Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

10/2/2018
06:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
0%
100%

Financial Sector Data Breaches Soar Despite Heavy Security Spending

Banks and other financial firms have disclosed three times as many breaches so far this year than they did in 2016, Bitglass says.

The preparedness of banks to deal with threats, such as a recently reported plan by criminals to launch mass attacks on ATM machines worldwide, would appear to be shaky at best considering the number of data breaches in the financial sector this year.

Security vendor Bitglass recently analyzed data breaches disclosed by banks, insurance companies, investment firms, and other financial services institutions thus far in 2018 and compared it with the same data from two years ago.

Between January and August this year, financial firms disclosed three times as many breaches as they did in the same period in 2016—103 in 2018 compared to 37 two years ago. The top three breaches alone this year compromised more records than the 64,512 records exposed in all of 2016, Bitglass said.

Hacking and malware were once again the primary causes like they were in 2016, and accounted for 74% of the data breaches that financial companies have disclosed so far this year. Nearly 15% of the breaches resulted from accidental data disclosures. 

Among the financial institutes that have disclosed breaches this year is RBC Royal Bank, Goldman Sachs, Fidelity Investments, Sallie Mae, and Dun & Bradstreet. The biggest incident involved an employee at SunTrust Banks who stole the names, addresses, phone numbers, and account balances of some 1.5 million of the banks' customers. In another instance, attackers managed to gain access to the Royal Bank of Canada's travel rewards website and steal payment card data belonging to some 66,000 individuals.

The breach numbers suggest that while financial services companies spend more on cybersecurity than most other organizations — and are more heavily regulated than others — the sector as a whole doesn't appear to becoming a whole lot more secure over time.

One of the reasons, of course, is that cybercriminals target banks and financial institutions more heavily than organizations in most other industries (with the exception of government and healthcare). Banks and other financial firms have significantly better defenses against malicious activities, but precisely for that reason they also tend to be targets of much more sophisticated threats.

Just one example of the constant and rapidly evolving threats that banks face is a new global campaign that cybercriminals are reportedly preparing to conduct large-scale theft from ATMs worldwide. The FBI has supposedly warned banks to be on the lookout for the attacks in coming months.

Another reason is that financial services institutions, like organizations in other sectors, have a tendency to over-rely on the tools they already have in place, says Jacob Serpa, product marketing manager at Bitglass. Companies often tend to stick with their existing tools because they have invested significant funds in them, and because they overestimate the ability of the products to deal with current and emerging threats, he says.

Regulations such as the Gramm-Leach-Bliley Act and PCI DSS have been useful in getting financial companies to pay more attention to security, but many continue to treat compliance with these regulations as the end goal of their security efforts.

"Companies should consider compliance with regulations like GLBA and PCI DSS as the bare minimum for cybersecurity, while understanding that much more needs to be done to be truly secure," Serpa says.

Not Just About the Money

Market research firm IDC expects that enterprises worldwide will spend north of $91 billion on cybersecurity this year. Banks, the federal government, and discrete manufacturers will be the biggest spenders, with more than $27 billion in spending.

While such spending might indicate banks are getting better at security, that is not always the case. Deloitte's cyber risk service practice earlier this year surveyed CISOs from 51 organizations in the financial services sector including banks, insurance companies, and investment management firms about their cyber risk management strategies.

Deloitte's study showed that the amount of money an organization spends on cybersecurity doesn't automatically translate to better security. Deloitte found that many financial companies with below average security spending had a better risk posture than companies that spent a lot more. Factors that did affect security were top-level accountability, a culture that emphasized shared responsibility for security, and a risk-focused approach to mitigating security threats.

At the same time, Deloitte also found that larger financial companies are not allocating enough resources to cybersecurity, with budgets ranging between 5% and 20% of the total IT budget, and the average hovering around 12%.

Related Content:

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Can Your Patching Strategy Keep Up with the Demands of Open Source?
Tim Mackey, Principal Security Strategist, CyRC, at Synopsys,  6/18/2019
Florida Town Pays $600K to Ransomware Operators
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12928
PUBLISHED: 2019-06-24
The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server.
CVE-2019-12929
PUBLISHED: 2019-06-24
The QMP guest_exec command in QEMU 4.0.0 and earlier is prone to OS command injection, which allows the attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server.
CVE-2019-12936
PUBLISHED: 2019-06-23
BlueStacks App Player 2, 3, and 4 before 4.90 allows DNS Rebinding for attacks on exposed IPC functions.
CVE-2019-12937
PUBLISHED: 2019-06-23
apps/gsudo.c in gsudo in ToaruOS through 1.10.9 has a buffer overflow allowing local privilege escalation to the root user via the DISPLAY environment variable.
CVE-2019-12935
PUBLISHED: 2019-06-23
Shopware before 5.5.8 has XSS via the Query String to the backend/Login or backend/Login/load/ URI.