When you think of data that 100% needs to be encrypted, what comes to mind? How about financial data? When your bank sends sensitive financial info about your clients to other institutions, what are you doing to secure that data? Chances are, you’re using keys generated by your in-house PKI, or Public Key Infrastructure, to encrypt financial messages as they move throughout your back-office ecosystem and reach their eventual endpoints (whether that’s the SWIFT gateway or another similar system).
Instances of cyber-attacks on banks and other financial institutions are on the rise. This may come as no surprise to you, but did you know that during the Covid-19 pandemic, these attacks have spiked an incredible 238%? That’s according to a report from VMWare’s Carbon Black cloud division. The same report states that over ¼ of all cyber-attacks this year have targeted either financial or healthcare institutions. What are you doing to ensure the privacy and security of your financial information?
Banks and other financial institutions are suffering under the weight of a staggering 238% increase in cyber attacks since the beginning of the Coronavirus pandemic and ensuing lock-downs. While there are myriad reasons for this added attention from bad actors, the simple fact remains that these organizations are vulnerable due to broad attack surfaces that include numerous distinct endpoints.
Let’s say you’re a pizza delivery person showing up at someone’s home: you expect him to pay for the pie you’re delivering, but when he opens the door he claims that he never placed an order and won’t accept the delivery. If the order was placed over the phone, there’s not much you can do. Someone might have spoofed the phone number in order to perform a prank, and there’s no real way to prove who actually placed the order. Luckily, the order was actually placed via a delivery app—meaning that the recipient had to sign in to an account associated with his address and credit card. Once you pull up the app on you phone and show the nogoodnik a record of the transaction, the jig is up, and he’s forced to pay out.
SWIFT CSP’s mandatory controls get more numerous and stringent with every yearly release, and it can be difficult for even the most tech-savvy banks to keep pace. Beginning in July 2020, for instance, self-attestations will require independent audit assessments that cover at least the mandatory controls. This audit can be conducted by an internal or external team, but SWIFT seems to be pushing for (and in some instances requiring) outside assessors to help banks understand their own compliance pictures.
Data, whether it’s in motion or at rest, is constantly imperiled by hackers and fraudsters. This means that encryption is more important now than ever—a fact that most businesses around the world are quickly catching onto. Even as the consensus grows around the importance of encrypting both caches of stored data and communications like emails and other messages, however, there isn’t really a unified theory of how best to implement encryption in way that makes operational sense while minimizing potential attack vectors. As a result, around two-thirds of businesses list cryptographic key management as either a medium or large challenge.
In a survey of several thousand IT professionals across a dozen countries, 57% of respondents said that encryption key management at their company was “painful.” In a similar study, the risk and cost associated with key management was, on average, rated a seven out of 10. Those percentages change from year to year, but as the importance of encryption becomes increasingly obvious across different sectors, the total number of businesses dealing with serious encryption key pain is only going to go up.
At a SWIFT-run business forum a few years ago, a handful of banking insiders gave a rundown of the cybersecurity threats that keep them up at night. Some of what they were worried about was predictable—giant data breaches running hundreds of millions of dollars, adversaries getting smarter and more sophisticated, etc.—but some of it displayed a little more nuance. Some were specifically worried that they might completely miss a cyberattack and only realize what had happened much later (which is hardly an implausible scenario). Others were worried about the high rate of false positives in anti-fraud operations.
Right now, your bank is probably vulnerable to costly cyber attacks. Why? Because, like most financial institutions, you probably haven’t implemented end-to-end encryption or robust endpoint protection. It’s easy to understand why something like this could fall through the cracks—no one wants to shell out for a complex software solution whose purpose they don’t fully get—but the next big cyber bank heist is coming, and you probably don’t want to be the victim.
In 2018, the Bank of Chile found that the malicious KillDisk virus had infiltrated 9,000 of its computers and 500 of its servers and was poised to wreak havoc on their internal systems. Understandably, they immediately went into crisis mode, working as quickly as possible to disconnect those workstations. During the ensuing flurry of activity, the hackers were able to perform their real attack completely unnoticed: $10 million worth of fraudulent SWIFT transactions that the bank was too busy to notice.