Technology

How to future proof the financial industry against cyberattacks

Published

1 year ago

May 30, 2022

admin

Moshe Hayun, threat intelligence team leader at Deep Instinct

The financial industry is the backbone of an economy- more specifically it is the building block of a digital economy. Offering a broad number of services to billions of users across the globe, including banking, loan, consultancy, and investment, the nature of modern finance provides consumers and businesses with endless opportunities.

However, the amount of data held in these organisations is why the financial industry has historically been one of the most popular domains for cybercriminals, as they typically have a larger attack surface to exploit. Consumers trust these organisations with some of their most private information, and the potential threat of leaking this data, and the subsequent consequences, can be a nightmare for financial institutions.

In 2021, banking institutions alone saw a 1318% increase in ransomware attacks with the average cost of a cyberattack in the financial sector reaching $5.7 million in 2021. Evidently, the finance industry is one that is going to continue to be seen as an attractive and lucrative target for cyber criminals, and it is therefore paramount that organisations within the sector do all that they can to prevent themselves from becoming the next victim.

Moshe Hayun

The biggest cybercriminal families targeting the financial industry

Certain malware families have been a prominent threat to financial institutions throughout 2021. Our recent research revealed that Dridex and TrickBot were the most frequent malware families targeting the industry, specifically the banking sector. Dridex accounted for most of the malware attacks (68%), while TrickBot was responsible for 11% of the attacks.

Both are highly sophisticated banking trojans. For example, Dridex is a trojan designed to sneak behind an organisation’s defences (or, more accurately, trick defenders into bringing it beyond the perimeter themselves). While TrickBot on the other hand, is used to target individuals, businesses, and large enterprises to steal financial data, personal information and bank account credentials. Once this information is obtained, it can be used to carry out financial fraud and identity theft.

IcedID is another modular banking trojan that has attacked banks, e-commerce and credit card companies. Much like a worm, it has been designed to replicate, spread and infect more systems as it travels. Once executed on one machine, it will then cultivate and use simple evasion techniques such as operating after the machine restarts, making it more difficult to identify and defeat.

Another of the top five financial malware families is Zloader, a banking trojan that is a variant of the i Zeus banking malware. It is distributed in phishing campaigns or spoofed emails designed to trick victims into downloading and executing the malware. QakBot is the fifth malware family which can cause chaos within the finance sector. It steals information and is adept at stealing online banking credentials or other financial information.

Tricky Techniques and Implications

The malware families targeting the finance industry have their own techniques to achieve their financial goals. The more data they steal, the bigger the monetary gain. As such, they use a series of devious and stealthy methods to avoid detection. One common tactic is the use of malicious macros. Threat actors hide malicious code insider Word documents or other files which executes once someone opens them. For example, a favored method by Dridex is a PDF laden with JavaScript, or a malicious email attachment containing Word documents comprising of dangerous macros.

Trickbot, on the other hand, harvests emails and offers a backdoor into their victims’ network. The malware family also possesses a screen-lock, ransomware-style option which is designed to steal system passwords.

With techniques by these malware groups designed to be devious and arguably, cunning, it is no surprise that they are successful. LOLBins and PowerShell are another common tactic being used by cyber criminals to launch their ransomware attacks. Both are pre-installed on a computer which makes them ideal for threat actors to hide behind and avoid detection. This type of deception is also used by IcedID. For example, they can manipulate a victim’s browser so that they think they are viewing a genuine banking website, when in actual fact, they have been redirected to a fake website designed to steal system passwords.

Zloader on the other hand, uses Excel macros and other techniques including keylogging to steal information from users, while Qakbot spreads through malspam (malicious spam) and exploit kits that are deployed through compromised websites. If a victim visits the site, QakBot delivers its payload and infects them.

So, in this growing field of cyber-threats, how can financial institutions future proof themselves against devastating cyberattacks?

Facilitating real-time threat detection and prevention using deep learning

Most financial institutions today are using Endpoint Detection and Response (EDR) solutions which implements are designed to improve security at entry points to networks and systems. However, they often lack accuracy and speed.

EDR only works post-execution, meaning that malware is detected after it’s deployed into the target’s system. This means it is useful for finding known threats. However, threats evolve rapidly, with some of the fastest known malware infecting endpoints in less than 15 seconds. As a result, EDR solutions are not useful when it comes to preventing immediate and unknown threats and cannot process data at a speed which can ensure they are found in a timely manner that actually prevents attacks from infecting the endpoint.

To strengthen their proactive stance, finance companies need to move away from conventional EDR and implement deep learning – a more effective and next-gen solution for threat prevention. Deep learning is an advanced subset of AI that uses neural networks to imitate how humans think and learn in real-time- independently studying millions of attack patterns, file systems, and threat vectors.

However, deep learning solutions work without any human intervention. This broad knowledge base is then used to project existing and evolving threat patterns. This mechanism allows deep learning tools to detect threats in milliseconds, with unparalleled accuracy. Thus, even the fastest and most advanced malware is detected and stopped before they reach the target network.

