What Financial Executives Need To Know About Cybersecurity

You’ve seen the headlines – another day, another data breach wreaking havoc on an organization’s business. Whereas the negative effects of breaches on business performance are well understood, the financial strain breaches bring should not be overlooked or underplayed. Data breaches divert time and effort from the day-to-day functions of a business, costing firms a significant amount of money to identify, contain and remedy. Data breaches also affect insurance costs and can damage a brand’s reputation and relationships with its customers and partners beyond repair. A company can spend months and even years recovering from the financial toll and negative perception resulting from a data breach.

No one is immune 

Cyberattacks occur in every industry and the problem is far more pervasive than the quintessential scenario of criminals looking to access credit card data or foreign hackers trying to steal top-secret government information. Though the Verizon 2018 Data Breach Investigations Report found that healthcare, hospitality and foods services, and the public sector had the most recorded data breaches in 2017, all industries – from financial services to education and manufacturing – were affected. And it’s not just large, national or multi-national corporations targeted by cybercriminals. In 2017, 58 percent of data breach victims were categorized as small businesses. Companies of all sizes and in all industries need to be aware of their security risks and vulnerabilities.   

Who are the perpetrators? 

Verizon found that 73 percent of data breaches are perpetrated by outside actors – anyone from organized criminals and state-affiliated actors to former employees. The approach and method of the breach may vary greatly between occurrences but most cyberattacks share a financial motivation. A competitor may be looking to steal a manufacturer’s trade secrets to gain a competitive advantage or a criminal group may hold a hospital’s records for ransom, hoping for a large pay-out.

But it’s not just external threats companies need to worry about. Employees can also perpetrate cyberattacks – intentionally and unintentionally. Well-meaning employees going about their daily routine can fall victim to phishing scams, where bad actors send malware via unassuming emails. Indeed, on average four percent of people in any given phishing campaign will click the email – and a hacker only needs to hook one person to gain access. Employees may also be the source of a data breach – either by unintentionally mishandling sensitive information or by maliciously compromising their companies’ systems for personal gain.

Why money matters for breaches 

An FBI report on cyber activity and the US economy estimates that malicious cyberattacks cost the U.S. economy between $57 billion and $109 billion in 2016. According to Cybersecurity Ventures’ 2017 Cybercrime Report, the cost of cybercrime is estimated to reach $6 trillion annually by 2021. On top of this, Verizon’s report found that 75 percent of data breaches in 2017 were financially motivated. Data is expensive and cybercriminals are influenced by the lure of selling stolen IP, stealing financial information to access funds or even holding precious information at a high ransom.

Best practices for financial executives 

Financial executives – often left out of the cybersecurity planning of a company – need to take an active role in the security practices of their organizations as breaches directly affect a company’s bottom line.  As the gatekeepers of an organization’s financial information and activities, financial executives are in the unique position to safeguard one of the areas of a business most-targeted by cybercriminals.

There are several steps executives and organizations should take to protect their information and prepare their employees and systems for potential cyberattack, including:

• Multi-factor authentication: Once a hacker steals an employee’s login credentials, they can spread a virus throughout a company’s systems. To prevent the spread of viruses to other parts of a network, businesses should implement multi-factor authentication (MFA) to access systems, adding an additional layer of security. 
• Employee security training: Employees are a firm’s greatest asset but they can also be a liability as phishing continues to be a prominent method of cyberattack. You should conduct routine security training for all employees to lessen the effectiveness of phishing attempts and reinforce best-practices like shredding confidential information. Also, provide employees with a quick and easy way to report phishing attacks and other suspicious cyber incidents.
• Keep data “need to know:” Keep highly sensitive and secret data – such as financial information – separate from the rest of your network. Restrict data access to individuals who absolutely require it to do their jobs and routinely monitor employee access to determine if the data is being copied, moved or accessed in a suspicious manner.
• Backup your data: Make routine backups of important information. In the event of a ransomware attack, a recent backup of your critical data and assets could mean the difference between a crippling delay in business and a relatively painless return to business-as-usual. Indeed, Verizon saw a significant uptick in ransomware attacks in 2017, making this a very real threat for organizations to consider.
• Monitor network usage for suspicious behavior: Denial of Service (DoS) attacks, which flood the bandwidth of a system to overload it, continue to be a significant problem in many industries. Have a DoS protection service and monitor your daily usage to prepare for spikes in traffic that are indicative of larger than normal legitimate usage.

Cyberattacks show no signs of letting up as attackers continuously evolve their methods to evade detection and work around sophisticated security measures. When the consequences of a data breach are so significant – from financial, legal and reputation perspectives – it is important to implement stringent cybersecurity measures in all departments and levels of an organization.

Cybersecurity is and will continue to be a critical component of a company’s broader risk management strategy and plan for overall business and financial success.

Chris Novak is the Global Director Threat Research Advisory Center at Verizon Enterprise Solutions.