According to Verizon’s Data Breach Investigations Report, the financial sector is consistently among the most targeted industries, and the rate of attacks is growing. Banks saw a 238% increase in attacks for 2022 alone. The average data breach in the financial sector costs $5.9 million, which trails only the healthcare sector in average cost, according to IBM’s Cost of a Data Breach Report 2023.

While the industry has made significant strides with cybersecurity, there are countless factors that still make banks and financial institutions attractive targets.

The Challenges of Protecting Financial Data

Several issues contribute to the difficulties financial institutions face in protecting their assets. One of the most significant is the complexity of the business environment, especially for larger institutions that have undergone mergers and acquisitions. Connecting legacy networks and applications can result in misconfigurations introducing vulnerabilities that provide hackers easy entry.

Financial institutions, like many businesses, also have a more distributed workforce in the wake of the pandemic. As a result, they have had to integrate greater uses of cloud and mobile computing which increases the attack surface. And, despite the implementation of modern, outward-facing applications, it’s not uncommon for banks to have 50-year-old applications — written in COBOL — running on the back end that are long past the point of being supported. These applications can become risky from a security perspective, but often do not make financial or operational sense to update.

Despite all these risks, most attacks hinge on the human element in the form of identities on the network.

Active Directory and the Importance of Identities

User identities play a big part in many cyberattacks, whether breaches result from insider actions, external attacks, or the involvement of third-party partners.

When it comes to identity threats, a malicious insider can cause extensive damage. The most notable example being the 2019 Capital One hack. Almost four years later and this particular hack is still widely recognized as one of the greatest insider threats to date. A single insider was responsible for the theft of 100 million customer records, 140,000 Social Security numbers and 80,000 bank details of customers. And a credential compromise from outside an organization is really just another type of insider threat. Once external attackers gain access by stealing credentials, they operate like a trusted insider.

Third-party risk can also cause severe damage. Most financial institutions have dozens to hundreds of vendors, service providers, and other partners connected to their network. For savvy hackers, a breach in a third-party system can create the perfect jumping off point to enter financial environments.

What’s the one similarity these attacks share? The most common avenue for these breaches is Active Directory (AD), the core identity service for 90% of financial organizations and businesses worldwide.

When someone asked Willie Sutton why he robbed banks, he replied, “Because that’s where the money is.” So, why do cybercriminals attack Active Directory? Because that’s where the privileged access is. AD is so tightly woven into most organizations that it’s involved in 9 out of 10 cyberattacks. Microsoft estimates threat actors attack 95 million AD accounts each day, and that’s on the conservative side.

Whether an attacker gains access through phishing or other means, moving to an identity-rich area like Active Directory can allow them to elevate privileges, move across networks, and steal data or launch ransomware attacks. These types of attacks can bring banks and other financial service operations to a halt, preventing access to funds, leaking customer data and causing brand damage.

Breach Preparedness and Other Best Practices

To better protect their data, banks and financial institutions should start with prioritizing their risk. They need to accept that breaches will happen, so they must identify their highest-priority assets — those that would cause the most damage if compromised — and the vulnerabilities of those assets.

Breach preparedness begins with an assessment of AD security, along with reviews of an organization’s security architecture, operational procedures and security configurations. This allows security teams to identify attack paths and develop plans for response and remediation. With thorough assessments of the environment, organizations can develop threat mitigation plans to reduce the attack surface, optimize security configurations and create a thoughtful plan for recovering from an attack that reduces downtime and disruption.

Continually monitoring user identities is also very important. If a lower-level employee suddenly has elevated privileges, is accessing sensitive data they shouldn’t be reviewing, or is operating at odd hours and not performing regular business tasks, there’s a chance their identity is compromised.

Finally, planning should have a human element, in the form of recruiting and retaining security personnel and educating users. Banks and financial institutions must attract and retain knowledgeable security practitioners, which is easier for large institutions to afford. But in organizations of any size, security is a small part of the business. Financial institutions still have hordes of people with limited knowledge of security who are accessing systems and handling sensitive data. As such, employee training and security awareness is essential, especially with an increasing number of remote workers.

The Future of Financial Sector Security

With the pace and sophistication of attacks on the rise, institutions need to gain visibility into their environments, get control of user identities and develop clear plans for breach preparedness, response and recovery.

Looking forward, financial institutions will also have to confront the risks associated with new threats and challenges with cryptocurrency. As with all forms of security, it comes down to mastering the fundamentals of gaining visibility into and control over the enterprise.