Deep learning technology attains predictive analytics automatically through its own process of examining, analysing, and breaking down existing threat patterns, which helps to detect unknown and zero-day threats. It also produces a 99.9 percent accuracy rate which means security teams don’t have to chase after false-positive security alerts.

Deep learning solutions take the focus away from the conventional threat mitigation approach of the financial industry and emphasises threat prevention. The technology addresses the most critical security concern of the financial industry, which is accurately detecting and preventing threats. By detecting advanced threats in milliseconds, security teams can gain the upper hand on the attackers and close down their attack paths before they wreak havoc on the finance industry.

Up Next

Mind the AI gap: 3 common artificial intelligence pitfalls and how finance firms can avoid them

Don't Miss

How to cut the cybersecurity risk of M&A

Business

How can law firms embrace automation and revolutionise their payments?

Published

21 hours ago

September 28, 2023

editorial

Attributed to: Ed Boal, Head of Legal at Shieldpay

Once again, AI is dominating international headlines. This time, it’s due to a closed-door meeting this month between tech leaders and US senators to discuss the technology’s regulation.

AI and automation isn’t just for the likes of Big Tech. We’re seeing predictive and automated technologies transform almost every sector and the legal industry is no exception. In fact, recent research from HBR Consulting found that 60% of law departments had implemented a legal data analytics tool last year and more than 1 in 4 indicated they were using AI for at least a single use case.

However, adoption isn’t without its challenges. Reticence remains among some and there’s also the danger of ‘transformation fatigue’ slowing real progress. If law firms want to reap the many benefits of automation – including revolutionising their payment processes – these challenges need to be carefully considered and thoughtfully addressed.

An area of great opportunity

Often seen as conservative, the legal industry has been gradually warming up to the idea of automation and technology.

While some pioneering firms have been quick to embrace automation tools, others remain cautious about disrupting their established workflows. As we navigate this landscape, it’s clear that certain areas of legal services are ripe for innovation.

One area is contract management. The process of drafting, reviewing, and managing contracts has traditionally been time-consuming and prone to human errors. Automation can alleviate these pain points by streamlining the entire lifecycle of contracts, from creation to renewal, thereby enhancing efficiency and reducing risks.

Another promising domain is legal research. Thanks to advancements in natural language processing and machine learning, legal professionals can now leverage AI-powered research tools that analyse vast volumes of legal data to provide accurate insights and case precedents swiftly.

But, while progress is undoubtedly being made, the legal sector still lags other sectors when it comes to innovation.

What’s getting in the way of progress?

This isn’t always down to a resistance to change. Often, it’s a result of firms spreading their resources too thinly across numerous technology initiatives.

Ed Boal

Attempting to tackle everything at once can result in ‘transformation fatigue’, where the benefits of individual innovations get diluted – leading to frustration and slower progress.

Before legal firms embark on digital transformation projects, a critical first step is introspection. Recognising and acknowledging areas where legacy processes and manual tasks still hold sway is paramount to optimising the impact of automation.

For many firms, archaic practices continue to consume valuable time and resources, diverting attention from higher value, billable tasks. One often-overlooked area is payments.

Legal firms play a critical role in complex transactions, from M&A and real estate deals to litigation and arbitration payments. The associated admin and processes represent a drain of firms’ time and resources. Spanning everything from collating stakeholder payment details and verifying payee identity to ensuring compliance with Know Your Customer (KYC) and Anti Money Laundering (AML) regulation, this adds unnecessary stress for lawyers – who would rather dedicate their time and expertise to their clients’ legal needs.

The repercussions of such time-consuming financial processes reverberate throughout the entire organisation. Administrative burden weighs heavily on the team, affecting productivity and ultimately, the bottom line: recent research from Shieldpay, surveying the UK’s Top 100 law firms, found that almost 1 in 3 (32%) say KYC collection and verification checks take 4-9 working days.

At the same time, firms are exposed to significant financial risk which can make handling client funds a costly endeavour. Not only are they penalised with fines if found to be in breach of stringent client account rules but firms are also subject to hefty premiums for Professional Indemnity (PI) insurance. No wonder 73% of all legal professionals and 90% of junior law professionals are concerned about the risks and time costs associated with holding client funds.

Revolutionising payment transactions

In short, manual payment processes are more than just an inconvenience for modern law firms. They can damage relationships with clients – who have come to expect a fast, painless and automated payout experience in a digital world – and impede revenue generation by tying up top talent in an endless cycle of paperwork and (unbillable) admin.

So how can firms take the pain out of legal payments?

Fortunately, new payment technologies have emerged as a formidable ally. Third-party payment providers offering solutions for law firms, such as escrow and paying agent services for specific transactional deals, or more embedded payment solutions such as managed accounts (TPMAs) – i.e. outsourced client account functions – offer secure and instant transactions, while prioritising transparency and automation.

TPMAs operate as an escrow payment service in which the third-party – a licensed external payments partner – receives and disburses funds on behalf of a firm and their client(s).

With advanced encryption ensuring data security, working with a regulated payment partner means legal professionals and their clients can engage in financial transactions with peace of mind – while law firms benefit from improved operational efficiency.

