TalkTalk's Cybersecurity Lesson

Last October broadband provider TalkTalk was hacked for the third time in the space of just a year. The company, which has around four million customers in the UK, was initially unable to confirm whether the stolen customer data was encrypted or not, fuelling public outrage and landing them with a total bill of £35 million as a result.

This attack is not an isolated incident. It followed a long line of similar attacks that have recently affected companies as varied as Target, Sony, Carphone Warehouse and Ashley Madison. So what can financial services companies learn from these attacks? Where should companies invest in stronger security and what should they be doing to protect their customers' data?

There is no doubt the tactics of cyber-criminals are becoming increasingly intelligent and complex. A vast range of bespoke criminal software, specifically designed to help hackers exploit weaknesses in cyber-security, is available for purchase by bitcoins on the dark web in an untraceable marketplace. This black market for exploitative software has become a billion dollar industry. According to the Federal Reserve Bank of San Francisco, unique strains of malware such as that sold on the dark web reached 100 million variants in 2012, and this number is growing at an accelerated pace.

When or if they ever get to the bottom of the TalkTalk attack, it would not be surprising to find that the malware code they used was procured from this dark web.

Aside from the threat of hackers obtaining malware on the dark web, there are still gaps and vulnerabilities in companies' software systems that must be closed. At present, the easiest way to break into someone's bank account – for example – is to get their valid user ID and password. Social engineering bypasses the traditional cyber-security of user IDs and passwords – the hacker just steals valid credentials and they're in. The consumer needs to be educated in the various scams criminals use to obtain these credentials. The confidence scams are clever and effective and make traditional cyber-security mechanisms useless.

Perhaps nowhere else is data security more paramount than in the financial services industry, and FS providers need to up their game to address threats in real-time. Currently, the FS industry has invested heavily in securing the ‘perimeter fence' of security. There is very little attention paid to securing the business applications themselves.
 
It should be obvious by now that relying on perimeter security to prevent data breaches is a seriously flawed strategy. Organisations now need to look past the point of entry for hacking threats, criminals will always find a way in. Just as with building security where systems include alarm systems and sensors both at the point of entry as well as within the building, banks also need to focus on cyber-security within the banking application itself.

Companies need to monitor user behaviour for inconsistencies, deploying software sensors at critical points in the applications to detect valid users who are not using the system as expected.  Such a system learns patterns of behaviour that are normal for users, and can detect hackers who must probe the system to find weaknesses thus exposing their presence because the hacker's behaviour is not what a normal user would do.  By knowing what the cyber-criminal does when they break in, companies can monitor for this type of activity and sound an alarm when it happens.
 
Tackling the threat posed by cyber-criminals is also on the government's agenda. It was recently announced that the UK government will be increasing it’s spend on cyber-security to £1.9 billion to protect the country from potentially devastating hacks on a national scale by terrorists – and increased governmental spend on cyber-security is likely to impact positively on the threat posed to UK consumers. In addition, the new EU Data Protection Regulations will have a two-year transition period for all systems in the EU to become compliant before enforcement starts.  
 
The new compliance requirements will include the stipulation that data security becomes an overriding priority, with safeguards having to be built-in to products and services from the earliest stages of development. The pan-European regulations will enforce, among other things, that if the regulations are broken, fines of four percent of global revenue or €100 million can be levied.
 
The next few years will see a major increase in cyber-defence spending across both public and private sectors, and companies must invest wisely to successfully protect their customers and their reputations.

SC Magazine:

 

 

« Self-Driving Car Poses High Hacking Risk
EU Protects Online Data Quite Differently From The US »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Blue Frost Security

Blue Frost Security

Blue Frost Security provides high-level IT security consulting, penetration testing services, ISO 27001 Solutions, PCI compliance solutions and training.

Devo Technology

Devo Technology

Devo Security Operations is a next-gen cloud SIEM that enables you to gain complete visibility, reduce noise, and focus on the threats that matter most to the business.

Antiy Labs

Antiy Labs

Antiy Labs is a vender of antivirus engine and solution, providing the best-in-breed antivirus engine and next generation antivirus services for confronting PC malware and mobile malware.

Bl4ckswan

Bl4ckswan

Bl4ckswan is a Management Consulting firm specialized in the delivery of information security and compliance services.

Redbelt Security

Redbelt Security

Redbelt is a cyber security consultancy. We integrate people, systems, services and products to transform how your information security is delivered.

Blackpoint Cyber

Blackpoint Cyber

Blackpoint’s mission is to provide effective, affordable real-time threat detection and response to organizations of all sizes around the world.

SECFORCE

SECFORCE

SECFORCE is a leading information security consultancy specialising in bespoke penetration testing and red team engagements.

Datenschutz Schmidt

Datenschutz Schmidt

Datenschutz Schmidt is a service provider with many years of experience, we support you in complying with numerous data protection guidelines, requirements and laws.

Venari Security

Venari Security

Venari is an award-winning cybersecurity SaaS provider that has developed an ETA (Encrypted Traffic Analysis) platform which fundamentally changes the way encrypted traffic is analysed.

Pionen

Pionen

Pionen are a specialist information security consultancy with excellent people and proven security delivery methodologies at its core.

MicroAge

MicroAge

Powered by five decades of experience, lasting partnerships, client relationships, and the values that guide us daily, MicroAge is here to help you secure, accelerate, and transform your business.

Valeo Nertworks

Valeo Nertworks

Valeo Nertworks is a full-service Managed Security Service Provider (MSSP). We partner with organizations to remove the burden of technology so that they can focus on growing their business.

CentriVault

CentriVault

CentriVault is a leading independent provider of Cyber Security and Data protection services to small and medium enterprises (SMEs).

Sayers

Sayers

Sayers is best known for its ability to solve business challenges with IT solutions. Our areas of expertise include cloud, storage, virtualization, security, mobility and networking.

Security Discovery

Security Discovery

Stay ahead of cyber threats with Security Discovery. We offer expert consulting, comprehensive services, and a powerful vulnerability monitoring SaaS platform.

Dispel

Dispel

Dispel makes the fastest secure remote access for industrial networks. Built by operators for operators: a zero trust engine for your entire OT, IoT, and xIoT stack.