Attacks On Financial Services Just Keep Going Up

Cyber attacks being carried out on across an increasing range of ectivities -political campaigns, cities and towns, hospitals and consistently on financial institutions.  What is most interesting about these incidents is two-fold: 

First that organisations are still leveraging traditional or outdated cybersecurity approaches in an era where cyber-attacks have become so incredibly complex. Second how people, organisations and governments respond and aren’t properly learning from them. 

The former can be addressed much more quickly than we all think, but the latter unfortunately seems to be lagging behind.

Don’t blame the Cloud
Several organisations in the financial world have made the transition to the cloud in some way shape or form. And when you hear about high-profile breaches in the industry there are very legitimate and valid reasons to be concerned about taking this step if you’re a key decision-maker. 

But this hasn’t stopped financial institutions from using public cloud due to increased reliability, scalability, and yes, even enhanced cybersecurity.  Many companies now find it easier to meet cybersecurity needs and adhere to compliance than in their own data centers, i.e. a private cloud environment, so while a lot of the attention is on “using the public cloud” as the culprit, it is much more complex than that.

We need Zero Trust
The real issue here is that no organisation, company, business, or government is ever truly safe or able to prevent a breach, the problem lies with somewhat dated approach and mentality. We need to adopt an 'assume breach' mentality, which essentially takes our traditional understanding of cybersecurity and flips it on its head: you must assume that you will be breached, because it’s a when, not an if. When you start from a worst-case scenario and work your way back, you’re better suited to address it when it does eventually happen. 

The bottom line is that you can’t rely on status quo cybersecurity measures within your network. Firewalls are no longer a viable answer to defense, especially in the cloud, as perimeter-based networks operate on the assumption that all systems and users in a network can be trusted. 

This is what the industry refers to as Zero Trust, it’s a concept that’s centered on the belief that nothing inside or outside of your network perimeters should, or can, be trusted. While you may not always be able to stop an attacker from getting in, you must make it incredibly hard for them to move around once they do. 

Decoupling Security Segmentation from the Network
Software-defined networking (SDN) has been all the rage these days and while it does solve a lot of network problems, unfortunately security is not one of them. SDN has limitations in that it is tethered to the infrastructure and is designed for reliable packet delivery, not for enforcing the security of what should and should not be allowed between two points on the network. 

Data and applications need to be secured where they live and in order to do that, security needs to be decoupled from the network and access must move from implicit allow to default deny. 

By decoupling enforcement from the actual network infrastructure, fine-grained policy is achieved within the compute without requiring access to anything except the workload itself, something that is available across all cloud providers.  Because the decoupling approach is completely agnostic to where an organisation runs its applications, bare metal servers, virtual machines, or containers in an on-premise data center or in any public cloud, this presents one micro-segmentation solution that works for all active applications regardless of where they are running. 

Learn from the Past and move Quickly
If organisations continue to focus on outdated cybersecurity methods, approaches, and policies, these types of attacks will undoubtedly happen again.Wwith cyber-attacks on the financial industry happening 300 times more frequently than other industries, Zero Trust is the only way forward. 

Cyber Defense Magazine:               Image: Nick Youngson

You Might Also Read:

The Financial Services Industry Just Does Not Get It:

 

 

 

« Airlines Think Biometrics Will Improve Passengers' Experience
US Releases Malware Linked To N. Korean Hacking Group »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Wizard Computing

Wizard Computing

Wizard Computer Services is a full service IT solutions provider that offers managed services, consultation, installation, and support to small and large businesses in New England.

Coalfire

Coalfire

Coalfire specialises in cyber risk management and compliance. Our services span the cybersecurity lifecycle from advisory and compliance, to testing and engineering, monitoring and optimization.

NATO Communications and Information Agency (NCIA)

NATO Communications and Information Agency (NCIA)

The NCIA Cyber Security Service Line is responsible for planning and executing all life cycle management activities for cyber security.

NNIT

NNIT

NNIT​ is one of Denmark’s leading consultancies in IT development, implementation and operations, including cyber security.

Malomatia

Malomatia

Malomatia is a leading provider of technology services and solutions in Qatar including information security.

Waratek

Waratek

Waratek is a pioneer in the next generation of application security solutions known as Runtime Application Self-Protection or RASP.

Sopher Networks

Sopher Networks

Sopher is a secure communication and collaboration platform for business and personal use.

Forum of Incident Response & Security Teams (FIRST)

Forum of Incident Response & Security Teams (FIRST)

FIRST is the global Forum of Incident Response and Security Teams.

ARCON

ARCON

ARCON offers a proprietary unified governance framework, which addresses risk across various technology platforms.

DataExpert Singapore

DataExpert Singapore

DataExpert Singapore provide solutions and services in the areas of Digital Forensics, Data Recovery, Data Duplication, Data Degaussing & Wiping, Data Destruction, and IT Disposal.

CyberSafe

CyberSafe

CyberSafe is a Portuguese company with a focus on cybersecurity solutions and services including network security, managed security, incident response and forensic analysis.

Tactic Labs

Tactic Labs

Tactic Labs (part of the Avnon Group) delivers a holistic Cyber-Security Management Platform which provides military-grade protection, safeguarding critical infrastructures and mission-critical data.

Matrium Technologies

Matrium Technologies

Matrium Technologies has been a leading provider of technology solutions since 1991, with a strong industry background in Network Testing, Network Visibility and Security.

LGMS - LE Global Services

LGMS - LE Global Services

LGMS is a leading cyber security penetration testing and assessment firm in the Asia Pacific region.

VC3

VC3

VC3 provides a full range of Information Technology Solutions and Services to hundreds of municipalities and organizations throughout the USA.

European Data Protection Supervisor (EDPS)

European Data Protection Supervisor (EDPS)

The EDPS is the European Union’s independent data protection authority. We monitor and ensure the protection of personal data and privacy when EU institutions and bodies process personal information.