Woburn, MA – March 30, 2017 – According new data from the Kaspersky Lab Financial Institutions Security Risks 2016 , the costs associated with cyberattacks affecting the financial sector are rising as organizations face increasingly sophisticated threats. In the U.S., the cost of a cybersecurity incident to a financial institution can be as much as $1,165,000. On average worldwide, financial firms are facing losses of nearly a million dollars ($926,000) for each cybersecurity incident they experience.

The findings also highlight the three most-costly types of incidents for financial organizations worldwide. The first most costly incident is threats that exploit vulnerabilities in point-of-sale (POS) systems, in which an organization typically loses $2,086,000, attacks on mobile devices are the second most costly ($1,641,000), followed by targeted attacks as the third most costly incident ($1,305,000).

Compliance is a key driver for increasing investment in IT security in banks and financial institutions. However, the study shows that 63 percent of organizations believe that being compliant is not enough to be secure. Another significant reason for spending more on security is growing infrastructure complexity. For example, an average financial firm adopts virtual desktop infrastructure (VDI) and manages approximately 10,000 end user devices with roughly a half of them being mobile smartphones and tablets.

Financial institutions need to come to terms with the losses experienced and educate themselves on the most common cyberthreats to their organizations’ to better prepare for future incidents. The majority of financial firms surveyed plan to put better strategies in place with 83 percent saying that they expect an increase in their IT security budgets in the next two years.

“Given the substantial monetary losses from cyberattacks, it is not surprising that financial organizations are looking to increase spending on security,” said Veniamin Levtsov, vice president, enterprise business at Kaspersky Lab. “We believe successful security strategies for financial organizations lie in a more balanced approach to allocating resources — not just spending on compliance, but also investing more in protection from advanced targeted attacks, paying more attention to personal security awareness and getting better insights on the industry-specific threats.”

Kaspersky Lab’s experts recommend five key considerations for security strategies adopted by financial organizations in 2017:

1. Beware of the targeted attacks: Targeted attacks on financial organizations are likely to be conducted through using third parties, or contractors. These companies can often have weaker or no protection at all and can be used as an entry point for malware or a phishing attempt. Ask questions about the security in place of third parties or contractors you decide to do business with.
2. Do not underestimate less sophisticated threats: Fraudsters can strike at mass and benefit from the scale using simplest tools. In some cases, social engineering may contribute to more fraudulent incidents than those caused by malware.
3. Do not pick compliance over protection: Budgets are usually allocated in favor of compliance, but strengthening security and introducing new protection technologies requires a more balanced approach to the allocation of resources.
4. Do regular penetration testing: Unseen vulnerabilities are real nevertheless. With implementation of sophisticated detection tools and penetration testing, vulnerabilities and incidents will emerge. Ensure your eyes are open to all weaknesses and threats – before it is too late.
5. Pay attention to insider threats: Employees can be exploited by cybercriminals — or decide to become one. Effective security strategies should go beyond perimeter protection to include techniques that can detect suspicious activity within organizations.

To learn more about financial organizations’ losses from security incidents and effective security strategies to fight them, along with some other findings from the report by Kaspersky Lab, read our blogpost linked here.