Ransomware is on the rise in the financial sector as a whole. A report by Sophos from 2023 indicates that as many as 64% of financial institutions globally have already experienced at least one ransomware incident.
People still seem to think that there’s a person on the other end of the keyboard that is deciding what looks interesting and who they’re going to attack today. But that’s just not true — in this day and age, it’s all about automation and bots.
I have a talk that I regularly give to small business owners to illustrate this. I always begin by spinning up a new virtual server in the cloud. Then at the 30-minute mark, I’ll come back and revisit this server that I just spun up.
Without failure, there are always at least 10,000 failed brute login attempts on this unknown server. The traffic never fails to let me down. Occasionally, the number even hits 50,000.
Keep in mind, there’s nothing interesting about this server — it’s being hit simply because it’s out there. These bots found a new live IP, and the vultures attacked.
The attackers break in now to gain a foothold and then they’ll figure out later if it was actually something interesting or not, but they’re not spending any time personally. It’s all bots and automated attacks on that first wave.
Because of automation, every institution has an increased vulnerability to threats like ransomware. In fintech, the time, money, data, and credibility lost to a ransomware attack can be especially devastating.
Related: A Beginner’s Guide to Ransomware
How is Fintech Most Vulnerable to Ransomware?
The financial sector and specifically fintech are highly vulnerable to these kinds of threats because of the nature of their business. It’s highly connected, it’s digital, and it’s often global in nature.
Banks and trading firms are constantly exchanging sensitive data and financial transaction information with each other about their customers, their partners, etc.
Simply put, fintech is designed to be extremely interconnected. It’s a difficult environment to fully protect from lateral movement through otherwise legitimate channels, where they’re trying to exchange business communications.
But while interconnectivity is essential to fintech’s operations, it also means ransomware attacks are particularly devastating. The biggest threat ransomware presents is lateral movement. As a result, interconnected networks like the ones in fintech are more vulnerable to threats like ransomware.
Also, the very nature of fintech products puts them in the hands of consumers on connected devices. Fintech in particular is about things like mobile banking apps, trading apps, and other types of financial product derivatives offered via electronic access.
This creates a number of avenues for threat actors to be able to exploit, since it’s not appropriate for fintech companies to patch and update an end consumer device.
It’s entirely possible and highly likely that the banking app your company created is being installed onto an already compromised device. How do you deal with that when you’re installing your software into a known bad environment?
It’s also important to keep in mind fintech is a highly lucrative target. The sector is all about money and financial transactions, which makes it a hacker’s paradise.
This is a huge motivator for threat actors to intentionally target the financial sector more than others. And statistics have shown that this has definitely been the case.
Ransomware Defense Strategies for Fintech Companies
When you build your organization’s ransomware defense, the goal should be to plan as extensively as possible. For businesses of all sizes, it’s not a matter of if you’ll be breached, but when. If you don’t have a plan to address and recover from ransomware, then you’ve planned to fail.
Each organization’s planning will vary from the next, but fintech companies should always check off these three items: user training, endpoint detection and response, and backups.
Training Users
If you’re unsure about where to start with ransomware defense, training users should be high on your list. By effectively training end users and employees, fintech companies build in a first line of defense that addresses a major vulnerability.
Users are the weakest link when it comes to ransomware. Ransomware most often starts because a user clicks a link in an email, text message, or elsewhere on a connected device. If users know not to click links, then a great deal of attacks can be prevented.
Endpoint Detection and Response
Next up on the list of ransomware defenses is endpoint detection and response (EDR). If you aren’t doing it already, you should be equipping a powerful and highly connected EDR solution.
Your EDR solution needs to be able to detect and block ransomware. There is a caveat, however. Standalone EDRs might be able to block known ransomware variants, but they may not recognize an unknown variant as it’s starting to spread across your organization.
More modern EDRs are far more centralized and connected, so they can detect suspicious behavioral patterns across multiple machines, not just signatures of well-known malware. It’s better to block something unknown and potentially malicious and find out later that it wasn’t, than to let something dangerous run rampant.
While the bad guys are using artificial intelligence to develop ransomware, the same technology is being used to fight it. AI-assisted EDRs are very capable when it comes to detecting the early warning signs of a ransomware breach.
Backups and Recovery Strategy
Without exception, every company must have a comprehensive recovery plan that is built on solid backups. A robust backup solution with a tried and true — and tested — recovery plan is the best way to recover from ransomware when it happens.
I frequently get calls from small business owners asking if I can help them recover from ransomware. Unfortunately, without the up-front work, and especially without backups and a disaster recovery strategy, the answer is usually no.
No one has the ability to wave a magic wand and make ransomware disappear. Occasionally we get lucky and find that the encryption key is already out there for an older known variant. But most of the time, the best path forward is through restoring from a backup.
Black Kilt Helps Defend Your Organization From Ransomware
Black Kilt’s experts can help on the front end before ransomware takes hold. We can devise a risk-based approach to prevent, detect, and mitigate ransomware. Our cybersecurity strategies are tailor-made for each of our clients’ needs, so you’ll never need to be concerned about getting solutions that aren’t the best fit for you.
We can also review your backup strategy and shore up any holes that may be there. Or we can even help you execute a live test so you can have confidence in that backup strategy and in your ability to recover.
If you’re interested in learning more, contact Black Kilt today to begin planning your ransomware defense strategy. We are happy to provide a consultation for your company, free of charge.