Published by Gbaf News
Posted on November 15, 2016
Keiron Shepherd, Senior Security Specialist, F5 Networks
The recent DDoS attack of web hosting company OVH using hacked devices provides yet another example of the escalating security threats faced by businesses. The hackers created a botnet of 150,000 IoT devices to deliver a 1 Terabit DDoS attack, thought to be the largest of its kind – eclipsing the previous record set only a week before when a 620Gbs attack took down journalist Brian Krebs’ website.
It is clear that the range of security threats are growing both in size and sophistication, and the chance of businesses being hit by an attack is ever more likely. With financial services right at the top of most hackers hit-lists, we’ve laid out the top 5 trends we think FS firms need to be aware of in the coming months to ensure they are adequately prepared:
IoT-led DDoS attacks
IoT devices are on the rise, but the security measures to protect them are not. Vulnerabilities in the wave of smart, connected devices flooding the market makes them easy targets for cyber criminals, who are beginning to utilise more and more ‘dumb’ devices, such as CCTV cameras. The OVH example mentioned above will provide a blueprint for other copycat hackers – who in a couple of clicks can harness the power of IoT devices and cause havoc via massive DDoS hacks, capable of bringing down company websites and operations. FS organisations must by wary of IoT devices, which, although heralded as the future, ultimately provide another vector for cyber criminals to leverage. Businesses need to ensure that they have a DDoS mitigation strategy in place and clear plan, should they be targeted.
Impending GDPR
The GDPR doesn’t come into effect until May 2018, but considering it will take most FS organisations years to prepare for, it should be on every firm’s agenda. With stricter penalties, such as a potential fine of 4% global annual revenue, businesses need to get their IT infrastructure in order fast. Elements within the GDPR around data privacy – such as the right to be forgotten and data portability – might cause problems. This is because, for many organisations, the extent of customer data they actually hold is unknown – both in terms of quantity and location. The biggest challenge companies face is trying to understand just how much data they are responsible for. Getting caught out by a breach in the future, or data demands from customers, could inflict major damage on the bottom line and harm customer loyalty.
Cloud comfortability
As a business enabler, FS organisations are becoming increasingly more comfortable with moving their infrastructure into the cloud. Yet many security concerns remain – are companies aware of how to operate securely in the cloud, or who even holds the key to their information, considering it no longer resides on premise or in the data centre? Technology is emerging to help organisations securely manage their transition to the cloud. For instance, Cloud Access Security Broker (CASB) solutions apply enterprise security policies across multiple cloud services, giving IT teams control over who can access cloud services, while ensuring company data is sufficiently encrypted.
App security
FS firms with a heavy reliance on apps (i.e. most businesses) need to shift their focus more towards the end user and the protection of credentials. The rise of the mobile worker has resulted in employees using a plethora of apps to access corporate assets from a range of devices and locations. Any weak point in this network, such as a mobile phone infected with malware, can give cybercriminals the key to the kingdom. If a cybercriminal is able to gain an employee’s domain credentials, they can ultimately access to all company information. By switching focus and resources to app-level security and user awareness, rather than solely to more old fashioned firewall approaches, organisations can better secure themselves.
Access Management/IDAM
The rise of the cloud has led to an ecosystem of third party services for FS businesses to utilise. Employees can access different online portals from sales, to financial services to holiday allowance, all with the same single sign on authentication. If an employee was to leave a company, there are concerns that they may still gain access to vital information through their credentials if they are not removed in time. Companies therefore need to invest in a Federated Services technology that can provide a single sign on approach where the authentication point resides with the employer and redirects employees back to the cloud service, seamlessly granting access to the application. By putting themselves in charge of their employees’ credentials, corporations can regain their position as gatekeeper and better protect against fraud.
Failure to recognise or keep on top of developing issues such as those above can stop a business in its tracks. Years of best practice and hard earned customer loyalty can be shredded by a few clicks of a hacker’s mouse. By identifying threats early, investing in the right cyber security infrastructure and educating users about the cyber security landscape, FS businesses can keep ahead of the hackers and improve the likelihood of 2017 being a successful year.
