EXECUTIVE BRIEF

Sponsored byFile Sharing and Collaboration
Leads to Security Gaps in
Financial Services Firms
Introduction
Financial services organizations, including banks, brokers, insurance, and wealth managementadvisors, are generally considered the most secure enterprises. According to an April 2015 study by
Accenture, 86% of people in the U.S. and Canada said that banks and financial institutions were thecompanies they trusted most with managing their data securely, far ahead of mobile phone providers,tech firms, and social media platforms.1
Trust and financial services go hand in hand. Not only do customers trust financial institutions with
their assets, but with their personal information as well. The very nature of the business involves agreat deal of sensitive information, from account balances to personal identifiable information (PII)
like Social Security numbers.
There are a number of regulatory regimes imposed on financial services firms at the international,
federal, state, and local levels. Many of these regulations govern data security, making financial
institutions subject to a great deal of scrutiny over their cybersecurity efforts. Among the betterknown regulations are the Federal Information Security Management Act (FISMA), the Gramm-LeachBliley Act (GLBA), the Payment Card Industry Data Security Standard (PCI DSS), the EU’s General Data
Protection Regulation (GDPR), and New York State’s NYCRR Part 500 regulations.
With hefty fines, strategic and operational impacts, and exposure to legal action, the failure toadequately protect sensitive information is costly for any organization. According to the 2017 Cost of
Data Breach Study by the Ponemon Institute and IBM, the average total cost of a data breach is $3.62
million.2 In financial services, the cost is particularly high. The study found that breaches cost financial
firms $336 per compromised record. Only healthcare – another highly regulated industry – suffers ahigher per-record cost at $380.

In this Paper• Regulatory scrutiny makes data breaches
particularly costly for organizations that
operate in the financial services industry• Data breaches can come from any numberof sources, including mistakes fromwell-intended employees, rogue employees, andinternational crime organizations• Solutions exist today to help financial services
organizations better protect their unstructured
data and avoid costly breaches

A QuinStreet EXECUTIVE BRIEF © 2017

File Sharing and Collaboration Leads toSame Title
SecurityGaps
As thein Financial
Cover: AServices
QuinStreet
Firms
Executive Brief

Information security discussions often focus on perimeter security

policies cover unstructured data such as business files. However,and intrusion prevention, which is understandable. Many high-profile

the survey also confirms the presence of significant security

breaches, including the 2017 Equifax incident, involve intruders

risks involving unstructured data and file sharing.

gaining access to databases full of records stored as structured
data. This Research Brief, however, focuses on two areas thatreceive less attention: unstructured data (such as Microsoft Officefiles, PDFs, and image files), and the security risks present in many

Despite the fact that the vast majority of respondents said that
their firms had security policies covering unstructured data, only
35% of survey respondents reported they were certain that theirof the internal business processes that use it.

business processes around collaboration and file sharing meet

The same regulatory scrutiny and fines that apply to a breachthey were only “somewhat confident” or “not at all confident”

of structured data also apply to breaches that result fromabout their ability to meet regulatory requirements. Most of theflaws in file sharing (which usually involves business files – i.e.,survey’s respondents indicated plans are in place for addressing

unstructured data). Sometimes these breaches are subject tothe security of unstructured data.

their regulatory requirements. One-third of the respondents said

higher penalties because they highlight greater flaws in internal
operations and processes.
Data Protection Policies Covered by Financial Industry Regulations
PCI
DSS

GDPR

How confident are you that your business process aroundcollaboration and file sharing meet security standards orregulatory requirements such as GLBA, the new NYCRR Part 500
and GDPR regulations?

NYDFS
500

GLBA/
FFIEC

Protection of Customer Info









Not at all confident

Encryption









Somewhat confident

Access Controls









Mostly confident

Compliance Logging and Reporting









Oversight of External Users









Incident Monitoring and Reporting







The findings in this Research Brief are based on a survey of 200
IT professionals who work in financial services. The survey was
conducted in September 2017.

Security is Top of Mind, But Risks Remain
The survey results confirm that financial services organizations
put a great deal of effort into their security plans for structured
and unstructured data, as well as for sharing sensitive files. They

5%
28%
33%
35%

Certain
Total Number ofRespondents = 200

0

10

20

30

A QuinStreet EXECUTIVE BRIEF © 2017

50

60

70

Email is a Problem
The survey results uncovered areas where the businessprocesses used by financial services institutions were exposing
them not only to risks, but to inefficiencies as well. The mostprominent example involves email.
Does your organization’s security policy address unstructured
data beyond who can access the file repositories?

also confirm that financial services firms believe their security“Email was created for the fast,easy distribution of information,
but it was not developed withsecurity in mind.”

