Firms may also need to limit internet access on outdated machines, and increase patch updates and logging frequency, he said.

Hackers scan networks for vulnerabilities

Attacks don't need to be sophisticated, Roberts said. A so-called zero-day attack is when a hacker exploits a previously unknown hole in a target's software before the vendor can fix it. "We don't need a complicated zero-day to get access to the network or to get access to your bank," he said. "In fact, even just physical access is easy still; getting access to a financial institution and walking in by impersonating a repairman."

Some small financial institutions may feel like their size protects them from hackers, but Roberts said "that is categorically untrue." Hackers are scanning networks for vulnerabilities, regardless of where they are located or how many assets they can potentially access.

Firms should audit user logins and service accounts to delete accounts from former or temporary workers. (Photo: Shutterstock)

Traditionally, firms used signature-detection tools, such as antivirus and anti-malware tools, threat matching, block lists, intrusion defense and prevention systems, and reputation-based signature detection to identify threats.

These tools rely on events that have already happened and been reported to block threats, and on their own are inadequate. "Today's landscape requires much more than a signature-based approach to detection," Roberts said.

"The effectiveness of these signature-based detection methods depends on how often the cyber criminal is evolving their approach from something that is known to unknown," he added.

New tools for detection

New tools for detection include anomalous activity detection, which builds a baseline of user activity and looks for events outside of normal activity.

For example, say an employee who typically works from 8 to 5 appears to log in to the network at 3 a.m. Roberts said, "Why is Steve logged in at 3 in the morning? Does somebody have access to his credentials or is Steve logged in at 3 in the morning because he's at the office downloading files to a USB drive because he's stealing data from the network?"

Daily tasks should include reviewing activity for new incidents and abnormal data flows, Oldright suggested. Firms need a way to quickly escalate issues when they're identified.

Related: Data breaches continue to increase, according to figures from Beazley

After finding a threat, firms should block the IP address on the firewall and isolate the host, but this is also a good time to educate users, Oldright said.

Steps for prevention

Steps for prevention include internal penetration tests, restricting access to certain administrators, and monitoring guest and wireless networks. Firms should have the same policies that go on their production networks on guest networks, and monitor them for breaches, Oldright said.

Firms should also audit user logins and service accounts to delete accounts from former or temporary workers, including any test or demo accounts that may have been set up for new software.

Finally, firms should conduct regular scans for vulnerabilities. "If you haven't already done so, you want to implement a vulnerability management program," Oldright said, such as Nessus or Pwnie Express. He recommended conducting weekly scans and downloading patches as they become available.