As the Financial Sector moves rapidly into 2014, several factors are impacting the segment, including the tsunami-like point of sale attacks. The direct correlation of the breach of half a billion records of personally identifiable information (PII) to the bottom line profit margin has not been lost on the Financial Sector. As financial services CEOs and board executives are asking their security leaders if this could happen to them, CISOs are performing their own risk assessments. There is nothing like a good high dollar breach to drive the verification of your risk posture, and garner support for strategic security projects.

The IBM X-Force Threat Intelligence Quarterly 1Q 2014 speaks to the 2013 breach of the ATMs that occurred in 24 countries over a 10 hour spree. This kind of global breadth within such a short attack window takes a well-planned and weaponized execution structure. Make no mistake that there were months of “under the radar testing” of the card leeching tactic prior to the peak season onset.   Newly announced forensics capabilities are much improved and can sniff out similar types of low level activities with visibility into real antagonist conversations. This is an area that financial institutions should have on their strategic roadmaps. Banking institutions should pay close attention as they drive new customer services utilizing an omni-channel approach, including the ATM channel.

IBM’s acquisition of Trusteer in 2013 adds significant value to the Financial Sector with its global base of security malware research. This research integrates well with the on-going internet security research performed by IBM X-Force Research and Development. Trusteer research added intelligence of over 30,000,000 user endpoints and hundreds of organizations to the already mighty X-Force acumen.  Once again Oracle Java was identified as a prime target attributed to its broad implementation across platforms and its ability to run without recompiling code. Trusteer’s in-depth expertise in financial malware confirms the high exploitation of Java.

As reported, financial markets continued to take the largest percentage of attacks along with computer services and governments.  This should be no surprise as the largest quadrant of threat motivators is still “opportunistic”, such as financial gain.  Unless we move to a system based on barter, Financial Sector organizations should understand they are a top target.

There is good news on the mobile application front.  As highly competitive financial institutions race to deploy new mobile apps for their customers, these applications are mostly UI’s for customers with the back office still vaulting down the key customer financial information.  Traditionally financial institutions have implemented deep layers of security in mainframe datacenters utilizing RACF, Z-Secure and other proven solutions.  However, organizations should remain laser focused on the threat of identification theft where there is still work to be done.

More from Banking & Finance

Kronos Malware Reemerges with Increased Functionality

The Evolution of Kronos Malware The Kronos malware is believed to have originated from the leaked source code of the Zeus malware, which was sold on the Russian underground in 2011. Kronos continued to evolve and a new variant of Kronos emerged in 2014 and was reportedly sold on the darknet for approximately $7,000. Kronos is typically used to download other malware and has historically been used by threat actors to deliver different types of malware to victims. After remaining…

Why Cybersecurity Risk Assessment Matters in the Banking Industry

When customers put money in a bank, they need to trust it will stay there. Because of the high stakes involved for the customer, such as financial loss, and how long it takes to resolve fraud and potential identity theft, customers are sensitive to the security of the bank as well as fraud prevention measures. Banks that experience high volumes of fraud are likely to lose customers and revenue. The key is to protect customers and their accounts before problems…

Cost of a Data Breach: Banking and Finance

The importance of cybersecurity has touched almost every industry. Beyond that, robust cybersecurity is table stakes for several sectors, particularly health care and the banking and finance industry. Not only is financial data at risk, but so is customer trust. In banking and finance, trust means everything. Yet, consumers are hesitant to share their confidential data. A recent McKinsey survey revealed that no industry achieved a trust rating of 50% for data protection. Here’s the most sobering stat: 87% of…

What Do Financial Institutions Need to Know About the SEC’s Proposed Cybersecurity Rules?

On March 9, the U.S. Securities and Exchange Commission (SEC) announced a new set of proposed rules for cybersecurity risk management, strategy and incident disclosure for public companies. One intent of the rule changes is to provide “consistent, comparable and decision-useful” information to investors. Not yet adopted, these new rules – published in the Federal Register on March 23 – could change reporting requirements. Take a look at some of the big-ticket items and what your organization needs to know.…