Welcome!

Related Topics: @CloudExpo, Cloud Security

@CloudExpo: Blog Post

Financial Institutions Are Vulnerable to Cyber Attacks | @CloudExpo #Cloud #Cybersecurity

The introduction of nascent technologies to improve financial access is also accompanied by increased vulnerability

Financial Institutions are Vulnerable to Cyber Attack as the Increase in Technologies Improves

It is impossible to go outside and not notice banks offering consumers new ways to save, send, spend, and access their money at a bank. This trend-to ease access to funds – extends well beyond the retail banking sector and is equally prevalent among investment banks, private banks, hedge funds, mutual funds, ETFs and just about any financial institution, large or small. It is arguably the single most compelling commercial driver in the financial services sector. Financial institutions compete aggressively and continuously for dominance in this regard and technology is, in all cases, the single most important differentiator across institution, customer, and geography.

Unfortunately the introduction of nascent technologies to improve financial access is also accompanied by increased vulnerability to the very currency and associated details at the heart of the financial services industry. This is the cost of an increasingly open marketplace for financial services and a dynamic that is only further complicated by the growing array of devices and techniques customized for each device to engage in financial transactions. Fortunately there are technologies and strategies available that can be embedded within the security infrastructure of financial institutions to defensively and prospectively detect and eliminate threats, which vary in scope and nature.

General Scope of Threat
Financial institutions are ripe for cyber attacks because of the breadth of personal and business data embedded within their networks as well as financial information. An approximately 35-40% increase in cyber crime targeting the financial sector was recorded in 2015 and a staggering record 21 million fraud attacks and 45 million BOT attacks were detected in Q4 of 2015 alone. Q3 to Q4 BOT attacks increased tenfold and there is little reason to see this trend reversing course. The threat is neither one dimensional or lacking in sophistication – attacks are highly organized and are multi-channel in nature. BOTs and other complex attacks (e.g., malware) are structured to behave as authentic customers to circumvent traditional security defenses. The consequences and costs are severe: data loss and its wide-reaching proximate impact as well as direct financial losses that can easily reach billions of dollars for a single firm.

At Risk Sub-Sectors
The complex nature of financial institutions demands different technological approaches and structures for each sub-sector. This is also the inherent challenge in devising dynamic strategies to protect against cyber attacks across all vulnerability points of a firm or specific categories of firms. Mobile usage as well as online lending and alternative payment techniques are primary target areas with perceived weak security infrastructure. Part of this vulnerability comes from the speed of the transaction cycle, compared to traditional lending, but also due to the less traditional and smaller lenders that are enabled by online lending to issue loans and are less likely to have powerful security infrastructure on par with traditional lenders. Vulnerability from a single lender can create systemic vulnerabilities reaching beyond the lender itself. A weakness in a small lender can create a vulnerability that exposes a larger institution on the other side of the transaction.

Financial institutions involved in e-commerce are also soft targets for cyber attacks. Mobile transaction volume increased more than 200% between 2014 and 2015 and is estimated to maintain that growth trajectory as more mobile devices, with greater sophistication and applications tied to financial institutions, enter the e-commerce system. With multiple technologies and institutions collaborating to enable e-commerce, the complexion of any approach to cyber security must be multi-layered to enable businesses to detect and prevent various attacks such as malware, device spoofing, and mobile bot attacks.

Methods and Strategies
In an environment where the challenges are not static or one-dimensional, neither should the solution. Speed and comprehensiveness of a defense and response system is critical to effectiveness in minimizing risks and mitigating damages in the event of an attack. Unified risk assessment and threat prevention techniques must be core to a financial institution's cyber attack strategy. Financial institutions must recognize their central role in core financial services activity as well as e-commerce and mobile payment products. But how should financial institutions with disparate sizes, services, and, most importantly, balance sheets make decisions about cyber security? How can varied budget sizes be accounted for in maintaining consistently effective approaches to similar threats?

For large institutions the risks are too considerable and far-reaching to implement anything short of the most comprehensive systems available in the market. Speed, synchronization and uniformity should be paramount considerations and, fortunately, there are technologies available that accomplish these objectives while retaining a degree of malleability to adjust with evolving threats and risk points.

For smaller firms the solutions that are being implemented tend to be more patchwork (though even larger financial institutions have similar ‘band-aid' approaches). "Cyber-as-a-service" firms are increasingly common service providers for smaller and medium sized companies as well as concentrated on key risk areas through the utilization of dedicated computers for sensitive transactions, which can be monitored for unusual activity. These methods, while often effective defensively, lack the key elements of speed and comprehensiveness; they are reactionary in nature, but lack the embedded and dynamic technical characteristics to be prospective in their approach to risk.

In devising a cyber attack strategy financial institutions should be mindful of four dynamics:

  • The role that the interconnected nature of the financial services industry, regardless of firm size and scope of services offered, plays in widening the scope of vulnerabilities outside the immediate ambit of a firm
  • The value of an integrated and uniform solution to ensuring responsiveness across platforms and vulnerability points
  • The importance of speed in detection and responsiveness to preventing attacks and mitigating damages
  • The crucial role that comprehensive internal and external monitoring will play in anticipating unforeseen attacks that exploit vulnerabilities in newly introduced technologies

More Stories By Yuri Frayman

Yuri Frayman is the Chief Executive of ZENEDGE. He recently sold his last company to Google.

