Bethesda, Md. – Financial services organizations are still being breached too often, most frequently by those with insider access, according to the second annual SANS survey on the security of the financial services sector.
In it, 46% cited abuse or misuse by internal employees or contractors and 42% cited successful spearphishing attacks as being their most prevalent causes of breaches.
"One of the biggest security problems we're seeing is bad user behavior," says SANS instructor and financial systems security expert G. Mark Hardy. "As a result of their inability to contain user mistakes, financial services companies are learning that compliance doesn't translate to security and are shifting their top priority from compliance to avoiding data breaches."
In 2015, avoiding breaches was chosen by 81% of respondents, making it the top driver for information security programs. In 2014, the top driver was meeting compliance. This year, compliance is respondents' second most important driver, while their third top driver is to improve their security and risk management programs overall.
"This shift toward better detection and improved programs indicates growing maturity in cyber risk operations, which should be the ultimate goal for all IT organizations," says Hardy. "It is also important to put some structure to that maturity and implement the Critical Security Controls and other risk-reduction frameworks."
This shift toward stopping breaches and improving programs was further demonstrated by a trend to spend more on information security. Although one-third could not quantify their IT security budgets, 41% of those who could were planning to spend 9% or more of their IT budgets on security in FY 2015 compared to 35% making that commitment in FY 2014. Moreover, 58% said they plan to invest more heavily in IT-related security and risk management in the next 24 months.
Adds Hardy, "Increased emphasis on avoiding breaches and improving overall risk posture, coupled with increasing security budgets, bode well for improved security in the financial services sector."
Full results will be shared during a webcast on June 23, 2015, at 1 PM EDT, sponsored by AlienVault, Arbor Networks, LogRhythm, and VSS Monitoring, and hosted by SANS.
Register to attend the webcast at www.sans.org/u/5CA
Those who register for the webcast will also receive access to the published results paper developed by renowned technology journalist Jaikumar Vijayan in consultation with SANS Analyst and security expert, G. Mark Hardy.
Tweet This
SANS 2nd Financial Sector Security Survey RESULTS on 6/23, 1 pm EDT - free webcast/whitepaper. bit.ly/2015FinSecSurvResults #infosec
How prepared is the #Financial Sector to fend off #CyberCrime? Webcast/whitepaper 6/23, 1pm EDT bit.ly/2015FinSecSurvResults
#Cybercrime in #FinancialSector-the most prevalent causes of #infosec incidents discussed on 6/23 bit.ly/2015FinSecSurvResults
SANS Media Contact
- Deb Radcliff
- SANS Institute
- E-mail: dradcliff@sans.org
- Phone: (707) 732-3317
About SANS Institute
The SANS Institute was established in 1989 as a cooperative research and education organization. Today, SANS is the most trusted and, by far, the largest provider of cyber security training and certification to professionals in government and commercial institutions world-wide. Renowned SANS instructors teach more than 60 courses at in-person and virtual cyber security training events and on demand. GIAC, an affiliate of the SANS Institute, validates practitioner skills through more than 35 hands-on, technical certifications in cyber security. The SANS Technology Institute, a regionally accredited independent subsidiary, offers a master’s degree, graduate certificates, and an undergraduate certificate in cyber security. SANS Security Awareness, a division of SANS, provides organizations with a complete and comprehensive security awareness solution, enabling them to easily and effectively manage their ‘human’ cybersecurity risk. SANS also delivers a wide variety of free resources to the InfoSec community including consensus projects, research reports, webcasts, podcasts, and newsletters; it also operates the Internet's early warning system–the Internet Storm Center. At the heart of SANS are the many security practitioners, representing varied global organizations from corporations to universities, working together to support and educate the global information security community. (https://www.sans.org)