Keiron Shepherd, Senior Security Specialist, F5 Networks
The recent DDoS attack of web hosting company OVH using hacked devices provides yet another example of the escalating security threats faced by businesses. The hackers created a botnet of 150,000 IoT devices to deliver a 1 Terabit DDoS attack, thought to be the largest of its kind – eclipsing the previous record set only a week before when a 620Gbs attack took down journalist Brian Krebs’ website.
It is clear that the range of security threats are growing both in size and sophistication, and the chance of businesses being hit by an attack is ever more likely. With financial services right at the top of most hackers hit-lists, we’ve laid out the top 5 trends we think FS firms need to be aware of in the coming months to ensure they are adequately prepared:
IoT-led DDoS attacks
IoT devices are on the rise, but the security measures to protect them are not. Vulnerabilities in the wave of smart, connected devices flooding the market makes them easy targets for cyber criminals, who are beginning to utilise more and more ‘dumb’ devices, such as CCTV cameras. The OVH example mentioned above will provide a blueprint for other copycat hackers – who in a couple of clicks can harness the power of IoT devices and cause havoc via massive DDoS hacks, capable of bringing down company websites and operations. FS organisations must by wary of IoT devices, which, although heralded as the future, ultimately provide another vector for cyber criminals to leverage. Businesses need to ensure that they have a DDoS mitigation strategy in place and clear plan, should they be targeted.
Impending GDPR
The GDPR doesn’t come into effect until May 2018, but considering it will take most FS organisations years to prepare for, it should be on every firm’s agenda. With stricter penalties, such as a potential fine of 4% global annual revenue, businesses need to get their IT infrastructure in order fast. Elements within the GDPR around data privacy – such as the right to be forgotten and data portability – might cause problems. This is because, for many organisations, the extent of customer data they actually hold is unknown – both in terms of quantity and location. The biggest challenge companies face is trying to understand just how much data they are responsible for. Getting caught out by a breach in the future, or data demands from customers, could inflict major damage on the bottom line and harm customer loyalty.
Cloud comfortability
As a business enabler, FS organisations are becoming increasingly more comfortable with moving their infrastructure into the cloud. Yet many security concerns remain – are companies aware of how to operate securely in the cloud, or who even holds the key to their information, considering it no longer resides on premise or in the data centre? Technology is emerging to help organisations securely manage their transition to the cloud. For instance, Cloud Access Security Broker (CASB) solutions apply enterprise security policies across multiple cloud services, giving IT teams control over who can access cloud services, while ensuring company data is sufficiently encrypted.
App security
FS firms with a heavy reliance on apps (i.e. most businesses) need to shift their focus more towards the end user and the protection of credentials. The rise of the mobile worker has resulted in employees using a plethora of apps to access corporate assets from a range of devices and locations. Any weak point in this network, such as a mobile phone infected with malware, can give cybercriminals the key to the kingdom. If a cybercriminal is able to gain an employee’s domain credentials, they can ultimately access to all company information. By switching focus and resources to app-level security and user awareness, rather than solely to more old fashioned firewall approaches, organisations can better secure themselves.
Access Management/IDAM
The rise of the cloud has led to an ecosystem of third party services for FS businesses to utilise. Employees can access different online portals from sales, to financial services to holiday allowance, all with the same single sign on authentication. If an employee was to leave a company, there are concerns that they may still gain access to vital information through their credentials if they are not removed in time. Companies therefore need to invest in a Federated Services technology that can provide a single sign on approach where the authentication point resides with the employer and redirects employees back to the cloud service, seamlessly granting access to the application. By putting themselves in charge of their employees’ credentials, corporations can regain their position as gatekeeper and better protect against fraud.
Failure to recognise or keep on top of developing issues such as those above can stop a business in its tracks. Years of best practice and hard earned customer loyalty can be shredded by a few clicks of a hacker’s mouse. By identifying threats early, investing in the right cyber security infrastructure and educating users about the cyber security landscape, FS businesses can keep ahead of the hackers and improve the likelihood of 2017 being a successful year.
Explore more articles in the Technology category