And the advantages don’t stop there. Enhanced transparency builds a sense of confidence and trust, while the elimination of manual data entry and repetitive tasks allows legal professionals to devote more time to legal services and fostering stronger relationships with their clients.

AI and automation has much to offer the legal sector. But its adoption must be carefully planned in order to avoid transformation fatigue that risks stalling progress altogether. With typically shallower pockets than Big Tech giants, it’s important for law firms to focus their efforts on specific areas that could benefit from automation, rather than rush to overhaul their entire way of working, all at once. This controlled phase-out is the key to avoiding adoption frustration, seeing a real impact on profits and productivity and setting firms up for real, lasting change.

Business

In-platform solutions are only a short-term enhancement, but bespoke AI is the future

Published

2 days ago

September 27, 2023

editorial

By Damien Bennett, Global Director, Principal Consultant, Incubeta

If you haven’t heard anyone talking about artificial intelligence (AI) yet, then where have you been? Conversations about AI and its advantages to society have been a key talking point over recent months, with advances being made in the generative AI race and ChatGPT opening a whole plethora of possibilities. Many have highlighted the advantages of AI, but notably it’s ability to create human-like content.

But these discussions have only scratched the surface of what AI is capable of doing. It is for far more than just essay writing, adding Eminem to your rave and photoshopping dogs into pictures.

In marketing, we have been using AI for years, for everything from analyzing customer behaviors to predicting market changes. It’s enabled us to segment customers, forecast sales and provide personalized recommendations, having a huge impact on how our industry works.

It is even, for the more savvy marketers of the world, becoming a key tool in maximizing budget efficiency – which is apt, considering over 70% of CMOs believe they lack sufficient budget to fully execute their 2023 strategy.

Now, as AI becomes more intelligent, the number of efficiencies it can unlock continues to rise. Not only can it help brands get the most out of their available resources and identify any areas of waste, but it can also help highlight new opportunities for growth and maximize the impact of your budget allocation.

The trick, however, is to veer away from the norm of using in-platform solutions with a one-size-fits-all approach and create your own, bespoke solutions that are tailored to your business needs.

Pitfalls of in-platform solutions

In-platform solutions aren’t by any means a bad thing. In fact, built-in AI tools have become increasingly popular, owing to their ease of integration, user-friendly interfaces and minimal set up requirements. They come pre-packaged with the platform, offering the user the ability to leverage AI technologies without the need for in-depth technical expertise or the upfront cost of building a solution from scratch.

However, the streamlined and accessible nature of in-platform AI solutions comes at the expense of complexity and customization. They are designed to serve a broad user base, but for the most part are built using narrow AI solutions with predefined features and workflows.

This makes them great for assisting with common AI tasks, but they lack the flexibility to tailor functionality towards unique business requirements or innovative use cases, limiting the potential efficiencies and cost savings that can be unlocked. Additionally, if a business’ competitors are using the same platform, they are probably using the same AI solution, meaning any strategic advantage gained from these will be reduced.

Bespoke AI solutions, on the other hand, may carry a higher initial investment – but can offer a significantly more attractive ROI over a short amount of time.

Why customized and adapted AI is the key

The difference between bespoke AI and in-platform solutions is similar to that between home cooked food and a microwave meal. Yes, it is more time consuming to prepare, and yes it likely carries more of an upfront cost, but the end result is going to be far more appealing and will carry more long-term value (financially… not nutritionally).

That’s because bespoke solutions, by nature, will have been tailored to address your brands specific needs and challenges. These custom-built tools allow for much greater efficiencies by streamlining workflows across different channels, automating more complex tasks, and providing deeper, more relevant insights.

The increased level of optimization can significantly improve productivity and reduce operational costs over time, offering a higher ROI. The increased flexibility of bespoke AI also allows brands to implement innovative use cases that can significantly differentiate them from their competitors.

The data analyzed can be specifically chosen to match business requirements, as can the outputs of the AI tool, providing a significant advantage when understanding and acting on the insights provided.

Additionally, these tools are, by nature, more scalable. They can be updated, upgraded and expanded as needs change, ensuring they continue delivering value as the business grows. They can also be designed to integrate with any existing IT infrastructure, from CRM systems and databases to marketing platforms and sales tools – leading to more efficient and effective decision-making.

Managing finances with AI

It’s no secret that AI in marketing automation has, and will continue to, revolutionize the way marketing is done. It has a bright, if slightly terrifying, future and can help CMOs to unlock new efficiencies, maximize the impact of their budgets and increase their ROI. And as this technology becomes more advanced, its impact will only increase.

But we already know that…and so does everyone else.

So, in order for businesses to make themselves stand out from the crowd , they must look to fully adopt the power of AI. Creating a customized and unique AI solution could be the way to set yourself apart from your competitors. A bespoke AI tool can provide brands and businesses with features unique to them and their business needs. As a result, companies will benefit from more useful data and better results to make more data-driven decisions for their business. Ultimately, this will help brands to maintain a competitive edge over their competitors, deliver ROI and most importantly optimize their budgets.