Cybercrime and Cyber Risk Management

Introduction

Financial institutions depend on information systems for payments, lending, insurance underwriting, customer identification, trading, regulatory reporting and communication. This dependence creates efficiency and competitive advantage, but it also exposes institutions to cybercrime. A successful cyberattack may cause direct financial loss, theft of confidential information, market disruption, regulatory penalties, litigation, reputational damage and loss of customer trust.

Cyber risk is the possibility that the confidentiality, integrity or availability of information assets, systems or services will be adversely affected by a cyber event. Cybercrime is the use of computers, networks or digital services to commit an unlawful act. The two concepts overlap, but they are not identical: cyber risk includes accidental failures, system weaknesses and third-party disruption, whereas cybercrime requires criminal conduct.

In banking, finance and insurance, cybersecurity is therefore not merely an information-technology responsibility. It is an enterprise risk-management, governance and business-continuity responsibility.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain major forms of cybercrime affecting financial institutions.
2. Analyse phishing, malware, ransomware, credential theft, account takeover and data breaches.
3. Assess social engineering, supply-chain attacks and insider threats.
4. Apply principles of cyber hygiene, identity and access management, encryption and secure architecture.
5. Use recognized frameworks, including the NIST Cybersecurity Framework and ISO/IEC 27001 concepts, to structure cyber-risk management.
6. Recommend proportionate preventive, detective, responsive and recovery controls.
7. Evaluate ethical, legal, governance and operational implications of cybersecurity decisions.

1. The Cyber-Risk Environment

A financial institution's attack surface includes customer-facing applications, mobile banking, payment interfaces, employee devices, cloud services, application-programming interfaces (APIs), automated teller machines, data centres, vendors and privileged administrative systems. Digital interdependence means that a weakness in one component may affect many others.

Cyber risk is commonly analysed through three security objectives:

• Confidentiality: information is accessible only to authorised persons.
• Integrity: information and processing remain accurate, complete and unaltered.
• Availability: systems and information are accessible when required.

These objectives support financial-sector requirements such as reliable payment settlement, accurate account balances, protection of personal data and continuous customer access.

A useful risk expression is:

Likelihood represents the probability or credible frequency of an adverse event, while impact represents financial, operational, legal, regulatory, safety and reputational consequences. This is a risk-screening model, not a precise law of nature. It is most useful when assumptions, time horizon and impact categories are stated consistently. Some organisations use a more detailed model:

The annual rate of occurrence estimates how often an event may occur in a year; the single loss expectancy estimates the loss from one event. These figures are uncertain and should not create false precision. Scenario analysis is often more reliable than relying on a single numerical estimate.

2. Major Forms of Cybercrime

Phishing and Social Engineering

Phishing uses deceptive messages, websites or communications to persuade a target to reveal information, transfer money or install software. Spear-phishing is targeted at a particular person or institution. Whaling targets senior executives or high-value individuals. Business email compromise may impersonate an executive, supplier or customer and request an urgent payment or change to bank details.

Social engineering exploits human judgement rather than a purely technical vulnerability. Common techniques include authority, urgency, fear, familiarity and reciprocity. A caller may pretend to be a fraud investigator; a message may claim that an account will be suspended unless the customer acts immediately.

Controls include security awareness, verification through an independent channel, payment approval segregation, email authentication, phishing-resistant multifactor authentication and transaction monitoring. Training should be continuous and measured through improvement, not humiliation or blame.

Malware

Malware is malicious software designed to disrupt, damage, spy on or gain unauthorised access to systems. Examples include:

• Trojans, which appear legitimate but perform unauthorised actions;
• Spyware, which collects information covertly;
• Keyloggers, which record keystrokes;
• Botnet agents, which allow a device to be controlled remotely;
• Wipers, which destroy data or system functionality; and
• Remote-access tools, which provide unauthorised control.

Malware may enter through malicious attachments, compromised websites, software vulnerabilities, removable media or third-party software. Endpoint detection and response, patch management, application allow-listing, network segmentation, secure backups and least privilege reduce the likelihood and impact of infection.

Ransomware

Ransomware encrypts or otherwise blocks access to data and demands payment. Modern campaigns may also steal data before encryption and threaten public disclosure. This is known as double extortion. Ransomware can interrupt loan processing, claims administration, payment operations and customer service.

