News

Cybercriminals not just focused on 'big guys,' fraud expert warns

November 17, 2016

In recognition of International Fraud Awareness Week, happening Nov. 13-19, TMG Fraud Prevention Manager Ashley McAlpine is warning that distributed denial of service and ransomware attacks are no less a threat to small organizations than to global giants.

"It may look like these attackers are only after the big guys. In fact, small organizations are very much on the radar of these criminals," McAlpine said, according to a press release.

A DDoS attack occurs when many compromised systems attack a single target. The result is denial of service for users of the targeted system. Ransomware, a type of malware, allows attackers to encrypt a victim's data and demand payment in an untraceable digital currency in exchange for the decryption key. 

One recent high-profile DDoS attack disrupted Visa, Twitter, Spotify, Airbnb, Netflix and other major websites, causing an hours-long outage. A similarly high-profile ransomware attack on victims of the 2015 data breach at the U.S. Office of Personnel Management threatened as many as 22 million government workers.

Incidents like these can give small financial institutions a false sense of security, McAlpine said. But they can present an easy "test bed" for attackers honing their craft, in part because they often have fewer layers of protection.

In fact, ransomware strikes small businesses at a rate eight times higher than that of larger counterparts. Some cybersecurity experts predict ransomware will become as prevalent as DDoS attacks in 2017.

McAlpine said that FIs should take the following steps to mitigate the risk of DDoS and ransomware attacks:

• educate and train employees, including executives;
• update firewalls and routers;
• change default passwords and update all passwords often;
• hire a "white hat" hacker, a cybersecurity expert adept at finding gaps in security protocols; and
• designate a cybersecurity leader internally or partner with an outside security firm if the appropriate internal resources are not available. "However, even when you partner with an outside organization, there has to be an internal champion to monitor evolving threats and oversee a plan to protect against them," McAlpine said.