Report discloses cyber stealth attacks in financial services sector
Announcement posted by PR Deadlines 07 Jun 2018
By Tom Kellermann, Carbon Black
Despite investing heavily in security, financial institutions continue to experience cyber attacks at a rapid pace.
Conducted primarily for the purpose of yielding illicit financial gain, cyber attacks against the financial services industry are increasing in sophistication and are often undetectable, global and instantaneous.
This was one of the themes of the recent FS-ISAC Annual Summit, in Boca Raton, Florida.
To better understand how cyber criminals remain undetected in their attacks against the financial services industry, Carbon Black recently collected responses from CISOs at 40 major financial institutions, including six of the top 10 global banks.
In the report, ‘Modern bank heists: Cyberattacks and lateral movement in the financial sector’, survey respondents revealed trends in lateral movement, counter incident response, integrity attacks and the most concerning threat actors financial institutions are currently facing.
The following information outlines key findings.
23 percent of respondents experienced counter incident response.
Cyber attacks have moved from burglary to home invasion over the past few years, and cyber criminals, aware that there are humans on the other end devised to detect and respond to their activities, are increasingly reacting and adapting to defenders’ response efforts.
This trend will continue unless organisations establish specific threat hunting teams. These threat hunters should employ both active measures (agents deployed to endpoints) as well as passive measures (netflow, packet capture appliances) to both anticipate and better defend their organisation’s weaknesses.
8 percent of respondents experienced destructive attacks beyond ransomware - and 90 percent reported being targeted by ransomware
An overwhelming majority (90 percent) of CISOs responding to the survey reported experiencing some kind of attempted ransomware attack during the past year. However, what’s more concerning is that 1 in 10 respondents reported encountering destructive attacks unrelated to ransomware, and we believe these types of attacks will only increase in size as more hackers become punitive.
From application attacks to fileless malware, destructive attacks enable cybercriminals to move freely and laterally within an organization’s network and often go completely overlooked until it’s too late.
44 percent of respondents were concerned with the security posture of their technology service provider (TSP).
TSPs are regularly targeted by cyber criminals, who have been slow to adopt ‘intrusion suppression’ technologies and thus have become the weak links in the financial sectors information supply chain. Biggest weaknesses include visibility and time to detection, resulting in cybercriminals ‘island hopping’. To solve for these weaknesses, TSPs must shift to the cloud to enable delivery of faster, more accurate protection.
8 percent of respondents are seeing secondary command and control (C2).
Breach detection systems are being defeated as attackers continues to develop new methods to not only penetrate system defences, but dwell a lot longer in an organisation’s environment through C2. This new stage in the cyber kill chain – what we call the ‘maintenance stage’ – give no reason for attackers to ever leave once they infiltrate an organisation’s system.
Cyber defence is evolving into a high-stakes game of digital chess, and this latest report offers clear evidence that the cybersecurity challenges facing financial institutions will only worsen. Taking a more proactive approach to defence through the establishment of a threat hunting and incident response team is imperative to stopping future attacks.
The full report offers several more interesting statistics and recommendations for protecting your organisation. Of note, non-malware attacks continue to make waves, with “good-use” tools leveraged for nefarious purposes.
Contact
Marie Evans, Carbon Black.
marie.evans@carbonblack.com
61 (0) 412 044 072
Conducted primarily for the purpose of yielding illicit financial gain, cyber attacks against the financial services industry are increasing in sophistication and are often undetectable, global and instantaneous.
This was one of the themes of the recent FS-ISAC Annual Summit, in Boca Raton, Florida.
To better understand how cyber criminals remain undetected in their attacks against the financial services industry, Carbon Black recently collected responses from CISOs at 40 major financial institutions, including six of the top 10 global banks.
In the report, ‘Modern bank heists: Cyberattacks and lateral movement in the financial sector’, survey respondents revealed trends in lateral movement, counter incident response, integrity attacks and the most concerning threat actors financial institutions are currently facing.
The following information outlines key findings.
23 percent of respondents experienced counter incident response.
Cyber attacks have moved from burglary to home invasion over the past few years, and cyber criminals, aware that there are humans on the other end devised to detect and respond to their activities, are increasingly reacting and adapting to defenders’ response efforts.
This trend will continue unless organisations establish specific threat hunting teams. These threat hunters should employ both active measures (agents deployed to endpoints) as well as passive measures (netflow, packet capture appliances) to both anticipate and better defend their organisation’s weaknesses.
8 percent of respondents experienced destructive attacks beyond ransomware - and 90 percent reported being targeted by ransomware
An overwhelming majority (90 percent) of CISOs responding to the survey reported experiencing some kind of attempted ransomware attack during the past year. However, what’s more concerning is that 1 in 10 respondents reported encountering destructive attacks unrelated to ransomware, and we believe these types of attacks will only increase in size as more hackers become punitive.
From application attacks to fileless malware, destructive attacks enable cybercriminals to move freely and laterally within an organization’s network and often go completely overlooked until it’s too late.
44 percent of respondents were concerned with the security posture of their technology service provider (TSP).
TSPs are regularly targeted by cyber criminals, who have been slow to adopt ‘intrusion suppression’ technologies and thus have become the weak links in the financial sectors information supply chain. Biggest weaknesses include visibility and time to detection, resulting in cybercriminals ‘island hopping’. To solve for these weaknesses, TSPs must shift to the cloud to enable delivery of faster, more accurate protection.
8 percent of respondents are seeing secondary command and control (C2).
Breach detection systems are being defeated as attackers continues to develop new methods to not only penetrate system defences, but dwell a lot longer in an organisation’s environment through C2. This new stage in the cyber kill chain – what we call the ‘maintenance stage’ – give no reason for attackers to ever leave once they infiltrate an organisation’s system.
Cyber defence is evolving into a high-stakes game of digital chess, and this latest report offers clear evidence that the cybersecurity challenges facing financial institutions will only worsen. Taking a more proactive approach to defence through the establishment of a threat hunting and incident response team is imperative to stopping future attacks.
The full report offers several more interesting statistics and recommendations for protecting your organisation. Of note, non-malware attacks continue to make waves, with “good-use” tools leveraged for nefarious purposes.
Contact
Marie Evans, Carbon Black.
marie.evans@carbonblack.com
61 (0) 412 044 072