October is Cybersecurity Awareness Month, and it starts with large attacks against two prominent financial organizations – An Experian breach, which affected 15 million T-Mobile customers; and Scottrade, which compromised the information of approximately 4.6 million customers. The reality is that there are still huge gaps in companies’ security programs in financial institutions, and unless it gets under control, there will be bigger problems ahead that will affect everyone.
As Experian reported[1], “Based on Experian’s investigation to date, the unauthorized access was an isolated incident over a limited period of time. It included access to a server that contained identifying information for some organizations and, primarily, personal information for individuals, including some current customers, and also consumers who applied for T-Mobile USA postpaid service or device financing, which require a credit check, from Sept. 1, 2013 through Sept. 16, 2015. Records containing a name, address, Social Security number, date of birth, identification number (typically a driver’s license, military ID, or passport number) and additional information used in T-Mobile’s own credit assessment were accessed…”
Scottrade also has an announcement on their website[2] to notify customers: “Although Social Security numbers, email addresses and other sensitive data were contained in the system accessed, it appears that contact information was the focus of the incident. We have no reason to believe that Scottrade’s trading platforms or any client funds were compromised. Client passwords remained fully encrypted at all times and we have not seen any indication of fraudulent activity as a result of this incident. We have secured the known intrusion point and conducted an internal data forensics investigation on this incident with assistance from a leading computer security firm. We have taken appropriate steps to further strengthen our network defenses.”
The truth is clear – whether your company is a retail bank or commercial bank with branch offices scattered across the world, an insurance company, or a trading company, the data your company possesses is highly valuable and cybercriminals will stop at nothing to obtain it.
Here are the Top 3 Kinds of Attacks against Financial Services:
1. Advanced Persistent Threats
Advanced persistent threats (APTs) are highly dangerous to an organization as they employ multiple attack techniques in numerous stages. They are targeted and extremely difficult to detect because they occur over days, weeks, months, or years. They are composed of multiple small events and methods, which individually may seem harmless. When finally detected, it is often too late. Designed to infiltrate systems while evading detection, APTs allow attackers to target a company and gain access to particular assets over a period of time.
2. Network and Endpoint Security
One of the greatest challenges to financial institutions is that they must constantly adapt and meet the growing demands of their customers. Since the digital age began dominating the way we communicate, interact, pay bills and perform our everyday banking and purchases, banks have had to ensure the security of the data that is being sent through numerous networks across numerous websites and applications. Whether it is through the Internet, the Cloud, mobile applications, or even text messages, hackers have designed ways to exploit vulnerabilities in mobile technology to gain access to credentials and account information.
3. Denial of Service Attacks
Denials of Service (DoS) attacks use a single Internet connection to overwhelm internet-connected systems with massive amounts of data. It may seem harmless at first, but cumulatively it overpowers the network and application layers with huge volumes of traffic. These kinds of attacks are often used as part of a broader attack strategy. This can be accomplished by using DoS techniques as a diversion for a multi-vector attack ultimately designed to confiscate data.
What can we do?
Financial cybersecurity is a profoundly complex, multifaceted ecosystem that demands advanced protection from sophisticated cyber threats. This means that integrated solutions are needed to protect against advanced persistent threats and zero-day attacks while also helping the organization uphold regulatory compliance and maintain complete visibility into operations with centralized security management. Ultimately, protections should automatically adapt to the threat landscape without the need for security administrators to follow up manually on thousands of advisories and recommendations. These protections must integrate seamlessly into the larger IT environment, and the architecture must provide a defensive posture that collaboratively leverages both internal and external intelligent sources.
To find out more about the effects of financial services breaches, and what you can do to protect your company, download our 2015 Cyber Security Report.
[1] “Overview: Unauthorized Acquisition of Personal Information.” <i>Overview: Unauthorized Acquisition of Personal Information</i>. Experian, 08 Oct. 2015. Web. 09 Oct. 2015.
[2] “Cyber Security Update.” Scottrade.com. Scottrade, 1 Oct. 2015. Web. 09 Oct. 2015.