# How a trail of breadcrumbs is leading straight to financial infrastructure
Author:  Pal Sinha, Barnali 
Author URL: https://financedigest.com/author/pal-sinha-barnali
Published: 2022-03-24
Category: FINANCE
Category URL: https://financedigest.com/category/finance
Meta Title: Protecting Financial Services from Cyber Attacks
Meta Description: Learn how to safeguard your organisation from cyber criminals targeting the finance sector. Stay one step ahead of threats by avoiding common pitfalls.
URL: https://financedigest.com/how-a-trail-of-breadcrumbs-is-leading-straight-to-financial-infrastructurehtml

![undefined](https://prod.superblogcdn.com/site_cuid_cm5qst7v3003gwirgwqtxn8i8/images/istock-1011996682-1736815938861-compressed.jpg)

_By_ **_Ben Bulpett,_** _EMEA Identity Platform Director at SailPoint_

Cyber security breaches of any kind remain a serious threat both in terms of financial costs and reputational damage. However, with lucrative assets at stake, it comes as no surprise that the finance and insurance industries have been the [most attacked targets in recent years](https://www.ibm.com/security/data-breach/threat-intelligence/).

The financial sector is generally known for having a high cyber security maturity level, to protect against criminals who have always sought financial gains. However, threats are continuing to evolve at pace, and the widespread disruption from the forced transition to remote work opened security and compliance gaps that many industries, including [financial services](https://www.financedigest.com/4-ways-high-performance-analytics-powers-financial-services.html "4 ways high-performance analytics powers financial services"), are still grappling with. As of January this year, the National Cyber Security Centre received [over 10 million reported phishing scams](https://www.ncsc.gov.uk/collection/phishing-scams). Globally, financial services accounts for [nearly 40% of all phishing URLs.](https://www.helpnetsecurity.com/2021/07/22/financial-services-phishing/)

The workforce will always come with a certain risk level, but employees are unknowingly creating visibility gaps, [leaving a trail](https://www.financedigest.com/one-million-without-power-as-ida-leaves-trail-of-destruction.html "One million without power as Ida leaves trail of destruction") of breadcrumbs for attacks to slip through corporate infrastructure. As the number of attacks continue to rise, it is critical that financial services [organisations and their employees take steps to protect](https://www.financedigest.com/protect-your-organisation-from-fraud.html "Protect your organisation from fraud") themselves, and their customers. Doing so requires an understanding of the tactics threat actors are using, and how to avoid playing into their hands.

**Seeking information online**

A cunning bad actor [will stalk workers online](https://www.wsj.com/articles/what-hackers-can-learn-about-you-from-your-social-media-profile-11623157200) to gather as much information as possible. Any information shared publicly on LinkedIn, Facebook, Twitter, or Instagram pages allows a [cyber criminal to piece together a profile of the target](https://www.financedigest.com/cyber-attack-targets-outcomes-watch-2019.html "Cyber Attack Targets & Outcomes to Watch Out for in 2019"). With nearly [half of UK workers (47%) including their position and name of employer](https://www.sailpoint.com/blog/what-greek-mythology-can-teach-us-about-present-day-cybersecurity/) on their social media profile – some even sharing corporate emails (10%) for all to see – it is more likely that malicious actors will be able piece together a profile of their victims and strategize on who to target next.

While it is a common practice in many parts of the world to include work [details on social profiles](https://www.financedigest.com/automotive-chrome-trim-products-market-industry-analysis-and-detailed-profiles-of-top-industry-players.html "Automotive Chrome Trim Products Market: Industry Analysis and Detailed Profiles of top Industry Players") for networking and recruiting, it’s a stark reminder that unsavoury characters could be using this information in their next attack. Therefore, it’s imperative to be extra cautious about what is shared online; for example, include [company and job title](https://www.financedigest.com/title-rubber-gloves-market-research-report-2030-top-companies-market-size-and-forecast.html "Rubber Gloves Market Research Report 2030: Top Companies, Market Size and Forecast") but leave out email addresses.

**Using [compromised emails](https://www.financedigest.com/what-is-business-email-compromise.html "What is business email compromise?") and passwords**

[Cyber criminals are using phishing scams to lure unsuspecting victims into leaking their organisation’s](https://www.financedigest.com/cyber-threats-for-finance-organisations-to-watch-in-2023.html "Cyber threats for finance organisations to watch in 2023") private information. But they’re also being given a head start in doing so. With a quarter of UK workers (25%) using corporate emails to conduct non-business related activity [according to our research](https://www.sailpoint.com/press-releases/new-sailpoint-survey-exposes-concerning-generational-differences-regarding-corporate-email-use-and-cybersecurity-posture/), for example social media logins and online shopping, there is a clear window for cyber criminals to find an ‘in’ to an organisation.

