Although nearly 14 years have passed, the events of Sept. 11, 2001, are never far from anyone’s thoughts. Few events in human history have so changed the landscape of any given society, and yet despite the thousands of man-hours spent to determine how we failed to recognize the threat, we continue to repeat those same procedural mistakes in different industries.

After 9/11, the U.S. government implemented changes to law, regulation, policy, etc., all to ensure that critical intelligence and information flowed freely across agencies so everyone had access to what they needed to identify and stop serious threats. While one could argue that the efforts of the government have been successful, as evidenced by a lack of a major catastrophe, the private sector has largely been left to fend for themselves.

Understanding the Threat Environment

In order for an organization to protect against an overwhelming threat environment, it first needs to understand the cybersecurity threat landscape; that is to say, enterprises must know:

  • Why are they being attacked? Or, what is the desired outcome?
  • Who are the attackers?
  • What methods are the cybercriminals using?
  • How are they executing the attack?

Having a clear understanding of the battle space is just the first hurdle. It is then incumbent upon the organization to know itself and its security:

  • What are the vulnerabilities?
  • What assets can be applied today?
  • What assets are needed in the future?
  • How do we employ those assets?
  • How do we configure ourselves to mitigate the risk?
  • What does success look like, and how do we measure that success?

All of these are great questions to lay the foundation for understanding the threat environment. Getting to an answer may take weeks or even months, however, and it will likely shift over time; it’s a continuous evolution. What is important is for organizations to seriously dedicate themselves to understanding the threat environment, assessing their organic capabilities, identifying and documenting gaps, deploying resources, developing internal policies and forming organizational structures to maximize their efforts.

Learning to Live in a New Landscape

No one will argue that the threat environment is rapidly changing, or that this fact seriously impacts multiple sectors in our economy. Every day a new data breach, attack against our infrastructure or financial crime is costing the economy millions of dollars — not to mention leaving our organizations in a vulnerable position. Left unchecked, these attacks will continue to grow and chip away at an already severely weakened infrastructure, eventually leading to a collapse.

What we need are leaders who can recognize that the threat landscape in the financial industry is drastically different from what it was 14 years ago. These decision-makers must be willing to implement solutions such as threat intelligence sharing in their organizations to mitigate modern-day risks. Changes to any enterprise are never easy, but given the serious nature of the threat landscape, industry leaders are left with little choice.

Read the white paper to learn more: The Pre-9/11 Financial Crimes Landscape

More from Fraud Protection

What’s up India? PixPirate is back and spreading via WhatsApp

8 min read - This blog post is the continuation of a previous blog regarding PixPirate malware. If you haven’t read the initial post, please take a couple of minutes to get caught up before diving into this content. PixPirate malware consists of two components: a downloader application and a droppee application, and both are custom-made and operated by the same fraudster group. Although the traditional role of a downloader is to install the droppee on the victim device, with PixPirate, the downloader also…

Unveiling the latest banking trojan threats in LATAM

9 min read - This post was made possible through the research contributions of Amir Gendler.In our most recent research in the Latin American (LATAM) region, we at IBM Security Lab have observed a surge in campaigns linked with malicious Chrome extensions. These campaigns primarily target Latin America, with a particular emphasis on its financial institutions.In this blog post, we’ll shed light on the group responsible for disseminating this campaign. We’ll delve into the method of web injects and Man in the Browser, and…

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today