As the Financial Sector moves rapidly into 2014, several factors are impacting the segment, including the tsunami-like point of sale attacks. The direct correlation of the breach of half a billion records of personally identifiable information (PII) to the bottom line profit margin has not been lost on the Financial Sector. As financial services CEOs and board executives are asking their security leaders if this could happen to them, CISOs are performing their own risk assessments. There is nothing like a good high dollar breach to drive the verification of your risk posture, and garner support for strategic security projects.

The IBM X-Force Threat Intelligence Quarterly 1Q 2014 speaks to the 2013 breach of the ATMs that occurred in 24 countries over a 10 hour spree. This kind of global breadth within such a short attack window takes a well-planned and weaponized execution structure. Make no mistake that there were months of “under the radar testing” of the card leeching tactic prior to the peak season onset.   Newly announced forensics capabilities are much improved and can sniff out similar types of low level activities with visibility into real antagonist conversations. This is an area that financial institutions should have on their strategic roadmaps. Banking institutions should pay close attention as they drive new customer services utilizing an omni-channel approach, including the ATM channel.

IBM’s acquisition of Trusteer in 2013 adds significant value to the Financial Sector with its global base of security malware research. This research integrates well with the on-going internet security research performed by IBM X-Force Research and Development. Trusteer research added intelligence of over 30,000,000 user endpoints and hundreds of organizations to the already mighty X-Force acumen.  Once again Oracle Java was identified as a prime target attributed to its broad implementation across platforms and its ability to run without recompiling code. Trusteer’s in-depth expertise in financial malware confirms the high exploitation of Java.

As reported, financial markets continued to take the largest percentage of attacks along with computer services and governments.  This should be no surprise as the largest quadrant of threat motivators is still “opportunistic”, such as financial gain.  Unless we move to a system based on barter, Financial Sector organizations should understand they are a top target.

There is good news on the mobile application front.  As highly competitive financial institutions race to deploy new mobile apps for their customers, these applications are mostly UI’s for customers with the back office still vaulting down the key customer financial information.  Traditionally financial institutions have implemented deep layers of security in mainframe datacenters utilizing RACF, Z-Secure and other proven solutions.  However, organizations should remain laser focused on the threat of identification theft where there is still work to be done.