Attacks On Financial Services Just Keep Going Up

Cyber attacks being carried out on across an increasing range of ectivities -political campaigns, cities and towns, hospitals and consistently on financial institutions.  What is most interesting about these incidents is two-fold: 

First that organisations are still leveraging traditional or outdated cybersecurity approaches in an era where cyber-attacks have become so incredibly complex. Second how people, organisations and governments respond and aren’t properly learning from them. 

The former can be addressed much more quickly than we all think, but the latter unfortunately seems to be lagging behind.

Don’t blame the Cloud
Several organisations in the financial world have made the transition to the cloud in some way shape or form. And when you hear about high-profile breaches in the industry there are very legitimate and valid reasons to be concerned about taking this step if you’re a key decision-maker. 

But this hasn’t stopped financial institutions from using public cloud due to increased reliability, scalability, and yes, even enhanced cybersecurity.  Many companies now find it easier to meet cybersecurity needs and adhere to compliance than in their own data centers, i.e. a private cloud environment, so while a lot of the attention is on “using the public cloud” as the culprit, it is much more complex than that.

We need Zero Trust
The real issue here is that no organisation, company, business, or government is ever truly safe or able to prevent a breach, the problem lies with somewhat dated approach and mentality. We need to adopt an 'assume breach' mentality, which essentially takes our traditional understanding of cybersecurity and flips it on its head: you must assume that you will be breached, because it’s a when, not an if. When you start from a worst-case scenario and work your way back, you’re better suited to address it when it does eventually happen. 

The bottom line is that you can’t rely on status quo cybersecurity measures within your network. Firewalls are no longer a viable answer to defense, especially in the cloud, as perimeter-based networks operate on the assumption that all systems and users in a network can be trusted. 

This is what the industry refers to as Zero Trust, it’s a concept that’s centered on the belief that nothing inside or outside of your network perimeters should, or can, be trusted. While you may not always be able to stop an attacker from getting in, you must make it incredibly hard for them to move around once they do. 

Decoupling Security Segmentation from the Network
Software-defined networking (SDN) has been all the rage these days and while it does solve a lot of network problems, unfortunately security is not one of them. SDN has limitations in that it is tethered to the infrastructure and is designed for reliable packet delivery, not for enforcing the security of what should and should not be allowed between two points on the network. 

Data and applications need to be secured where they live and in order to do that, security needs to be decoupled from the network and access must move from implicit allow to default deny. 

By decoupling enforcement from the actual network infrastructure, fine-grained policy is achieved within the compute without requiring access to anything except the workload itself, something that is available across all cloud providers.  Because the decoupling approach is completely agnostic to where an organisation runs its applications, bare metal servers, virtual machines, or containers in an on-premise data center or in any public cloud, this presents one micro-segmentation solution that works for all active applications regardless of where they are running. 

Learn from the Past and move Quickly
If organisations continue to focus on outdated cybersecurity methods, approaches, and policies, these types of attacks will undoubtedly happen again.Wwith cyber-attacks on the financial industry happening 300 times more frequently than other industries, Zero Trust is the only way forward. 

Cyber Defense Magazine:               Image: Nick Youngson

You Might Also Read:

The Financial Services Industry Just Does Not Get It:

 

 

 

« Airlines Think Biometrics Will Improve Passengers' Experience
US Releases Malware Linked To N. Korean Hacking Group »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

CSIRT.CZ

CSIRT.CZ

CSIRT.CZ is the National Computer Security Incident Response Team of the Czech Republic.

Qualitest Group

Qualitest Group

Qualitest is the world’s largest pure play Quality Assurance and software testing company.

Praetorian

Praetorian

Praetorian is an offensive cybersecurity company whose mission is to prevent breaches before they occur.

Siscon

Siscon

Siscon delivers tailor-made compliance solutions that are based on the customer's specific wishes and reality and then supplement with many years of experience in the field.

Cybersecurity Professionals

Cybersecurity Professionals

Search vacancies from top cyber security jobs worldwide on CyberSecurity Professionals. View IT security jobs or upload your CV to be seen by recruiters from industry leading firms.

EOL IT Services

EOL IT Services

EOL IT Services is the UK’s most accredited provider of IT Asset Disposal (ITAD), Lifecycle Services and Data Destruction.

Gigacycle

Gigacycle

Gigacycle is one of the leading IT disposal and recycling providers in the UK. We specialise in IT asset disposal (ITAD) and data destruction.

Tech Nation

Tech Nation

Tech Nation is the UK’s first national scaleup programme for the cyber security sector, aimed at ambitious tech companies ready for growth, at home and abroad.

Redwall Technologies

Redwall Technologies

Redwall provides cybersecurity expertise and technology to prevent and respond to emerging threats against mobile applications and connected infrastructures.

Nucleon Security

Nucleon Security

Nucleon Endpoint Detection and Response EDR is the most effective way to protect the value created by your organization against any threat.

TestArmy

TestArmy

TestArmy CyberForces provide you with a broad spectrum of cybersecurity services to test every aspect of your IT infrastructure security and software development process.

SandboxAQ

SandboxAQ

SandboxAQ is an enterprise SaaS company combining AI + Quantum tech to solve hard problems impacting society.

Astrix Security

Astrix Security

Astrix enables security teams to instantly see through the fog of connects and detect redundant, misconfigured and malicious third-party exposure to their critical systems.

Gutsy

Gutsy

Gutsy uses process mining to help organizations visualize and analyze their complex security processes to understand how they actually run, based on observable event data.

Health Sector Cybersecurity Coordination Center (HC3)

Health Sector Cybersecurity Coordination Center (HC3)

HC3 was created by the US Department of Health and Human Services to aid in the protection of vital, controlled, healthcare-related information.

Infosec Ventures

Infosec Ventures

Infosec Ventures incubates and scales cyber security innovators that solve inefficiencies in cyber security.