All it takes is one breach for this information to end up on the dark web forums, where it is bought and sold. To ensure a corporate email doesn’t end up in the wrong hands, employees should be [encouraged to create a throwaway account](https://www.financedigest.com/digitised-prize-linked-savings-accounts-how-it-can-encourage-better-financial-habits.html "Digitised prize-linked savings accounts: How it can encourage better financial habits") to conduct non-business-related activities.

**Impersonating CEOs and fellow employees**

[Across the globe](https://www.financedigest.com/germany-u-s-agree-to-new-covid-curbs-as-omicron-spreads-across-globe.html "Germany, U.S. agree to new COVID curbs as Omicron spreads across globe"), workers are experiencing an influx of suspicious messages from top-level executives. This has been seen most recently with the [FBI warning about a disturbing](https://uk.pcmag.com/video-conferencing-software/138749/fbi-dont-fall-for-this-money-transfer-video-chat-scam) uptick in criminals exploiting virtual meetings to swindle organisations out of finances. In some cases, this went as far as hijacking video [meeting accounts](https://www.financedigest.com/theres-a-fine-line-between-relinquishing-control-and-accountability-financial-institutions-must-balance-both-to-successfully-cloudify-operations-and-meet-customer-expectations.html "There’s a fine line between relinquishing control and accountability. Financial institutions must balance both to successfully cloudify operations and meet customer expectations") belonging to company executives in order to impersonate them and trick unsuspecting employees.

Malicious actors try to get unsuspecting individuals to pay them through [spoofing financial](https://www.financedigest.com/how-financial-services-are-overhauling-security-to-defend-against-spoofing-scams.html "How financial services are overhauling security to defend against spoofing scams") services—with this sector being one of the highest targeting by phishing. Therefore, it is imperative to be vigilant when sussing out if a financial request for details is honest.

**Mitigating against attacks through training and technology**

Criminals rely on a culture of blame. Therefore, it is important that organisations ensure a positive, ongoing conversation with employees, that results in a deeper understanding of exactly how these [incidents will impact both individuals and the organisation](https://www.financedigest.com/finance-amongst-worst-offenders-as-74-of-security-incidents-come-from-within-organisations-not-hacking-groups.html "Finance amongst worst offenders as 74% of security incidents come from within organisations, not hacking groups"). [Our research](https://www.sailpoint.com/press-releases/new-sailpoint-survey-exposes-concerning-generational-differences-regarding-corporate-email-use-and-cybersecurity-posture/) found that currently, almost half (46%) of UK workers say that they have not received any formal training or education about phishing. Cyber education must be moved to the top of the list for employee training – with this in place, [employees can feel well supported and equipped to deal](https://www.financedigest.com/how-to-deal-with-challenging-employees.html "How to Deal With Challenging Employees?") with phishing threats when they occur.

Also crucial is the use of new technology, which can help mitigate against these type of attacks on the [security perimeter in the first place](https://www.financedigest.com/is-the-next-big-cyber-threat-mis-placed-security-spending.html "Is the next big cyber threat mis-placed security spending?"). Cyber criminals often rely on using identities to try and trick organisations into [thinking they are who they say](https://www.financedigest.com/go-for-it-think-positive-believe-in-yourself-and-do-what-you-love-says-dawn-elliott-of-sew-confident-chorley.html "“Go for it, think positive, believe in yourself and do what you love” says Dawn Elliott of Sew Confident Chorley") they are. An identity [security system can help organisations manage](https://www.financedigest.com/managing-the-hidden-security-gap-in-financial-services-the-office-printer.html "MANAGING THE HIDDEN SECURITY GAP IN FINANCIAL SERVICES: THE OFFICE PRINTER") who has access to what, meaning access is permitted strictly on a need-to-know only basis – reducing the risk of sensitive information getting into the wrong hands. As well as this, it can also alert [organisations to any user behaviour](https://www.financedigest.com/how-behavioural-biometrics-can-help-financial-organisations-tackle-complex-ato.html "How behavioural biometrics can help financial organisations tackle complex ATO") which is out of the ordinary and suspicious.

**Protection for the long term**

All roads lead back to phishing – and the revenues generated by the [financial services](https://www.financedigest.com/the-future-of-financial-services-tech-evolution-not-revolution.html "The future of financial services: Tech evolution not revolution ") industry make them a ripe target. With proper awareness, education, and the will to remain hyper-vigilant – together with the right technology in place – the [financial services](https://www.financedigest.com/data-fake-will-be-the-new-real-in-financial-services-in-2023.html "Data: Fake will be the new real in financial services in 2023") industry can ensure it’s well protected against cyber threats.


---
This blog is powered by Superblog. Visit https://superblog.ai to know more.
---