Resilience depends on tested offline or logically isolated backups, rapid restoration procedures, privileged-account controls, segmentation, vulnerability management and incident-response exercises. Paying a ransom does not guarantee recovery, confidentiality or legal permissibility. Any payment decision requires executive, legal, sanctions-screening and law-enforcement consideration.

Credential Theft and Account Takeover

Credential theft involves obtaining passwords, tokens, security answers or authentication cookies. Credentials may be stolen through phishing, malware, password reuse, credential stuffing or data breaches. Account takeover occurs when an attacker uses stolen credentials to control a customer, employee or administrator account.

Controls include unique passwords, password managers, multifactor authentication, device and behavioural analytics, adaptive authentication, session monitoring, transaction limits, step-up verification and rapid credential revocation. Phishing-resistant methods, such as hardware-backed security keys or passkeys, are generally stronger than one-time codes delivered through easily intercepted channels.

Data Breaches

A data breach is an incident involving unauthorised access to, disclosure of, alteration of or loss of protected information. Financial institutions hold identity documents, account data, payment details, credit information, health information and commercially sensitive records.

The consequences depend on the type of data, scale, exposure period, jurisdiction and likelihood of misuse. Effective controls include data classification, minimisation, retention limits, encryption, database activity monitoring, loss-prevention controls, access reviews and documented notification procedures.

Supply-Chain Attacks

Financial institutions rely on software providers, cloud hosts, payment processors, managed-security providers, telecommunications firms and data vendors. A supply-chain attack compromises a supplier, software update, dependency or service provider in order to reach downstream victims.

Supplier risk management should assess security before contracting, define minimum controls, require incident notification, restrict supplier access, review subcontractors, test resilience, verify software provenance and maintain exit arrangements. A supplier's certification is useful evidence but is not a substitute for the institution's own risk assessment.

Insider Threats

An insider threat may involve a malicious employee, a coerced individual, a negligent user or an attacker using a compromised employee account. High-risk indicators can include unusual access, bulk downloads, unexplained privilege changes and activity outside normal working patterns, although indicators are not proof of wrongdoing.

Controls include separation of duties, least privilege, privileged-access management, joiner-mover-leaver procedures, monitoring with due process, whistleblowing channels, background screening where lawful and prompt access termination. Insider-threat programmes must balance security with privacy, labour rights and fairness.

3. Cybersecurity Principles and Architecture

Cyber Hygiene

Cyber hygiene consists of routine practices that reduce avoidable exposure:

• maintain an accurate asset inventory;
• apply security patches according to risk and exploitability;
• remove unsupported software;
• use secure configurations and disable unnecessary services;
• implement reliable, tested backups;
• deploy endpoint protection and central logging;
• use strong authentication and unique credentials;
• train staff and customers;
• test incident-response and recovery plans; and
• review exposure continuously.

Cyber hygiene is foundational, but it cannot eliminate advanced threats. It must be combined with architecture, monitoring and governance.

Identity and Access Management

Identity and access management (IAM) answers three questions: who is requesting access, what may that identity do, and under what conditions? Important principles include:

• Least privilege: grant only the access needed for an approved task.
• Need to know: restrict information according to legitimate business need.
• Separation of duties: divide incompatible activities, such as payment preparation and approval.
• Privileged-access management: tightly control administrative accounts.
• Multifactor authentication: require two or more independent authentication factors.
• Strong lifecycle management: create, modify and remove access promptly.

A factor may be something known, possessed or inherent. Multiple passwords are not true multifactor authentication because they are the same factor category. Authentication confirms identity; authorisation determines permitted actions; accounting or logging records activity.

Encryption and Key Management

Encryption transforms readable plaintext into ciphertext using an algorithm and key. Confidentiality depends not only on a strong algorithm but also on secure key generation, storage, rotation, access control, backup and destruction. Data should be protected both in transit and at rest where the threat model warrants it.

Hashing is different from encryption. A cryptographic hash is a one-way transformation commonly used for integrity checking and password verification. Passwords should be stored using a deliberately slow, salted password-hashing scheme rather than reversible encryption or unsalted hashes.

