Don't let the Financial sector be a leading target of cybercrime

The financial sector caught in a balancing act of regulation compliance and cybercrime defence

Reports like these often shock and destabilise the financial world:

              +++++++++              A new case of JACKPOTTING: Cybercrime on ATMs          ++++++++++
This is what experts call attacks in which either malicious software has been installed on ATMs or criminals succeed in connecting their computer and inducing the ATM to dispense cash, e.g. through the Cutlet Maker malware.

How can this be prevented? By regular updates, encrypted data transfer, the blocking of USB ports and execution control of only approved programs. 

++++        Banker TROJANS +++++++  PHISHING +++++++ Bank customer's data hacked        +++++++++

• Banker Trojans have infected 800,000 Android devices in the past four years. The people behind the group called Geost steal access data to bank accounts.

• Using spear-phishing, criminals have succeeded in penetrating the IT system of an Eastern European bank using the IT system. For 2 months they spied out the system without being disturbed and collected information  to carry out illegal transactions or take over ATM infrastructures.

• More than 100 million bank customer's data were hacked in the USA: In July 2019, it became known that a hacker at US-Bank Capital One stole millions of sensitive customer data contained in credit card applications. The bank also announced that it expects additional costs of about USD 100 million to USD 150 million due to the cyber attack in 2019 alone.

Banks under supervision and regulations

IT security has been a high priority in the banking sector since its evolution into digitalisation. The requirements concerning cyber security include for example an appropriate IT strategy and management of information risks, information security and user authorisation. These are to be implemented in concrete terms with technical-organisational measures. In Europe, for example, the European Central Bank has announced the Cyber resilience oversight expectations (CROE), specifying the requirements for the resilience of the financial market infrastructure to cyber risks.

Also, financial institutions in some countries are also classified as critical infrastructures, for which security measures must be implemented and proven.

From this perspective, it does not matter which regulation or guideline you consult: as a financial institution you must give top priority to cyber and IT security.

Why is the financial sector particularly lucrative for attacks?

• In banks and insurance companies there exist significant amounts of confidential customer and account data.
• Electronic payment transactions, trading systems, payment flows and millions of accounts offer profit-oriented cyber organisations a lucrative breeding ground for manipulating account/customer data and transactions (e.g. bank transfers).
• Online banking is widely-used and leaves potential gateways for unmaintained private devices or carelessness on the customer's behalf. 

What are the requirements regarding data processing and data security?