Spearphishing is a real cybersecurity concern for financial institutions worldwide; and it should be. Symantec’s Internet Security Threat Report stated that in 2015, the number of spearphishing campaigns that targeted employees of all sized companies increased by 55% that year. Through email is the top way that a breach of an organization occurs and some studies are showing that banks and financial institutions around the globe are not doing enough to prevent these types of attacks.
Global Cyber Alliance (GCA), found that while the top five largest banks in the United States are using Domain-based Message Authentication, Reporting & Conformance (DMARC), only 11 in the United States and 9 in Europe of the top 50 in each region are using it.
DMARC, is a validation system for email that helps detect and prevent email spoofing of email addresses, which is a popular way that cybercriminals are managing to get these spearphishing messages opened and malicious links or attachments clicked. It also can help an organization protect a company’s brand, reputation, and customer relationships by preventing hackers from spoofing its name. Philip Reitinger, President and CEO of Global Cyber Alliance (GCA) noted, “If a customer can’t trust your email correspondence, they will be looking elsewhere rather quickly.”
The DMARC protocol helps financial institutions (and other organizations) prevent spammers and phishers from being successful, which is a big problem; especially if the sender appears to be known by the recipient. Surprisingly, 69% of people surveyed in a study (Avecto) said they had no concern about opening messages and clicking links and attachments from friends, colleagues, vendors, and suppliers.
On the other hand, DMARC is free to use, relatively simple to implement, and recommended by the Computer Emergency Response Team for the European Union (CERT-EU). Considering that the average cost to a financial institution is “substantially above the overall mean of $221” per capita (Ponemon Institute’s Cost of a Data Breach), DMARC is worth consideration at the very least.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