40

10%
Yes

6%

No
I don’t know

84%

2File Sharing and Collaboration Leads toSecurity Gaps in Financial Services Firms

Consider that a copy of each email message is saved:
Does your organization’s security policy cover file sharing?
1%

9%

Yes
No

•

On the outbound email server•On the inbound email server•

On each recipient’s hard drive•

On each device that the sender and each recipient uses toaccess their email.

I don’t know

90%

Even in a simple scenario where an email is sent from one sender
to one recipient, where each party uses a single device, that’s four
copies of the message on various machines. Now consider thatAs with most businesses, file sharing via email is a very common

each of those machines or devices is vulnerable to attack, misuse,practice at financial institutions. The survey found that moreor in the case of mobile devices, they may be stolen or lost.

than four out of five respondents said their organization sends
sensitive files via email as part of their business process.

There’s no way for organizations to guarantee that an outside
device or email server is secure, which means any information
sent via email needs to be treated as if it will be exposed at some

Does your organization use email to send sensitive
documents?
10%
Yes

Salesforce.com learned the hard way in 2016 — or the private
musings of a public official, like former U.S. Secretary of State

6%

Colin Powell whose personal email was made public by hackers
in 2016.

No
I don’t know

point, whether it’s sensitive business information — a lesson

84%

Mistakes Happen
One of the biggest missteps reported by survey respondents was
the accidental sharing of sensitive files. More than one-quarter

Email was created for the fast, easy distribution of information,
but it was not developed with security in mind. That makes emailof respondents indicated they had a security breach caused by asimple mistake.

a poor choice for sending sensitive information. More recent

Typos, busy people trying to multitask, and new employees are justadvances in email security, such as encrypted email, are notsome of the ways human error can lead to the release of sensitive

practical for day-to-day communications with external parties

information. In addition to better technology solutions for securely

due to low adoption rates for this technology.

sharing unstructured data, the survey findings suggest that better

Using email to send sensitive information exposes financial
services firms and their partners to a great deal of risk. Whena copy of an email and any associated information (like anattachment) is sent from one user to another, multiple copies

training on the handling of business documents, which is repeatedon a regular cadence, could help reduce costly mistakes. Better
security practices also need to extend beyond employees toinclude partners and consultants as well.

of the message are also stored on servers and devices, some

Audit trails are particularly useful for instances where sensitiveof which are beyond the control (and security policies) of theinformation is accidentally shared. The ability to see whoorganization where the email originated.

A QuinStreet EXECUTIVE BRIEF © 20173

File Sharing and Collaboration Leads toSecurity Gaps in Financial Services Firms

received the information, viewed the file, downloaded it, or madeorganizations either have employees using file-sharingedits is an important feature of enterprise-grade file-sharing andapplications that are not approved by IT (and one assumes,

collaboration solutions. An audit trail can be used to understandtherefore, not covered in the existing security plan) or they

the extent of a mistake and help contain the damage.

aren’t sure about the use of such applications. Twenty percent

When an outside counsel representing a large U.S. bank turned
over documents as part of a routine discovery process related toa lawsuit in 2017, more than a gigabyte of sensitive information
unrelated to the matter in question was accidentally released,
including financial information on as many as 50,000 individuals.
The information was sent by the bank to its outside counsel,
and was then burned onto a CD and delivered to the plaintiff’s
lawyers. Once the information left the bank’s network, there wasof respondents indicated that their firm suffered a data breachinvolving unstructured data as a result of its employees using
personal email accounts or file-sharing solutions.
Many companies report that employees are using non-approved
file sharing apps.
Do your employees use file sharing solutions
that are not approved by IT?

Examples may include: cloud-based email applications, consumer filesystems such as Box or Google Drive, or collaboration apps

little that the financial institution could do to stop it from being
shared further. This example demonstrates how the ability to
revoke access to information after it has been shared can help
prevent a mistake from becoming a very costly problem.

27%

Yes
No
I don’t know

63%

10%

Rogue Employees: Consumer-Grade File-Sharing
Applications
The widespread availability of web-based file-sharing systems
also presents a risk to financial services firms. Employees use
file-sharing applications as shortcuts to try to get their jobs
done, but in doing so they are exposing their company, other
employees, customers, and partners to an enormous amount of

Has your company experienced any of the following types ofdata breaches involving unstructured data?
Security breaches due to lost,
stolen or unsecured devices

18%

risk, including compliance issues.

