TalkTalk's Cybersecurity Lesson

Last October broadband provider TalkTalk was hacked for the third time in the space of just a year. The company, which has around four million customers in the UK, was initially unable to confirm whether the stolen customer data was encrypted or not, fuelling public outrage and landing them with a total bill of £35 million as a result.

This attack is not an isolated incident. It followed a long line of similar attacks that have recently affected companies as varied as Target, Sony, Carphone Warehouse and Ashley Madison. So what can financial services companies learn from these attacks? Where should companies invest in stronger security and what should they be doing to protect their customers' data?

There is no doubt the tactics of cyber-criminals are becoming increasingly intelligent and complex. A vast range of bespoke criminal software, specifically designed to help hackers exploit weaknesses in cyber-security, is available for purchase by bitcoins on the dark web in an untraceable marketplace. This black market for exploitative software has become a billion dollar industry. According to the Federal Reserve Bank of San Francisco, unique strains of malware such as that sold on the dark web reached 100 million variants in 2012, and this number is growing at an accelerated pace.

When or if they ever get to the bottom of the TalkTalk attack, it would not be surprising to find that the malware code they used was procured from this dark web.

Aside from the threat of hackers obtaining malware on the dark web, there are still gaps and vulnerabilities in companies' software systems that must be closed. At present, the easiest way to break into someone's bank account – for example – is to get their valid user ID and password. Social engineering bypasses the traditional cyber-security of user IDs and passwords – the hacker just steals valid credentials and they're in. The consumer needs to be educated in the various scams criminals use to obtain these credentials. The confidence scams are clever and effective and make traditional cyber-security mechanisms useless.

Perhaps nowhere else is data security more paramount than in the financial services industry, and FS providers need to up their game to address threats in real-time. Currently, the FS industry has invested heavily in securing the ‘perimeter fence' of security. There is very little attention paid to securing the business applications themselves.
 
It should be obvious by now that relying on perimeter security to prevent data breaches is a seriously flawed strategy. Organisations now need to look past the point of entry for hacking threats, criminals will always find a way in. Just as with building security where systems include alarm systems and sensors both at the point of entry as well as within the building, banks also need to focus on cyber-security within the banking application itself.

Companies need to monitor user behaviour for inconsistencies, deploying software sensors at critical points in the applications to detect valid users who are not using the system as expected.  Such a system learns patterns of behaviour that are normal for users, and can detect hackers who must probe the system to find weaknesses thus exposing their presence because the hacker's behaviour is not what a normal user would do.  By knowing what the cyber-criminal does when they break in, companies can monitor for this type of activity and sound an alarm when it happens.
 
Tackling the threat posed by cyber-criminals is also on the government's agenda. It was recently announced that the UK government will be increasing it’s spend on cyber-security to £1.9 billion to protect the country from potentially devastating hacks on a national scale by terrorists – and increased governmental spend on cyber-security is likely to impact positively on the threat posed to UK consumers. In addition, the new EU Data Protection Regulations will have a two-year transition period for all systems in the EU to become compliant before enforcement starts.  
 
The new compliance requirements will include the stipulation that data security becomes an overriding priority, with safeguards having to be built-in to products and services from the earliest stages of development. The pan-European regulations will enforce, among other things, that if the regulations are broken, fines of four percent of global revenue or €100 million can be levied.
 
The next few years will see a major increase in cyber-defence spending across both public and private sectors, and companies must invest wisely to successfully protect their customers and their reputations.

SC Magazine:

 

 

« Self-Driving Car Poses High Hacking Risk
EU Protects Online Data Quite Differently From The US »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Omerta IT

Omerta IT

Omerta IT help you protect your organisation by helping ensure you have the best IT Security professionals working for you.

Picasso

Picasso

The Picasso project is focused on ICT Policy, Research and Innovation for a Smart Society: towards new avenues in EU-US ICT collaboration.

DirectDefense

DirectDefense

DirectDefense is an information security services and managed services provider.

Center for Cyber Safety and Education

Center for Cyber Safety and Education

The Center for Cyber Safety and Education works to ensure that people across the globe have a positive and safe experience online through our educational programs, scholarships, and research.

Cybint Solutions

Cybint Solutions

Cybint provides customized cyber education and training solutions for Higher Education, Companies and Government.

Rippleshot

Rippleshot

Rippleshot is a fraud analytics firm that detects mass card compromises faster, allowing issuers to execute more proactive fraud detection strategies.

Consensys

Consensys

ConsenSys is a global blockchain company. We develop enterprise applications, invest in startups, build developer tools, and offer blockchain education.

VLATACOM Institute

VLATACOM Institute

Vlatacom Institute is privately owned accredited research and development institute, system integrator and turn-key solution provider. Areas of expertise include encryption and authentication.

FPT Software

FPT Software

As a leading technology service provider, FPT assists customers of all sizes and from any industries in implementing and adapting digital technologies including cybersecurity.

UST

UST

UST is a global provider of digital technology and transformation, IT services and solutions including managed security services.

Cyberfort Group

Cyberfort Group

Cyberfort exists to provide our clients with the peace-of-mind about the security of their data and the compliance of their business.

Cynomi

Cynomi

Cynomi is a leading strategic cybersecurity operations platform that automates cybersecurity knowledge and expertise to empower teams with little to no in-house expertise.

Kingston Technology

Kingston Technology

Kingston is a leading global manufacturer of memory and storage solutions including encrypted storage solutions to protect data inside and outside the firewall.

Finesse Global

Finesse Global

Finesse is a global system integration and digital business transformation company.

SecurEyes

SecurEyes

SecurEyes is a leading cybersecurity firm that provides specialised services, including cybersecurity assessments, managed services, and governance risk and compliance services.

Dexian

Dexian

Dexian is a leading provider of staffing, IT, and workforce solutions with nearly 12,000 employees and 70 locations worldwide.