Industry Brief: Banking Cyber Risk Priorities

Sector context

A bank moves value in real time. Privileged identities authorize payments and change limits. Core platforms, card processors, payment networks and cloud providers sit in the critical path. Regulators set explicit expectations for resilience. Each of these raises the impact of an attack that would be routine elsewhere.

Verizon’s latest data for the financial and insurance sector gives the baseline. It covers 3,809 incidents, 1,300 of them with confirmed data disclosure.

Two cautions apply. The category is financial and insurance combined, so it is not a bank-only sample. And Verizon notes that sector differences are influenced by varying regulatory and reporting requirements, so a sector that must report more will look worse in the data.

Our reading: the table shows a sector under steady pressure from financially motivated outsiders using common techniques. Banking is not exposed to exotic attacks. It is exposed to ordinary ones with a larger blast radius.

Five priorities

1. Identity and privileged access around money movement

Verizon lists credentials among the most commonly compromised data types in financial and insurance breaches, at 26%. Credential abuse and phishing together account for 35% of initial access in the sector. Mandiant reports voice phishing as the second most common initial vector overall, at 11%, and Verizon found click rates in phishing simulations were 40% higher for mobile-centric channels such as voice and text than for email. Mandiant also describes attackers abusing misconfigured certificate templates in Active Directory to create administrator accounts exempt from MFA.

Our reading: the sensitive identities in a bank are not only domain administrators. They include the operators who release payments, the staff who maintain limits and beneficiaries, and the help desk that can reset any of them. A phone call to the help desk is an authentication path, and often the weakest one.

Decision: apply phishing-resistant authentication first to roles that release payments or administer payment, treasury and core platforms. Treat help-desk identity verification as a controlled process with its own evidence. Check that maker-checker rules are enforced by the systems, not just by procedure.

2. Financially motivated attacks and fraud

Financial motive appears in 98% of financial and insurance breaches in Verizon’s data. The attacker’s objective is value, and the route to it often passes through account takeover, payment manipulation or extortion.

Our reading: in many banks, fraud operations and security operations run separate tools and separate cases. An account takeover can look like a fraud alert in one queue and a suspicious sign-in in another. The decision is whether signals are shared and whether one process owns the combined case. This is a design judgment, and the sources reviewed do not measure it directly.

Decision: define a shared case path between fraud and security for identity-led events, and agree which team can freeze a session, an account or a payment channel.

3. Suppliers and concentration

Third-party involvement was 34% of breaches in the financial and insurance sector and 48% across all sectors in Verizon’s latest data. The remediation record is weak. Only 23% of third parties fully fixed missing or improperly secured cloud MFA, and for weak passwords and permission misconfigurations the median time to close half of the findings was well beyond two quarters.

Our reading: banks rely on a small number of core banking, processing, payments and cloud suppliers, and a failure at one of them can halt a critical operation. Tiering suppliers by spend misses this. Tiering by the operation they support does not.

Decision: rank suppliers by the critical operation each can interrupt, ask for evidence of actual MFA and permission settings, and test exit and substitution plans for the few that cannot be replaced quickly.

4. Internet-facing exposure

Exploitation of vulnerabilities was the leading initial access vector across all sectors in Verizon’s data, at 31%, and 22% in financial and insurance. Mandiant estimates mean time to exploit at minus seven days, which means exploitation often begins before a fix exists. Verizon found only 26% of KEV-listed vulnerabilities fully remediated, with a median time to full resolution of 43 days.

Our reading: a bank’s internet-facing estate includes VPNs, firewalls, customer channels, partner gateways and legacy services nobody has revisited. The patch cycle alone cannot cover them.

Decision: name an owner for every internet-facing asset, pre-agree a mitigation-first response for edge and remote access devices, and hunt for prior access after patching.

5. Recovery of critical operations

Verizon reports ransomware in 48% of breaches across all sectors, so this is not a banking-specific figure. Mandiant describes attackers targeting recovery directly: wiping cloud backup objects, copying virtual hard disks on hypervisors and extracting credentials in bulk from vaults. Prior compromise was the top confirmed initial vector for ransomware incidents, at 30%.

Our reading: a bank can lose confidence in its data or its identities without losing a single server. Recovery then depends on whether backups, directory services and recovery tooling can be reached with the same credentials the attacker holds.

Decision: list the critical operations, such as payments, cards, core ledger, treasury and customer channels, set an agreed tolerance for disruption for each, and test recovery under a severe but plausible scenario in which production credentials are compromised.

Regulatory and regional lens

Supervisors are converging on the same expectations. The Basel Committee’s principles for operational resilience and the EU’s Digital Operational Resilience Act both center on critical operations, tolerance for disruption and oversight of ICT third parties. Law-firm analysis of the UAE central bank’s operational risk regulation describes similar themes: mapping critical operations, board-approved tolerances, testing against severe but plausible scenarios, and oversight of third parties supporting critical functions. It also reports expectations about hosting a firm’s master system of record in the UAE, including when services are outsourced.

For banks that use SWIFT, the Customer Security Controls Framework sets mandatory and advisory controls for the local environment connected to the messaging network, and customers attest against it.

Treat this paragraph as orientation. Check applicability, current text and timelines against the primary regulation and your supervisor’s guidance before relying on it.

Questions for the next planning cycle

• Which five identities can do the most financial damage, and which authentication does each use?

• Does the help desk follow a documented, evidenced verification process for privileged and payment roles?

• Which three suppliers could stop a critical operation, and what evidence do we hold about their controls?

• Which internet-facing systems have no named owner?

• When did we last restore a critical operation from a clean state, and under what assumptions?

About the evidence

This brief draws on published datasets and standards. It contains no Cybrilliant incident data and no client information. Figures are quoted as published. Sector figures cover financial and insurance organizations combined. Our readings and decisions are analysis and judgment, and are labeled as such.

Sources

1. Verizon. Data Breach Investigations Report, latest edition and executive summary. Financial and insurance sector figures, initial access, third-party involvement, ransomware, phishing simulation results. verizon.com/business/resources/reports/dbir verizon.com

2. Mandiant (Google Threat Intelligence Group). M-Trends, latest edition, as reported by Help Net Security. Initial vectors, time to exploit, attacker tactics against recovery and identity. helpnetsecurity.com

3. Pinsent Masons (Out-Law). Analysis of UAE central bank operational risk rules for financial institutions. pinsentmasons.com

4. Basel Committee on Banking Supervision. Principles for operational resilience. bis.org

5. European Union. Digital Operational Resilience Act (Regulation on digital operational resilience for the financial sector). eur-lex.europa.eu

6. SWIFT. Customer Security Program and Customer Security Controls Framework. swift.com