Use of personal email accounts
and file sharing solutions

20%

More than one-third of respondents to the survey said their

Use of personal software or
devices for corporate business20%

Total Number ofRespondents = 200“Many financial institutions
that lack confidence in modern
technology or tools to mitigate
risks related to unstructured data
are still using legacy technologies
as an alternative.”

A QuinStreet EXECUTIVE BRIEF © 2017

0

10

20

30

40

50

What if financial institutions used the appeal of consumer-grade
file-sharing and collaboration tools to help create an experiencefor employees that is both secure and easy to use? Many of thefreely available tools employees turn to in place of authorized
applications or processes are simple, increase employee
productivity, are accessible from multiple devices and locations;however, enterprise-grade security is not a built-in capacity.

4File Sharing and Collaboration Leads toSecurity Gaps in Financial Services Firms

When it is difficult for employees to access business email or otherBy implementing controls that give them complete control overapplications because they are off the corporate network, they are

their files, financial institutions gain the ability to neutralize

more likely to turn to web-based applications like email to send,

attacks by bad actors that take place despite their best efforts

receive, and store information because it’s available wherever there’sand existing defenses to prevent them. Every organization thata working Internet connection. The same can be said of web-based

was affected by WannaCry was protecting its network using

file-sharing applications, which can be used to access documents

tactics such as intrusion prevention, but they became victims

when an employee cannot access their business computer.

nonetheless. If access control for files, including the ability to

Bad Actors
Many of the well-publicized data breaches in recent years
involve bad actors: people or groups that intend to do harm byaccessing information left exposed by organizations of all types.

revoke access to sensitive information, were as widely used as
firewalls and perimeter defense strategies, attacks by bad actors
would be less lucrative and potentially less common.
Internal leaks trail external attacks, but remain a significant threat

More than one-quarter of the survey respondents reported theirHas your company experienced any of the following
types of data breaches involving unstructured data?

organizations suffered a data breach because of an external
attack, which could include hackers that are part of organizedRansomware

crime networks, lone actors or small groups that probe networks
to see what they can find, or attackers sponsored by nation-

13%

Internal leaks (by bad actors)

states looking to create havoc and steal data.

17%

Attacks / hacks

Seventeen percent of survey respondents reported their

Total Number ofRespondents = 200

organizations suffered a data breach at the hands of internal bad

26%
0

10

20

30

40

50

actors. This includes disgruntled employees and others, whoeither attained access to sensitive information or had access allalong and simply distributed the data to unauthorized parties.
A smaller but still significant percentage (14%) of respondents said
their organizations were the victims of a ransomware attack, wheredata is taken and held hostage until the attacker is paid off andreleases it (although payment doesn’t always guarantee its release).
The most noteworthy ransomware attack of the past several years is
the WannaCry attack, which struck the Internet in the spring of 2017.

“More than one-third of
respondents to the survey said
their organizations either have
employees using file-sharing
applications that are notapproved by IT.”A QuinStreet EXECUTIVE BRIEF © 2017

Cumbersome Process and Inefficiencies
Many financial institutions that lack confidence in modern
technology or tools to mitigate risks related to unstructured
data are still using legacy technologies as an alternative. Nearly
80% of respondents said their companies are sending sensitive
documents via old-fashioned snail mail and faxes. Threequarters of the respondents cited security reasons or legacy
processes that have not yet been modernized as the reason forusing postal mail and faxes. More than 40% indicated their use
was the result of technological or hardware constraints.
Why does your organization mail or fax documents?
Security reasons

77%

Legacy process

71%

Technology/hardware constraints

42%

Other

8%

5

File Sharing and Collaboration Leads toSecurity Gaps in Financial Services Firms

Whatever the reason for using mail and faxes, two things•

File access and usage controls: Ability to restrict accessare clear: first, these forms of communication carry security

to authorized users and restrict the redistribution of files.

risks of their own (e.g., you don’t really know who receives

Support for Digital Rights Management (DRM), water-marking

the information once you send it); and second, they create

and online view-only mode.

significant inefficiencies in the way that financial services firms
are conducting business. There is a substantial opportunity•

management. Ability to change or revoke access manually or

to increase productivity, speed, and customer satisfaction

automatically, even after files have been shared.

by adopting new technologies for communicating sensitive
information if it can be done in a secure manner.

•

adopting enterprise software technologies. The ability to send
documents via email, for example, is faster and less expensive
than using postal mail or fax. But, mail and fax are often
perceived as being more secure.

