Risk
11/9/2010
11:45 PM
50%
50%

Taking Cybersecurity Lessons To The Bank

Lessons learned from frequent attacks make banks good role models in defending against bad guys

Banks are under attack -- not so much from gun-toting bank robbers, but from sophisticated cybercriminals.

Using programs such as Zeus to compromise customers' PCs and siphon money from their bank accounts, cybercriminals stole or attempted to steal nearly $100 million in the first three quarters of 2009, according to the Internet Crime Complaint Center. Traditional bank robbers on average stole $4,029, and all the U.S. bank robberies in 2009 totalled about $35 million, according to the FBI's Uniform Crime Reporting (UCR) project.

"Criminals are out there right now harming both the commercial account holders and financial institutions," Sari Stern Greene, president of Sage Data Security, told attendees last week at the Cybercrime Symposium 2010 in Portsmouth, N.H. "And every time this happens, it harms the whole community."

Banks have the money, so they are today's targets. But they aren't the only ones. Zeus and other malicious programs can easily be used to provide access to corporate PCs in other industries as well. For that reason, security managers should look to what's working -- and what's not working -- for the banking industry, say security experts.

Even the most educated customer may not have a defense against a targeted Zeus attack. For that reason, James Woodhill, founder of Authentify and a cybercrime policy expert, argues that education is not the answer.

In his presentation, Woodhill pointed out that it took a noncontroversial medical practice -- the use of penicillin -- nearly 30 years to spread out to general medical practitioners. Innovative defenses against cybercrime could take just as long, he says.

"Education won't help a bit -- not at this scale," Woodhill says. "It takes a long time to get information through to a large group of people."

But being aware of the problem can at least help consumers know their options, argues Sage's Greene. "The challenge is how to inform customers without scaring them away," she says.

Any company that allows users to access corporate data from laptops or home computers is importing risk, says Gary Warner, director of research in computer forensics at the University of Alabama at Birmingham.

"Work from home equals risk at home," Warner says. "If one of your employees has Zeus on their computer and they work from home, then so do their friends in the Ukraine."

Companies should have quarantine zones for home computers and laptops that have left the company premises until their security can be verified, Warner advises.

In the online world, attributing attacks is difficult, which makes online theft an attractive crime.

In the physical world, bank robberies are a low-percentage crime. They account for only about 2 percent of all robberies -- and arrests are made in 60 percent of the cases, according to the FBI's Uniform Crime Reporting (UCR) program. In the virtual world, criminals conduct attacks from safe havens where laws are vague or law enforcement agencies don't often pursue online criminals.

To prosecute cybercriminals, there must be attribution, experts say. But many companies want to clean up the crime scene -- their computers -- and sweep the incidents under a virtual rug. Companies should stop hiding these incidents and pursue investigations of attacks that use Zeus and other malware, experts say.

"If you go in and delete malware off a computer, you don't know why they got the malware, you don't know where the malware came from, you don't know what it might have stolen while it was there, you don't know what data left your company because of the infection, and you don't know if the user understands how he got infected so he won't go do it again," UAB's Warner says.

The current attacks on banks also show the limitations of both application whitelisting and intrusion detection that depends on blacklists, such as antivirus tools, observers say. Blacklisting cannot keep up with the changing threat, and whitelists are too hard to maintain in general-use computing environments, says James Lyne, a senior technologist for Sophos.

"Any one control fails to deal with the threat," Lyne says.

Rather than make binary decisions, organizations should use blacklists and whitelists -- plus reputation and other information -- to help decide whether to allow access to a user, Lyne says. In addition, companies and banks need to use policies and controls to make security a foundation of their corporate culture, he says.

Banks are good at building process controls that help protect them against fraud, says Rick Simonds, CTO of Sage Data Security. "You need controls," he says. "You have a lot of controls on bank employees, and that helps them with security."

But while some banks have a lot of controls to detect fraud committed by insiders, they don't always monitor outside transactions in as much detail, Lyne says. A good defense should account for both the external threat and the internal threat.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3407
Published: 2014-11-27
The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.3(.2) and earlier does not properly allocate memory blocks during HTTP packet handling, which allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCuq68888.

CVE-2014-4829
Published: 2014-11-27
Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allows remote attackers to hijack the authentication of arbitrary users for requests tha...

CVE-2014-4831
Published: 2014-11-27
IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allow remote attackers to hijack sessions via unspecified vectors.

CVE-2014-4832
Published: 2014-11-27
IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allow remote attackers to obtain sensitive cookie information by sniffing the network during an HTTP session.

CVE-2014-4883
Published: 2014-11-27
resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and source ports of DNS query packets, which makes it easier for man-in-the-middle attackers to conduct cache-poisoning attacks via spoofed reply packets.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?