Cost Of Cybercrime Increasing For Financial Sector

It’s no secret that cybercrimes cost money to remediate. In fact, the bill can be rather high and in the financial sector, the cost of cybercrime has increased by 40% since 2014. In the past year, it rose 9.6% alone. This is all according to a report conducted by Accenture and the Ponemon Institute.

The Cost of Cybercrime Study found that for direct costs for incident response, as opposed to long-term remediation, the average incendnet cost for the financial sector reached $18.28 million in 2017. That’s up from $12.97 million in 2014. For all other industries, that figure was a “measly” $11.7 million in 2017.

The good news is that although the per cost figure is higher, financial services companies are spending resources in a more appropriate way to fight cybercrime. More is going into funding for key security technologies that can fight off the ever-evolving and sophisticated attacks such as malware attacks and vulnerability exploitation. That has led to the decrease in incidents in the industry of these types of threats.

The top two threats to the financial sector were malware and web-based attacks that had average incident costs of $2.36 million and 2.01 million respectively. Even with aggressive investment into technology to mitigate cyberattacks, they continue to plague the industry. Continued cybersecurity education that helps turn employees from a risk to a layer of protection has become a top goal for the industry. Denial-of-service attacks, for which there really are no defense technologies, had an average incident cost of $1.56 million. 

Social engineering is how many cybercriminals succeed. It’s at the foundation of nearly all attacks. A cybercriminal will convince someone to do an action they otherwise may not. This could come in the form of a business email compromise (BEC) where someone who can perform wire transfers does so after receiving an email request from someone they believe has the authority to ask for it. It could be by posing as a pest inspector and convincing a receptionist to allow him into the server room to “do a quick check for pests.” It could even begin on social networking sites, such as LinkedIn. A lot of information about what people do in an organization can often be found there and on other similar sites.

Training employees and others who work in the office on social engineering tactics is something that cannot be overlooked these days. Successful attacks due to social engineering, which include phishing, cost the sector $196.6 million per incident.

Isn’t conducting continual awareness training on the current threats and social engineering tactics a better use of funds than remediating a phishing attack?

Threats change all the time. There is no standard template for a phishing email message anymore. There is no way to profile the “typical” cyberthief. Making sure the people who have access to your data and information is the best defense and is far less costly than the alternative.