all weaknesses and threats - before it’s too late.

5. Pay attention to insider threats
Employees can be exploited by cybercriminals — or decide to become ones. Effective security strategies should go beyond perimeter protection to include techniques that can detect suspicious activity within organizations.