Key-management failures can defeat otherwise strong encryption. Institutions should define ownership, key custodianship, recovery procedures, separation of duties and access logging.

Secure Architecture and Zero Trust

Traditional perimeter security assumes that systems inside a network are relatively trustworthy. Modern architecture assumes that no user, device or connection should receive automatic trust. Zero-trust principles require explicit verification, least-privilege access, continuous evaluation and segmentation.

Secure architecture commonly includes network segmentation, secure APIs, hardened endpoints, application security testing, secrets management, resilient identity services, central logging and controlled administrative paths. Security should be designed into systems from requirements and architecture through development, deployment and retirement.

A secure software-development lifecycle includes threat modelling, code review, dependency management, security testing, vulnerability remediation and controlled release. Developers should treat external input as untrusted and protect against common weaknesses such as injection, broken access control and insecure authentication.

4. Recognized Cybersecurity Frameworks

NIST Cybersecurity Framework

The NIST Cybersecurity Framework 2.0 organises cybersecurity outcomes into six functions:

The framework is outcome-oriented rather than a checklist. An institution can create a current profile, define a target profile, identify gaps and prioritise investment.

ISO/IEC 27001

ISO/IEC 27001 provides requirements for an information-security management system. It emphasises organisational context, leadership, risk assessment, risk treatment, documented information, operational controls, performance evaluation and continual improvement. Certification may provide assurance, but it does not prove that every threat is prevented or that risk is acceptable.

COBIT and Sector Guidance

COBIT supports governance and management of enterprise information and technology. Financial institutions may also be subject to central-bank guidance, data-protection law, payment-security requirements, outsourcing rules and operational-resilience expectations. Frameworks should be integrated rather than adopted mechanically.

5. Detection, Response and Recovery

Preventive controls will fail at times. Detection should combine endpoint, network, identity, application and transaction signals. A security operations function may use a security-information and event-management platform to correlate logs, but data quality, retention, alert tuning and analyst capability are essential.

An incident-response plan should define severity levels, authority, evidence preservation, communications, legal escalation, customer protection, regulator notification and recovery criteria. The response cycle generally involves preparation, identification, containment, eradication, recovery and lessons learned.

Business continuity focuses on maintaining important functions during disruption. Disaster recovery focuses on restoring technology and data. Recovery objectives should be explicit:

• Recovery time objective (RTO): maximum targeted time to restore a service.
• Recovery point objective (RPO): maximum targeted period of data loss measured in time.

For example, an RPO of 15 minutes means that, under the recovery design, the institution aims to lose no more than 15 minutes of transactional data. These are objectives, not guarantees; they require tested procedures, resources and dependencies.

6. Risk Assessment and Measurement

A practical assessment identifies assets, threats, vulnerabilities, existing controls, dependencies and consequences. Risk registers should identify an owner, treatment decision, due date and acceptance authority.

Useful metrics include patch-age distributions, multifactor-authentication coverage, privileged-account review completion, phishing-reporting rates, mean time to detect, mean time to contain, backup restoration success and unresolved high-risk vulnerabilities. Metrics must be interpreted carefully. A low number of reported phishing incidents may indicate either low attack volume or poor reporting culture.

A control's effectiveness should be tested through evidence, technical validation, exercises and independent assurance. Compliance demonstrates that specified requirements were addressed; it does not automatically demonstrate resilience.

7. Illustrative Case: The Meridian Cooperative Bank Incident

Background

Meridian Cooperative Bank, a fictional regional institution, used a cloud-based customer relationship platform supplied by an external provider. Employees accessed the platform through single-factor passwords, and payment instructions were approved through email.

Problem

An attacker sent a convincing spear-phishing message to a relationship manager. The message imitated the cloud provider and captured the employee's password. The attacker entered the platform, downloaded customer information and sent altered payment instructions to the operations team. A second employee approved one transfer after receiving an urgent email apparently from a senior manager.

Analysis

The incident was not caused by phishing alone. Contributing weaknesses included password-only access, inadequate verification of payment changes, excessive user permissions, limited monitoring of unusual downloads, weak supplier assurance and insufficient staff awareness of impersonation techniques. The bank's incident plan also lacked a clear decision-maker for customer notification.

