With the recent cyber security attacks on M&S, Co-Op and Harrods, and with what we know so far, what should Financial Services firms be doing to stay protected?

Cyber criminality, particularly extortion and ransomware, is one of the most widespread cyber threats to businesses. This threat does not discriminate; it affects businesses of all sizes and all sectors. However, even with the recent attacks on UK retail, Financial Services remains one of the most popular sectors to target. Criminals are continually adapting their methods to maximise their gains, including using 'ransomware as a service' which allows even those with limited technical skills to launch sophisticated attacks.

While there are many unknowns still about these attacks, the NCSC, the UK’s National Cyber Security Centre, posted an article in response (https://www.ncsc.gov.uk/blog-post/incidents-impacting-retailers) that provides some insight into what may have happened and some good practice recommendations that everyone should be following. The key points included:

• Having the capability to quickly identify, assess and subsequently respond to unusual activity in your IT environment.
• Deploying and ensuring multi-factor authentication (MFA) is on.
• Reviewing the password reset processes to ensure its secure.

Whilst most of these recommendations are not new, in reality, they can be complex to implement in larger environments, such as Retail, where there are many different technologies, sites and a large number of people to consider.

One of the more interesting recommendations “Reviewing the password reset processes to ensure its secure”, does lean into some reports that access to the M&S, Co-Op and Harrods systems may have started as a result of someone impersonating a user to reset their password/MFA device and subsequently gain a foothold into the environment.

This does pose an interesting dilemma. If a user forgets their password and/or loses their multi-factor authentication device, such as their phone, how does an IT Service Desk confirm the person on the phone is who they say they are.

Securing password reset and MFA

As complex passwords with multi-factor authentication have made it more difficult for cyber criminals to gain access to a user’s account, a weakness continues to be providing support to help a user legitimately, but remotely, regain access to their account as a result of a forgotten password or lost phone.

Often, the setting in which a user needs to reset their password, or their MFA device, is not conducive to identity verification, such as;

• Location - the user may not be in the office, so carrying out verification in person is typically not possible.
• Lost phone, different number - in the case of losing their phone, you cannot identify a user from a known mobile phone number, as they are likely using a temporary or other phone.
• Voice or video – Whilst a better way to identify a user, this relies on an IT Service Desk to know the voice or what a user looks like to validate. Additionally, in the era of AI voice and video generation, validating someone's identity over the phone or video is fast becoming an increasingly unreliable verification method.
• Questions – Asking questions based on knowledge a user should know, such as job title, office number, mobile number, start date, colleagues’ names, etc, can usually be found online as a result of sites such as LinkedIn.

Additionally, an attacker using this method of gaining access to an account will pressure the IT Service Desk engineer with a sense of urgency, often impersonating someone senior at a business to apply further pressure. Whilst you could require another employee to carry out the validation rather than IT, the same issues apply, such as AI use of voice or video impersonation.

What can you do?

Banks have traditionally been institutions that have had to grapple with this challenge and use techniques everyone is familiar with, such as leveraging more personal information that a person is likely to remember, such as previous transactions, the use of snail mail (letters) to communicate to users sensitive information such as telephone banking PIN codes, or requiring a person to visit a branch in-person and supply valid forms of ID. These approaches are more difficult to achieve in a business setting, but they can inspire some alternatives.

There is no current industry standard verification method, however, Financial Services firms could implement one or more of the following techniques;

• Analog keyword – Providing users, by way of snail mail (letters) and not stored digitally, a memorable keyword they are likely to remember that must be used as part of password resets.
• Third-party validation - Companies such as Microsoft are previewing identity verification services that utilise video and facial recognition against an employee photo to validate a user, and the ability to scan government-issued identity information, such as passwords. However, these add complexity to data and privacy concerns.

None of these techniques provides 100% certainty of the validity of a person over the phone and have flaws, such as assuming the account is not already breached, but they provide more assurance than typical methods.

The most reliable method is to simply prevent any user's password reset from being carried out remotely, requiring users to have a physical presence in an office. However, this does severely impact users' ability to work and sometimes is simply not practical.

A continually changing landscape

As cyber threats continue to evolve, so must the approaches to thwart them. Whilst a cyber-attack can be extremely difficult and stressful for a company to recover from, it provides a reminder for everyone else to remain vigilant and to check their cyber security practices.

Although tools, techniques, and processes can limit the impact of an attack, it is crucial to understand that no one is immune, and an attack can happen to anyone at any time.