Effective Strategies to Combat Internal Threats in the Finance Industry

The finance industry is constantly facing evolving cyber security threats. While external attacks often receive more attention, internal threats pose a significant risk that must not be overlooked.

Consider these key statistics from the Securonix 2024 Insider Threat Report:

• Insider attacks reported by organisations rose from 66% to 76% between 2019 and 2024.
• Concern over malicious insiders increased from 60% to 74% in the same period.
• Only 29% of respondents believe they have the right tools to effectively combat insider threats.

These statistics underscore the urgent need to address internal threats within the finance industry. Whether due to malice or negligence, internal threats remain a significant concern.

This article delves into the various types of insider threats, the heightened risks faced by financial institutions, and strategies to effectively mitigate these internal dangers.

Understanding Internal Threats

Internal threats refer to cyber security risks that originate from within an organisation. These can come from current or former employees, contractors, or vendors with access to the company’s systems and data. Essentially, anyone with access to company devices or information can pose an internal threat.

Internal threats jeopardise the integrity, confidentiality, and availability of sensitive information and assets. Traditional security measures often fall short in preventing these threats due to their unique nature.

Why the Financial Sector is Vulnerable to Internal Threats

In the financial industry, employees typically have significant digital access, with an average of 10.8 million files available to them. In larger organisations, this can increase to 20 million files. This extensive access highlights the vast amount of sensitive data within financial institutions.

The challenge for the industry lies in securing this data against both compliance requirements and internal threats. As financial institutions increasingly adopt digitalisation, cloud technology, and remote work models, new vulnerabilities emerge, making internal threats a pressing concern.

Hackers see an opportunity in exploiting internal users to swiftly compromise financial institutions. Therefore, protecting against internal threats is crucial for the overall security of the finance sector.

Intentional Internal Threats

Intentional internal threats are driven by individuals with malicious intent, who exploit their access to sensitive data for personal gain or to harm the organisation.

These threats manifest in various forms:

• Fraud: Theft, alteration, or destruction of company data to deceive stakeholders.
• Espionage: Stealing information for another organisation, often a competitor, compromising data confidentiality.
• Sabotage: Using legitimate access to damage or disrupt the organisation’s operations.
• Intellectual Property Theft: Unlawful appropriation of a company’s intellectual property for personal gain.
• Revenge: Disgruntled former employees accessing sensitive information to tarnish the company’s reputation.

Example: South Africa Postbank 2020 In 2020, rogue employees at South Africa’s Postbank copied the master key, compromising millions of account holders’ data and necessitating the replacement of 12 million bank cards at a cost of $58 million. This incident highlighted the severe impact insiders can have and the need for robust internal security measures.

Unintentional Internal Threats

Unintentional internal threats arise from inadvertent actions or negligence by employees, leading to data breaches or security incidents.

Employees can unintentionally contribute to data breaches in several ways:

• Phishing or Social Engineering Victims: Employees tricked into revealing sensitive information.
• Using Unauthorised Devices: External devices like USB sticks can be infected and compromise company data.
• Using Unauthorised Software: Illegitimate software may contain malware.
• Loss of Company Devices: Unsecured or unencrypted devices, when lost, can lead to data leaks.
• Improper Access Control: Poor management of user access can lead to security issues.
• Misconfigurations: Errors in setting up or managing systems can create vulnerabilities.

Example: UniSuper Google Cloud Misconfiguration 2024 In May 2024, a misconfiguration in UniSuper’s Google Cloud resulted in the accidental deletion of their private cloud account, affecting over half a million members. This incident emphasised the risks associated with cloud service misconfiguration but was mitigated by having backups with an alternative provider.

Detecting Internal Threats

Detecting internal threats is crucial for safeguarding sensitive information and assets within the finance industry. Effective detection mechanisms include monitoring employee behaviour, analysing network activity, and employing advanced threat detection technologies.

Behavioural patterns and digital analytics can help identify potential threats by analysing suspicious activities and issuing alerts for deviations from typical behaviour. Common indicators of insider data theft include:

Digital Warning Signs:

• Accessing significant volumes of internal data.
• Unauthorised access to sensitive data.
• Unusual data access patterns.
• Repeated requests for unauthorised resource access.
• Use of unauthorised storage devices.
• Network crawling for sensitive information.
• Hoarding data by copying files.
• Transmitting sensitive data to external recipients.

Behavioural Warning Signs:

• Attempts to bypass security measures.
• Presence in the office during non-standard hours.
• Disgruntled behaviour towards colleagues or management.
• Violations of corporate policies.
• Discussions about resignation or seeking new job opportunities.

By combining digital monitoring and behavioural analysis, financial institutions can effectively detect and mitigate internal threats, protecting critical assets and maintaining operational trust.

Defending Against Internal Threats

Combating internal threats requires a multi-layered approach encompassing stringent access controls, continuous employee training, and advanced cyber security solutions.

Least Privilege Access Policies: Implementing access policies based on the principle of least privilege limits user access to only what is necessary and promptly revokes access when no longer needed, reducing potential attack surfaces.

Zero-Trust Model Controls: Adopting the zero-trust model, which verifies all connections regardless of origin, strengthens security. This includes measures like time-based controls and multi-factor authentication to fortify defences.

Comprehensive Security Training: Ongoing cyber security training for all employees is vital. New hires and contractors should receive training before system access, with regular sessions and phishing simulations to maintain vigilance.

Remote Access Monitoring and Control: Monitoring and controlling remote access is critical. Intrusion detection and prevention systems for wireless networks and mobile devices are essential, and remote access should be revoked promptly when an employee leaves.

Strengthening Network Security: Tailoring firewall configurations, implementing a demilitarised zone (DMZ) to isolate critical systems, and network segmentation to restrict user movement enhance security and monitoring capabilities.

Insider threats remain a significant challenge in the financial sector but can be effectively mitigated through comprehensive strategies and proactive measures. By leveraging technological advancements and fostering a strong culture of security awareness among employees, financial institutions can protect critical assets and maintain trust.

For tailored solutions to strengthen your organisation against insider threats, contact our Head of Client Solutions, Ollie Rayburn, at [email protected]. Simplify cyber security and safeguard your business with bespoke solutions designed to meet your unique needs.