Approach and Solution

The bank immediately disabled affected sessions, reset credentials, contacted the payment network, preserved evidence and notified relevant authorities. It then introduced phishing-resistant multifactor authentication, independent verification for payment changes, dual approval, download-volume alerts, role-based access, privileged-access reviews and supplier-access restrictions. It conducted a red-team exercise and revised its incident and communications plan.

Outcome

The bank recovered the exposed account, limited financial loss and improved detection. It also discovered that resilience depended on business-process controls, not merely technical tools. Management accepted that security investment had to be prioritised according to customer harm and critical-service exposure.

Learning Points

1. A valid password does not prove that a request is trustworthy.
2. Fraud controls and cyber controls overlap in payment processes.
3. Least privilege limits the consequences of account takeover.
4. Supplier dependence must be treated as an enterprise risk.
5. Exercises reveal governance gaps that written policies may conceal.

8. Governance, Ethics and Regulation

The board is responsible for oversight, risk appetite and challenge, while management implements controls and reports material risks. The chief information security officer should have sufficient independence, authority and access to decision-makers. Internal audit provides independent assurance rather than operating the controls it audits.

Privacy requires lawful, proportionate collection and use of personal information. Monitoring employees and customers should have a defined purpose, access restrictions, retention limits and transparency consistent with applicable law. Incident notification duties vary by jurisdiction and may depend on the type of data, severity and affected persons.

Ethical cybersecurity rejects discrimination, unnecessary surveillance, concealment of material incidents and exploitation of vulnerable customers. Automated fraud and security systems should be tested for bias, explainability and inappropriate false positives. Artificial intelligence can support anomaly detection, malware analysis and phishing triage, but generated outputs may be inaccurate, manipulated or difficult to explain. Human oversight, secure data use and model governance remain necessary.

9. Contemporary Developments and Best Practice

Important developments include deepfake-enabled impersonation, synthetic identities, criminal use of generative AI, software dependency attacks, cloud concentration risk, passkeys, confidential computing and increasing regulatory focus on operational resilience. Attackers can automate reconnaissance and personalise deception, while defenders can use automation to correlate events and prioritise vulnerabilities.

A mature financial institution should:

1. establish board-approved cyber-risk appetite;
2. maintain an accurate inventory of systems, data and suppliers;
3. classify critical services and map dependencies;
4. implement strong IAM and phishing-resistant authentication;
5. use secure configuration, patching and vulnerability management;
6. encrypt sensitive data and govern keys properly;
7. segment networks and restrict administrative pathways;
8. monitor identity, endpoint, network and transaction activity;
9. maintain tested, isolated backups and recovery capabilities;
10. exercise incident response with executives, suppliers and regulators where appropriate;
11. assess software and third-party supply chains throughout the contract lifecycle; and
12. learn from incidents, near misses and control testing.

Chapter Summary

Cybercrime threatens the confidentiality, integrity and availability of financial services. Phishing, malware, ransomware, credential theft, account takeover, data breaches, supply-chain attacks and insider threats exploit both technical weaknesses and human or organisational weaknesses. Effective management combines cyber hygiene, least privilege, multifactor authentication, encryption, secure architecture, monitoring, resilient recovery and strong governance.

The NIST Cybersecurity Framework provides a practical structure through Govern, Identify, Protect, Detect, Respond and Recover. ISO/IEC 27001 supports a risk-based information-security management system, while sector regulation and operational-resilience requirements provide additional expectations. Cybersecurity is most effective when integrated with fraud management, business continuity, supplier oversight, privacy and ethical decision-making.

Key Terms

Cyber risk: The possibility of adverse consequences arising from a cyber event.

Cybercrime: Criminal activity conducted through or targeting digital systems.

Phishing: Deceptive communication intended to induce disclosure, payment or harmful action.

Malware: Malicious software.

Ransomware: Malware or an attack process that blocks access or threatens disclosure for payment.

Credential stuffing: Automated use of credentials exposed in one breach against other services.

Account takeover: Unauthorised control of an account.

Data breach: Unauthorised access to, disclosure, alteration or loss of protected information.

Social engineering: Manipulation of people to obtain access, information or action.

Supply-chain attack: An attack exploiting a supplier, dependency or service relationship.

Insider threat: Risk arising from a malicious, negligent, coerced or compromised insider.

