Consumers are becoming more aware of the data companies collect about them, and place high importance on data security and privacy. Though consumers aren’t aware of every data breach, they are justifiably concerned about what happens to the data companies collect.

A recent study of consumer views on data privacy and security revealed consumers are more careful about sharing data. The majority of respondents (87%) say they wouldn’t do business with companies that appear to have weak security. Study participants also rated trustworthiness across multiple industries. Healthcare and financial services ranked higher than other industries, yet none scored especially high. Properly securing this sensitive data makes good business sense. That’s where an organization’s finance department can step in to help secure data and build trust.

The Link Between Finance and Cybersecurity

A company’s finance department holds the company’s crown jewels: They ensure financial transactions and systems are secure. The finance department is a key component of a company’s overall security.

Even though the finance department isn’t focused exclusively on cybersecurity, they secure vital operations on a daily basis. These teams are very familiar with financial regulatory reporting and compliance. Digital transactions make up the bulk of most business transactions, and each one must be secure. The nature of modern business requires this department to work in tandem with IT and security operations to ensure regulatory compliance. Data privacy and protection regulations are varied, especially for businesses with international operations. The complexity of regulatory compliance grows with each new regulation.

Finance is essential to the risk assessment and business continuity planning process. The finance department is familiar with all company financial assets and how they’re organized. They can be helpful in assessing risk to these assets. The finance department understands risk, especially third-party risk and how a partner of a partner becomes a risk. Finance is able to quantify potential risks, such as reputational or economic damages, across a variety of scenarios. They understand that they, too, can become a risk without appropriate training and procedures.

Finance Departments Make Appealing Targets

The finance department is a regular target for cyber criminals. As a result, this department must remain vigilant on all fronts since attacks can come in many forms. Social engineering and phishing are particularly popular cyberattacks since business email compromise through this department can yield banking details or direct currency transfers. Phishing emails commonly use the lure of an unpaid invoice or similar approach to garner clicks on their malicious links.

The Society for Worldwide Interbank Financial Telecommunications (SWIFT) wire transfer system was manipulated to steal $81 million from an account at the New York Federal Reserve Bank in 2016. A small town municipality in Washington lost $50,000 when an employee transferred funds to a scammer in response to a series of spoofed emails which appeared to come from the department supervisor.

These risks present real challenges to finance departments, whose main focus is not cybersecurity, to begin with. But these departments do not need to become cybersecurity experts themselves to work with the CIO to help establish and champion a culture of risk awareness throughout the entire organization. The department’s mix of experience as a target and defender gives them a unique perspective on the value of security awareness training and how well it prepares current employees for potential threats. The finance department can offer valuable feedback on the current approach.

Risk Management Builds Trust

As part of a risk management team, finance department leadership brings expert risk assessment skills to ask the right questions during planning. Cyber incident first response teams should include a knowledgeable leader from the finance department to analyze the potential financial impact of an attack. It’s important to include this person as a primary contact in official incident response policy and planning documentation. The designated finance contact should also participate in cyber incident response drills or simulations whenever possible.

Consumer perception of a company’s data privacy and security protection measures influences their purchasing decisions. The finance department helps protect customer and company data, lessening the likelihood of compromise. By securing financial transactions and systems, these departments contribute to the overall operational security of the company. Finance brings deep knowledge of regulatory compliance that can help the company navigate domestic and international privacy and security regulations that govern how data is used, stored and transmitted. Overall, keeping finance departments in the cybersecurity loop helps organizations reduce their risk and quickly respond to threats.

More from Risk Management

Security Awareness Training 101: Which Employees Need It?

4 min read - To understand why you need cybersecurity awareness training, you must first understand employees' outsized roles in security breaches. “People remain — by far — the weakest link in an organization’s cybersecurity defenses,” noted Verizon on the release of their 2022 Data Breach Investigations Report (DBIR). They elaborate that 25% of all breaches covered in the report were the result of social engineering attacks, and when you add human errors and misuse of privilege, the human element accounts for 82% of…

4 min read

Secure-by-Design: Which Comes First, Code or Security?

4 min read - For years, developers and IT security teams have been at loggerheads. While developers feel security slows progress, security teams assert that developers sacrifice security priorities in their quest to accelerate production. This disconnect results in flawed software that is vulnerable to attack. While advocates for speed and security clash, consumers must often pay the price when threat actors strike. 48% of developers admitted they were still shipping code with vulnerabilities in 2022. It’s clearly time for a change. Many believe…

4 min read

Will Commercial Spyware Survive Biden’s Executive Order?

4 min read - On March 27, 2023, reports surfaced that 50 U.S. government employees had been targeted by phone spyware overseas. On the day of that report, President Joe Biden signed an executive order to restrict federal agencies’ use of commercial spyware. The timing of the order was linked to this specific phone-targeting exploit. But spyware infiltration of government officials — and by government officials — has been a recurring problem globally. Commercial spyware has long been entwined with statecraft and spycraft, both…

4 min read

How to Boost Cybersecurity Through Better Communication

4 min read - Security would be easy without users. That statement is as absurd as it is true. It’s also true that business wouldn’t be possible without users. It’s time to look at the big picture when it comes to cybersecurity. In addition to dealing with every new risk, vulnerability and attack vector that comes along, cybersecurity pros need to understand their own fellow employees - how they think, how they learn and what they really want. The human element — the individual and…

4 min read