TalkTalk's Cybersecurity Lesson

Last October broadband provider TalkTalk was hacked for the third time in the space of just a year. The company, which has around four million customers in the UK, was initially unable to confirm whether the stolen customer data was encrypted or not, fuelling public outrage and landing them with a total bill of £35 million as a result.

This attack is not an isolated incident. It followed a long line of similar attacks that have recently affected companies as varied as Target, Sony, Carphone Warehouse and Ashley Madison. So what can financial services companies learn from these attacks? Where should companies invest in stronger security and what should they be doing to protect their customers' data?

There is no doubt the tactics of cyber-criminals are becoming increasingly intelligent and complex. A vast range of bespoke criminal software, specifically designed to help hackers exploit weaknesses in cyber-security, is available for purchase by bitcoins on the dark web in an untraceable marketplace. This black market for exploitative software has become a billion dollar industry. According to the Federal Reserve Bank of San Francisco, unique strains of malware such as that sold on the dark web reached 100 million variants in 2012, and this number is growing at an accelerated pace.

When or if they ever get to the bottom of the TalkTalk attack, it would not be surprising to find that the malware code they used was procured from this dark web.

Aside from the threat of hackers obtaining malware on the dark web, there are still gaps and vulnerabilities in companies' software systems that must be closed. At present, the easiest way to break into someone's bank account – for example – is to get their valid user ID and password. Social engineering bypasses the traditional cyber-security of user IDs and passwords – the hacker just steals valid credentials and they're in. The consumer needs to be educated in the various scams criminals use to obtain these credentials. The confidence scams are clever and effective and make traditional cyber-security mechanisms useless.

Perhaps nowhere else is data security more paramount than in the financial services industry, and FS providers need to up their game to address threats in real-time. Currently, the FS industry has invested heavily in securing the ‘perimeter fence' of security. There is very little attention paid to securing the business applications themselves.
 
It should be obvious by now that relying on perimeter security to prevent data breaches is a seriously flawed strategy. Organisations now need to look past the point of entry for hacking threats, criminals will always find a way in. Just as with building security where systems include alarm systems and sensors both at the point of entry as well as within the building, banks also need to focus on cyber-security within the banking application itself.

Companies need to monitor user behaviour for inconsistencies, deploying software sensors at critical points in the applications to detect valid users who are not using the system as expected.  Such a system learns patterns of behaviour that are normal for users, and can detect hackers who must probe the system to find weaknesses thus exposing their presence because the hacker's behaviour is not what a normal user would do.  By knowing what the cyber-criminal does when they break in, companies can monitor for this type of activity and sound an alarm when it happens.
 
Tackling the threat posed by cyber-criminals is also on the government's agenda. It was recently announced that the UK government will be increasing it’s spend on cyber-security to £1.9 billion to protect the country from potentially devastating hacks on a national scale by terrorists – and increased governmental spend on cyber-security is likely to impact positively on the threat posed to UK consumers. In addition, the new EU Data Protection Regulations will have a two-year transition period for all systems in the EU to become compliant before enforcement starts.  
 
The new compliance requirements will include the stipulation that data security becomes an overriding priority, with safeguards having to be built-in to products and services from the earliest stages of development. The pan-European regulations will enforce, among other things, that if the regulations are broken, fines of four percent of global revenue or €100 million can be levied.
 
The next few years will see a major increase in cyber-defence spending across both public and private sectors, and companies must invest wisely to successfully protect their customers and their reputations.

SC Magazine:

 

 

« Self-Driving Car Poses High Hacking Risk
EU Protects Online Data Quite Differently From The US »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

BruCON

BruCON

Brucon is Belgiums premium security and hacking conference.

NCC Group

NCC Group

NCC Group is a global cyber and software resilience business operating across multiple sectors, geographies and technologies.

Gate 15

Gate 15

Gate 15 provide risk management services focusing primarily on information, intelligence and threat analysis, operational support and preparedness.

Secure Recruitment

Secure Recruitment

Secure Recruitment is a specialist Executive Search business that focuses its efforts on attracting specific exceptional talent in Cyber Security.

Sky Republic

Sky Republic

Sky Republic offers a Smart Contract Platform to integrate and synchronize business networks beyond EDI and API.

Center for Education & Research in Information Assurance & Security (CERIAS)

Center for Education & Research in Information Assurance & Security (CERIAS)

CERIAS is one of the world’s leading centers for research and education in areas of information and cyber security.

Diateam

Diateam

Diateam is an R&D company specializing in computer security. Diateam develops highly innovative cyber range platforms and Industry-leading systems for cybersecurity training and testing labs.

SkyePoint Decisions

SkyePoint Decisions

SkyePoint Decisions is a leading Cybersecurity Architecture and Engineering, Critical Infrastructure and Operations, and Applications Development and Maintenance IT service provider.

Internet Crime Complaint Center (IC3)

Internet Crime Complaint Center (IC3)

The Internet Crime Complaint Center provide the public with a reporting mechanism to submit information to the FBI concerning suspected Internet-facilitated criminal activity.

ACSG Corp

ACSG Corp

ACSG Corp is a Critical Infrastructure Protection Company with a multi-disciplinary focus on building analytics software for various industry sectors.

CrowdSec

CrowdSec

CrowdSec is an open-source & participative IPS able to analyze visitor behavior by parsing logs & provide an adapted response to all kinds of attacks.

Wing Security

Wing Security

Wing fosters a stronger security culture by engaging SaaS end-users and enabling easy communication with security teams.

Goldilock

Goldilock

Goldilock is redefining how sensitive data, devices, networks and critical infrastructure can be secured.

NetCentrics

NetCentrics

NetCentrics leverages an innovative, agile, ‘what’s-next’ approach to our customers’ IT and cyber challenges.

UBDS Digital

UBDS Digital

UBDS Digital is your Digital Lifecycle Partner for Secure Cloud Transformation.

Anagram

Anagram

Anagram is the world’s first human-driven security awareness training platform that delivers real results.