Integration and support for data loss prevention (DLP)
solutions.
Productivity requirements include:•

Collaborative workspaces accessible via browsers and apps.

•

A platform-agnostic approach that supports secure access,productivity and file synchronization. Must support the mostWhen organizations invest in the right tools and processes,

important OS in the enterprise – Windows, MacOS, iOS, Android,

there doesn’t have to be a tradeoff. Modern file-sharing tools

and HTML 5.0 browsers (for any device that runs them).

exist today that are built around the concept of increasing
security, regulatory compliance, and productivity. They are

Logging and auditing: Ability to capture and log all data
access events. Support for flexible compliance reporting.

Improving the Security of Unstructured Data andRelated Processes
There’s often a tension between productivity and security in

Administrative controls: Fine-grained user and policy•

The ability to extend and secure existing repositories todeveloped to provide the same level of service and ease ofprotect files in place and enable access and sharing without

use as the consumer-grade products in the market, while also

the need for data migration

offering enterprise-grade security, administration, and reporting
features. The following requirements can help financial services
institutions identify a solution that meets their needs.

•

Support for existing workflows and systems, with a robust
integration architecture and development APIs and SDKs.

Security and compliance requirements include:

Conclusion•

File encryption: With FIPS 140-2 certified crypto-modules.

For many institutions in the financial services industry, their

Files encrypted at rest, in transit, and in use.

current security policies, applications, and business practices they
rely on when working with unstructured data may not be sufficient“It’s important that financial
services institutions havea way to respond to thesebreaches and minimize thedamage when they occur.”

A QuinStreet EXECUTIVE BRIEF © 2017

for protecting them from security risks or meeting compliancerequirements. This creates a great deal of risk for these firms
because of the high costs of a data breach -- in terms of customer
trust, restitution, and penalties -- can ruin a business.
Data breaches are going to happen. They happen at the hands ofwell-meaning employees who make mistakes, rogue employees
who fail to follow policies and procedures designed to protect6File Sharing and Collaboration Leads toSecurity Gaps in Financial Services Firms

the organization, and bad actors that hope to profit from gaining

processes and make it difficult to access or find information

access to sensitive information. It’s important that financial

will drive employees to the consumer-grade applications that

services institutions have a way to respond to these breaches

introduce risk. Collaboration and file-sharing solutions designed

and minimize the damage when they occur.

with security, productivity, and compliance in mind will go a long

Secure file-sharing and collaboration applications can help

way toward reducing the risks associated with unstructured data.

financial services institutions protect themselves and theirBlackBerry Workspaces

customers. Applications with the ability to restrict and revoke

BlackBerry Workspaces makes enterprises more mobile andaccess to business documents, for example, can prevent thecollaborative, while reducing the risk, complexity, and costdissemination of information that is stolen or accidentallyof sharing information across and beyond your organization.

released. Audit trails can help more quickly uncover rogue

Workspaces provides file-level encryption and user accessemployees and assist in meeting regulatory requirements.

controls, so you maintain control over your content even

But modern technology will only be widely adopted by employees
if it improves productivity. Security must be a core feature of
the workflows. Barriers created by applications that complicate

after it leaves your firewall. Workspaces also embeds digitalrights management (DRM) protection in your files, so you cancontrol what the recipient is able to do with the file once they gain
access to it. Learn more and sign up for a free trial atblackberry.com/workspaces.

Respondents by Business TypeBank
14

Brokerage
Wealth Management
Insurance
Card Processor

17

Information Security

21

140

4
9

8

Senior Management
Compliance

29

Other

24

Information Technology

17

Card Issuer

Respondents by Function

36

155

Other

About the Survey
The survey of 200 IT professionals in the financial services industry was conducted in September 2017. Respondents received an email invitation to takethe survey. The respondents include a number of job functions and business types within financial services.

About BlackBerry®
Today, BlackBerry is a transformed company. Building off decades of innovation in secure communications, BlackBerry continues to be a trusted
technology provider for financial institutions the world over. BlackBerry’s secure file sharing solution, BlackBerry Workspaces, received the highest scorein two of five use cases in the 2017 Gartner Critical Capabilities for Content Collaboration Platforms Report.

1

https://newsroom.accenture.com/industries/banking/north-american-consumers-overwhelmingly-trust-banks-to-securely-manage-their-personal-data-according-to-accenture-report.htm

2https://www.ibm.com/security/data-breach/index.html

A QuinStreet EXECUTIVE BRIEF © 20177