Latest Stories
SYS-CON Events announced today that Numerex Corp, a leading provider of managed enterprise solutions enabling the Internet of Things (IoT), will exhibit at the 19th International Cloud Expo | @ThingsExpo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Numerex Corp. (NASDAQ:NMRX) is a leading provider of managed enterprise solutions enabling the Internet of Things (IoT). The Company's solutions produce new revenue streams or create operating...
Almost two-thirds of companies either have or soon will have IoT as the backbone of their business in 2016. However, IoT is far more complex than most firms expected. How can you not get trapped in the pitfalls? In his session at @ThingsExpo, Tony Shan, a renowned visionary and thought leader, will introduce a holistic method of IoTification, which is the process of IoTifying the existing technology and business models to adopt and leverage IoT. He will drill down to the components in this fra...
I'm a lonely sensor. I spend all day telling the world how I'm feeling, but none of the other sensors seem to care. I want to be connected. I want to build relationships with other sensors to be more useful for my human. I want my human to understand that when my friends next door are too hot for a while, I'll soon be flaming. And when all my friends go outside without me, I may be left behind. Don't just log my data; use the relationship graph. In his session at @ThingsExpo, Ryan Boyd, Engi...
IoT is fundamentally transforming the auto industry, turning the vehicle into a hub for connected services, including safety, infotainment and usage-based insurance. Auto manufacturers – and businesses across all verticals – have built an entire ecosystem around the Connected Car, creating new customer touch points and revenue streams. In his session at @ThingsExpo, Macario Namie, Head of IoT Strategy at Cisco Jasper, will share real-world examples of how IoT transforms the car from a static p...
SYS-CON Events announced today that Pulzze Systems will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Pulzze Systems, Inc. provides infrastructure products for the Internet of Things to enable any connected device and system to carry out matched operations without programming. For more information, visit http://www.pulzzesystems.com.
If you’re responsible for an application that depends on the data or functionality of various IoT endpoints – either sensors or devices – your brand reputation depends on the security, reliability, and compliance of its many integrated parts. If your application fails to deliver the expected business results, your customers and partners won't care if that failure stems from the code you developed or from a component that you integrated. What can you do to ensure that the endpoints work as expect...
DevOps at Cloud Expo – being held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA – announces that its Call for Papers is open. Born out of proven success in agile development, cloud computing, and process automation, DevOps is a macro trend you cannot afford to miss. From showcase success stories from early adopters and web-scale businesses, DevOps is expanding to organizations of all sizes, including the world's largest enterprises – and delivering real results. Am...
The Internet of Things can drive efficiency for airlines and airports. In their session at @ThingsExpo, Shyam Varan Nath, Principal Architect with GE, and Sudip Majumder, senior director of development at Oracle, will discuss the technical details of the connected airline baggage and related social media solutions. These IoT applications will enhance travelers' journey experience and drive efficiency for the airlines and the airports. The session will include a working demo and a technical d...
SYS-CON Events announced today that Commvault, a global leader in enterprise data protection and information management, has been named “Bronze Sponsor” of SYS-CON's 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Commvault is a leading provider of data protection and information management solutions, helping companies worldwide activate their data to drive more value and business insight and to transform moder...
The Transparent Cloud-computing Consortium (abbreviation: T-Cloud Consortium) will conduct research activities into changes in the computing model as a result of collaboration between "device" and "cloud" and the creation of new value and markets through organic data processing High speed and high quality networks, and dramatic improvements in computer processing capabilities, have greatly changed the nature of applications and made the storing and processing of data on the network commonplace.
SYS-CON Events announced today that Bsquare has been named “Silver Sponsor” of SYS-CON's @ThingsExpo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. For more than two decades, Bsquare has helped its customers extract business value from a broad array of physical assets by making them intelligent, connecting them, and using the data they generate to optimize business processes.
Fact is, enterprises have significant legacy voice infrastructure that’s costly to replace with pure IP solutions. How can we bring this analog infrastructure into our shiny new cloud applications? There are proven methods to bind both legacy voice applications and traditional PSTN audio into cloud-based applications and services at a carrier scale. Some of the most successful implementations leverage WebRTC, WebSockets, SIP and other open source technologies. In his session at @ThingsExpo, Da...
SYS-CON Events announced today that Secure Channels will exhibit at the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. The bedrock of Secure Channels Technology is a uniquely modified and enhanced process based on superencipherment. Superencipherment is the process of encrypting an already encrypted message one or more times, either using the same or a different algorithm.
Traditional on-premises data centers have long been the domain of modern data platforms like Apache Hadoop, meaning companies who build their business on public cloud were challenged to run Big Data processing and analytics at scale. But recent advancements in Hadoop performance, security, and most importantly cloud-native integrations, are giving organizations the ability to truly gain value from all their data. In his session at 19th Cloud Expo, David Tishgart, Director of Product Marketing ...
The vision of a connected smart home is becoming reality with the application of integrated wireless technologies in devices and appliances. The use of standardized and TCP/IP networked wireless technologies in line-powered and battery operated sensors and controls has led to the adoption of radios in the 2.4GHz band, including Wi-Fi, BT/BLE and 802.15.4 applied ZigBee and Thread. This is driving the need for robust wireless coexistence for multiple radios to ensure throughput performance and th...