Least privilege: Granting only the access necessary for an approved task.

Multifactor authentication: Authentication using two or more independent factor categories.

Encryption: Transformation of plaintext into protected ciphertext using a key.

Zero trust: Security approach based on explicit verification and absence of automatic trust.

RTO: Target time for restoring a service.

RPO: Target maximum period of data loss measured in time.

NIST Cybersecurity Framework: A framework organised around Govern, Identify, Protect, Detect, Respond and Recover.

Review Questions

Short Answer Questions

1. Distinguish cybercrime from cyber risk.
2. What is the difference between authentication and authorisation?
3. Identify three controls that reduce account takeover.
4. Define RTO and RPO.
5. Why is encryption alone insufficient without key management?

Long Answer Questions

1. Explain how phishing, social engineering and business email compromise can combine in a financial institution.
2. Discuss the role of identity and access management in limiting insider threats.
3. Compare the purposes of the NIST Cybersecurity Framework and ISO/IEC 27001.
4. Explain how a financial institution should prepare for ransomware.
5. Evaluate the governance and ethical issues involved in employee security monitoring.

Analytical / Application Questions

1. A bank detects an employee login from an unusual country followed by a large customer-data download. Analyse the possible explanations, immediate response actions and longer-term controls.
2. A payment-services supplier refuses to disclose its subcontractors but offers an audit certificate. Assess whether the bank should accept the supplier and identify compensating controls.
3. A customer receives a convincing deepfake voice call requesting an urgent transfer. Design a control process that protects the customer without creating unreasonable barriers to legitimate transactions.

Multiple Choice Questions with Answers

Question 1

Which security objective concerns preventing unauthorised alteration of account information?

A. Confidentiality

B. Integrity

C. Availability

D. Non-repudiation

Correct Answer: B. Integrity

Question 2

Which attack commonly uses stolen credentials from one service to try logging into many other services?

A. Credential stuffing

B. Network segmentation

C. Data minimisation

D. Encryption

Correct Answer: A. Credential stuffing

Question 3

Which NIST Cybersecurity Framework function establishes strategy, roles and oversight?

A. Detect

B. Protect

C. Govern

D. Recover

Correct Answer: C. Govern

Question 4

Which control most directly limits what an employee can do after an account is compromised?

A. Least privilege

B. Public disclosure

C. Data duplication

D. Screen brightness controls

Correct Answer: A. Least privilege

Question 5

What does an RPO specify?

A. The maximum intended time to restore service

B. The maximum intended period of data loss

C. The number of permitted administrators

D. The time required to detect phishing

Correct Answer: B. The maximum intended period of data loss

Question 6

Which statement best distinguishes hashing from encryption?

A. Hashing is normally designed as a one-way transformation, while encryption is reversible with an appropriate key

B. Hashing always provides confidentiality, while encryption never does

C. Hashing requires two passwords, while encryption requires none

D. Hashing is used only for network cables

Correct Answer: A. Hashing is normally designed as a one-way transformation, while encryption is reversible with an appropriate key

Question 7

Which practice is strongest for verifying a sensitive payment-change request?

A. Replying to the original email

B. Accepting urgency as evidence of authenticity

C. Independent verification through a trusted channel

D. Allowing one employee to create and approve the change

Correct Answer: C. Independent verification through a trusted channel

Question 8

A supply-chain attack primarily exploits which relationship?

A. A supplier, dependency or service provider

B. A customer's physical address

C. A bank's interest-rate calculation

D. A paper filing system

Correct Answer: A. A supplier, dependency or service provider

Question 9

Which backup characteristic is especially valuable against ransomware?

A. Being permanently connected with administrator access

B. Being isolated or otherwise protected from routine compromise

C. Having no restoration testing

D. Using the same credentials as production systems

Correct Answer: B. Being isolated or otherwise protected from routine compromise

Question 10

Which statement about cybersecurity certification is most accurate?

A. Certification guarantees that no cyberattack can succeed

B. Certification eliminates the need for incident response

C. Certification can provide assurance but does not replace the institution's own risk assessment

D. Certification makes supplier oversight unnecessary

Correct Answer: C. Certification can provide assurance but does not replace the institution's own risk assessment