A new report by Constella Intelligence raises questions as to whether the sector is doing enough to protect itself.
The rash of high-visibility ransomware attacks is shining a bright light on the measures available to the federal government to assist targeted companies. The keyword there is “assist” Rep. Jim Langevin, D-R.I., said last week at CyberNext DC. The government won’t fully protect them. The most significant companies in sectors designated as critical infrastructure must first have a sufficient level of cybersecurity maturity so they can participate in their own defense.
The financial services industry is one such sector. Given that it is globally critical, and so much of its activity today is 100% reliant on IT systems and the internet, financial firms such as banks and credit unions should be among the most vigilant.
A new report by Constella Intelligence raises questions as to whether the sector is doing enough to protect itself, particularly among the largest—thus most critical—firms. The company “conducted an analysis of metrics pertaining to the digital vulnerabilities of major Finserv organizations … by aggregating and analyzing exposures of the top twenty financial services companies on the Fortune Global 500 list, including a sample of executives from these companies.” The analysis covered the period of 2018-2021.
It identified 6,472 breaches and leakages, plus more than 3.3 million exposed records from the 20 companies—with the number of exposed records growing “six-fold” in just two years. About two-thirds of the breaches and leakages included personally identifiable information (PII), including the top executives from breached companies in 71% of the recorded cases.
The report acknowledges that the worldwide pandemic has played a role. Many financial institutions were forced to shift to hybrid and remote work models, drastically increasing the number of at-risk endpoints and stressing companies’ cybersecurity resources.
But “left unchecked, this exposed data spells serious digital risk for financial services companies with expansive attack surfaces, sensitive data and critical operations,” wrote Sean Tierney, vice president of threat intelligence at Constella.
Employees in the Finserv sector increase that risk through their own conduct, the report found, by using their company email accounts, for instance, to visit non-essential sites—entertainment, news, retail and gaming, to name a few. And the exposure of senior executives’ PII is another risk accelerant because they generally have privileged access to their companies’ networks, data and critical infrastructure.
“Although cyberattacks may appear to be entirely technological or corporate threats, the human and social components are of central significance,” Tierney told Nextgov. “Increasingly distributed networks mean that threat actors can cause disruption to critical systems from a wide range of attack vectors, often exploiting employees and their exposed personal information and corporate credentials to infiltrate networks and inflict extensive interruptions and disarray. Financial institutions must take these factors into account to help reduce their cyber risk.”
Constella offers four recommendations to lower financial institutions’ risk profile:
- Avoid using corporate email and related corporate credentials outside the work environment.
- Limit the use of personal data in both the corporate environment and social networks.
- Use a strong password that is consistent with the company’s established security policies—and do not use that password for personal accounts.
- Continuously monitor the external threat landscape for any sign of exposed credentials.
