SMEs need to do more to stop financial criminals, says FSA

SMEs need to do more to protect themselves from fraudsters and hackers, according to report published today by the Financial Services Association (FSA).

The report, which reviewed 18 firms, "paints a mixed picture" of how financial firms have been managing their information security in the fight against fraud and other financial crime.

Whilst some major firms, particularly in the banking sector, have built their defences in response to targeting by hackers and fraudsters, other sectors and small and medium-sized firms are "less well prepared", the association said.

The FSA has warned senior management to take on responsibility for information security which includes the need for firms' defences to be continuously reviewed and updated to keep on top of the increasingly sophisticated methods used by criminals.

Although financial losses to firms and customers were found to be low, firms "could do more" to address the potential risks rather than responding to attacks once they have occurred.

Philip Robinson, Financial Crime Sector Leader at the FSA, warned that there was "no room for complacency" as criminals will seek to exploit vulnerable points where they can find them.

"Hackers and fraudsters are refining and improving their techniques as we speak. In the fight against fraud, firms will have to run to stand still if they are to protect their assets and those of their customers," he said.

"Firms should follow a preventative approach rather than reacting to a situation once it has happened which can be costly and damaging to reputation. Consumers must also take steps to prevent attacks from fraudsters, by taking care when disclosing their personal details or following the security tips offered by their online banking service."

According to the report, traditional threats to information security still existed in some firms because they did not invest adequately in their security frameworks. Some did not properly control employee access rights or user administration in their networks. Legacy systems with poor security design were also identified as a common threat.

The FSA also found that few firms had built relations with the various industry bodies and government agencies; and many small-to-medium size firms were unaware of the support available to them from schemes designed to offer advice on best practice.

(gmcg/sp)