Story image

Report finds major banks under assault from stealth attacks

29 May 2018

Despite significant investments in cybersecurity, financial institutions are still under fire from cyberattacks.

A new report from Carbon Black has found that cyberattacks in the financial services sector are increasing in sophistication to the point where they are now often undetectable, global, and instantaneous.

Carbon Black’s recent report collected responses from chief information security officers (CISOs) at 40 major financial institutions, including six of the top 10 global banks.

A number of staggering findings were revealed in ‘Modern bank heists: Cyberattacks and lateral movement in the financial sector’, including:

23 percent of respondents experienced counter incident response

“Cyber attacks have moved from burglary to home invasion over the past few years, and cyber criminals, aware that there are humans on the other end devised to detect and respond to their activities, are increasingly reacting and adapting to defenders’ response efforts,” says Carbon Black chief cybersecurity officer Tom Kellerman.

“This trend will continue unless organisations establish specific threat hunting teams. These threat hunters should employ both active measures (agents deployed to endpoints) as well as passive measures (netflow, packet capture appliances) to both anticipate and better defend their organisation’s weaknesses.”

90 percent were targeted by ransomware, while 8 percent experienced destructive attacks beyond ransomware

Kellerman says the overwhelming majority of CISOs experiencing ransomware attacks is undoubtedly a concerning statistic, but what is even more concerning is that one in ten encountered destructive attacks unrelated to ransomware, a trend that Carbon Black expects to continue as hackers become more punitive.

“From application attacks to fileless malware, destructive attacks enable cybercriminals to move freely and laterally within an organisation’s network and often go completely overlooked until it’s too late,” says Kellerman.

44 percent were concerned with the security posture of their technology service provider (TSP)

“TSPs are regularly targeted by cybercriminals, who have been slow to adopt ‘intrusion suppression’ technologies and thus have become the weak links in the financial sectors information supply chain,” says Kellerman.

“Biggest weaknesses include visibility and time to detection, resulting in cybercriminals ‘island hopping’. To solve for these weaknesses, TSPs must shift to the cloud to enable delivery of faster, more accurate protection.”

8 percent are seeing secondary command and control (C2)

According to Kellerman, breach detection systems are being overcome as attackers develop new methods to not only penetrate a system’s defences, but also to dwell a lot longer in an organisation’s environment through C2.

“This new stage in the cyber kill chain – what we call the ‘maintenance stage’ – gives no reason for attackers to ever leave once they infiltrate an organisation’s system,” says Kellerman.

“Cyber defence is evolving into a high-stakes game of digital chess, and this latest report offers clear evidence that the cybersecurity challenges facing financial institutions will only worsen. Taking a more proactive approach to defence through the establishment of a threat hunting and incident response team is imperative to stopping future attacks.”

Container survey shows adoption accelerating while security concerns remain top of mind
The report features insights from over 500 IT professionals.
Google 'will do better' after G Suite passwords exposed since 2005
Fourteen years is a long time for sensitive information like usernames and passwords to be sitting ducks, unencrypted and at risk of theft and corruption.
Hackbusters! Reviewing 90 days of cybersecurity incident response cases
While there are occasionally very advanced new threats, these are massively outnumbered by common-or-garden email fraud, ransomware attacks and well-worn old exploits.
SEGA turns to Palo Alto Networks for cybersecurity protection
When one of the world’s largest video game pioneers wanted to strengthen its IT defences against cyber threats, it started with firewalls and real-time threat intelligence from Palo Alto Networks.
Forrester names Trend Micro Leader in email security
TrendMicro earned the highest score for technology leadership, deployment options and cloud integration.
LogRhythm releases cloud-based SIEM solution
LogRhythm Cloud provides the same feature set and user experience as its on-prem experience.
One Identity named Leader in PAM and IAM by KuppingerCole
KuppingerCole lead analyst Anmol Singh evaluated the strengths and weaknesses of 20 solution providers in the PAM market for the report.
Healthcare environments difficult to secure - Forescout
The convergence of IT, Internet of Things (IoT) and operational technology (OT) makes it more difficult for the healthcare industry to manage a wide array of hard-to-control network security risks.