What is cross-site scripting (XSS)?
Dec 14 2021
Cyber Awareness
Cross-Site Scripting (XSS) is a web application vulnerability that can provide attackers an opportunity to run malicious code on web pages and steal the information of web users.
.png)
The sharp increase in cybercrime worldwide has made most banks employ advanced cybersecurity protection systems. Financial Expert reports suggest that cyber threats in financial institutions have progressed beyond fraud from wire transfers.
In recent years, cybercriminals have been hijacking the digital transformation of financial institutions via island hopping. About 63% of financial institutions recorded a spike in destructive attacks by about 17% from 2021. But what are the specific cybersecurity threats faced by banks in 2022, and what specific solutions can be deployed to mitigate the risk or eliminate the occurrence of cybercrimes?
Ransomware gangs consider banks as attractive targets because they can steal valuable information and sell online on the dark web. A ransomware attack involves locking out users from accessing their computers through malware encryption.
Furthermore, since financial institutions deal with sensitive data, they may be forced to pay the ransom.
Security experts advise banks against paying ransom since leaked data can be compromised and that the cost of ransom may be higher than the cost of data remediation.
Phishing is a social engineering technique used by cybercriminals to trick users into providing their login details so the criminals can access an internal network. Email phishing is one of the most common threats faced by financial institutions.
Malware from email phishing attacks may be installed on user computers if the user opens infected attachments or links. It could also occur if victims load fake web pages designed to harvest their login details. According to Imperva Research Labs report, in the first half of 2021, the banking industry's phishing attacks rose by about 22%. Phishing attacks that target financial applications also increased by about 38% last year.
According to security experts, phishing attacks will further increase and urge banks to sensitize employees and customers to identify potential phishing threats in 2022.
DDoS attacks on financial institutions have also been in the rise in 2022. The goal of these types of attack is to overwhelm a bank's server using fake connection requests. The affected bank may be forced to go offline with difficulties for recovery in a short-term perspective.
Since financial institutions have a diverse surface, including customer accounts, banking IT infrastructures, payment portals, etc., they become an attractive target by cybercriminals for DDos attacks.
Bank Drops are fake bank accounts opened by cyber criminals to store their stolen funds. Criminals create bank drops to confuse authorities from knowing their location. Cyber gangs collect bank customers' details to create so called “full” accounts. They collect information including date of birth, address, full names, credit score, driver’s license details, and social security details.
In addition, the stolen data may be sold on the dark web for about $15 to $60 for each record. Aside from generic “fullz” data (an information package that contains a person’s address, real name and other personal information), business fullz data of bank customers are sold for higher prices - about $35 to $60.
Supply chain attacks are carried out to breach a bank's third-party vendor in its chain that is compromised. Usually, vendors take cybersecurity less seriously than their clients, and since they store sensitive clients' data, cybercriminals can exploit their vulnerability to attack the banks.
Supply chain attacks have risen in 2022 and are further expected to increase. Thus, the banks are advised to implement zero trust cybersecurity measures to deter supply chain attackers.
 (2).png)
To mitigate cybersecurity risk of financial institutions, banks shall employ the following strategies:
By implementing a multi-factor authentication policy, banks can make it more challenging for cyber criminals to compromise their customers' sensitive and privileged data.
Banks can embrace attack surface management solutions to reduce the risk of data breach by ensuring that data leaks are detected internally or from a compromised vendor before it becomes available for the cybercriminal.
Implementing third-party risk management solutions will help in preventing supply chain attacks. It can help banks to identify any security vulnerability from third-party services.
Banks should ensure that their firewall protection program is updated regularly to help detect any attempt of malware injection.
Financial institutions should continuously train employees about cybersecurity best practices, including how they can identify potential threats and mitigate data breaches. They should also educate customers on the need to avoid divulging personal financial details to anyone without reaching out to their banks.
Cybercriminals are constantly looking for new ways to breach the security systems of financial institutions. Thus, banks must step up their cybersecurity defense systems and incorporate advance cybersecurity measures to mitigate and prevent cyber-attacks.