Data Breach Scenario: The Human Element – Financial Services Firms

While the news sensationalizes cyber threats from bad actors and nation states, the reality is that the largest threats to organizations are their own employees and contractors. Humans are vulnerable and prone to fall victim to schemes aimed at gaining access to company networks. For their part, the hackers are sly and cunning and know how to take advantage of the weak link. When organizations take the initiative to learn about common data breach scenarios, they can better prepare and protect themselves.

The Verizon RISK team recently published a report, the Data Breach Digest, outlining the most common data breach scenarios. Threats can come from within an enterprise – including third-party vendor partnerships – as well as outside of it. Here is an overview of five scenarios the RISK team investigated, all of which demonstrate how data breaches can be caused by manipulation of individuals’ actions and emotions.

1. Social Engineering

In an example of this scenario, a company rival e-mailed a chief design engineer. The e-mail masqueraded as a recruitment device, including an attachment with job openings. However, the attachment installed malicious software that was able to access classified design plans for a new piece of equipment. With these plans in hand, the rival was able to produce a copycat product, and the victim lost intellectual property.

2. Financial Pretexting

Financial pretexting generally involves manipulating human emotions in order to gain access to highly sensitive financial information.

In this particular case, a banking organization learned that someone had attempted to wire more than $5 million through FedWire. While the attempt failed because of built-in protective measures, the perpetrator managed to gain access to company functions through emailing an employee. This employee, a regional manager, received an email ostensibly from the company’s CIO, complementing her.

She clicked on a hyperlink in the email, which initiated the installation of malicious software. In this case, the software not only scraped data but was also capable of initiating wire transfers through the computer.

3. Digital Extortion

Extortion works by demanding that victims pay a ransom in order to recover data, unlock computers and devices, or even gain back control of the network . This form of cyber attack represents a growing threat. For one manufacturing and retail company, an extortion attack began when a member of the IT team received two emails claiming to have several years’ worth of customer transaction data. After validating the threat, the company revamped its e-commerce platform and publicly admitted that two million customer records had been compromised.

4. Insider Threat

Insider attacks are less common, but can be devastating. These attacks rely on trusted employees or contractors who have privileged access to network data.

Verizon reports that the majority (63%) of data breaches over the previous three years involving “insider and privilege misuse” were financially motivated. The majority of other cases involve disgruntled employees and revenge. In one example given, a company in the middle of a buy-out received a tip that a middle manager was accessing and abusing the CEO’s email account.

Ultimately, investigators discovered that the manager was working in concert with an IT administrator to access the CEO’s email account by taking advantage of the spam filter.

5. Partner Misuse

Business partners and trusted vendors are essential for business, but unscrupulous partners can be disastrous. One oil and gas company experienced a data breach at the hands of a partner gas station company. Several computer systems at the gas stations were able to access the parent networks, and one employee was ultimately found responsible.

Protecting Your Organization

These sobering scenarios suggest that companies must be on alert for data breaches caused by humans – whether accidental or intentional. Here are some steps companies can take to protect themselves:

• Provide employee education on common social engineering methods
• Thoroughly vet all business partners
• Use multi-factor authentication for sensitive data and systems
• Monitor all networks and limit privileged access

Data security is our number one priority at Fairdinkum Consulting. Our engineers have decades of experience and will work tirelessly to ensure your company is safe from data breaches. Contact us for a free consultation or download our Financial Services Cyber Security Audit Checklist now to test your current security protection.

{{cta(‘eb238fed-92de-4a6b-a44c-7472f398616a’,’justifycenter’)}}

You may want to read 5 Things Financial Firms Need To Know About Cyber Security.

Related Articles:

Data Breach Scenario: Weak Configuration

Data Breach Scenario: Malicious Software

 Criteria for Evaluating EMM/MDM Solutions