Cyberattacks on financial services institutions are becoming increasingly sophisticated and frequent, but where should IT teams start in better defending their networks? BRIAN FORSTER, senior director of Marketing at Fortinet shares his advice.
Cyberattacks on financial services institutions are becoming increasingly sophisticated and frequent. By using stolen legitimate credentials and malware to disguise criminal activity, these breaches can remain undetected for some time, making the financial impact irreparable.
Professionals in the financial services sector are well aware of such risks. The Financial Services Edition of the 2016 Vormetric Data Threat Report surveyed 1,100 senior IT security executives at large enterprises around the world, including over 100 U.S. financial services organisations. The report found that 90 percent of respondents feel vulnerable to data threats, and 44 percent have already experienced a data breach – with nearly one in five (19 percent) indicating they had experienced a breach in the last year. This just goes to prove the sentiment, “it’s not if you will get hacked, but when”. To which we can add, “and how quickly you learn about it”.
So, where should financial services IT teams start in better defending their networks? From sports fields to battlefields, there’s an adage that has been used for centuries that states: “the best defence is a good offence”. The idea behind this theory is that having a proactive offensive attitude (rather than a reactive defensive posture) is the best way to keep the opposition occupied and limit their ability to conduct an attack.
This strategy can also be highly effective in the business world, specifically for cybersecurity teams at large financial institutions. Cybersecurity professionals who are able to step away from the defensive side of security and think like a cybercriminal will likely be better prepared to put solutions and strategies in place to protect their data.
Here are some questions financial services IT professionals should ask themselves to put them in the frame of mind of a cybercriminal in order to better their defence:
Which industries should I attack?
Before an attack is launched, cybercriminals will evaluate the landscape and identify areas where they can prosper the most. The financial services industry is consistently at or near the top of cybercriminals’ lists because, quite literally, it’s where the money is.
However, aside from seeking out customer information to commit fraud, cybercriminals see value in stealing data like bank employee e-mail addresses and passwords. With this information they are able to pose as an employee to infiltrate the bank and commit theft. By understanding the industries that are commonly attacked, and the ways attackers try to get in, cybersecurity teams will be better prepared to put an effective strategy in place and make the investments where necessary to match the capabilities used by criminals.
Where are the vulnerabilities?
As the network expands, so does the attack surface. With the proliferation of mobile devices in the workplace, for instance employees working from remote locations, today’s cybercriminals have more opportunities than ever before to find ways into targeted networks. Additionally, when financial institutions acquire a company to expand their presence, they typically acquire the disparate technology that comes with it, often adding complexity to the organisation’s security posture. All of these components equate to challenges that need to be addressed.
However, nobody knows the network and its vulnerabilities better than those who have put it together in the first place.
IT security professionals in financial services should look for openings in their own defence via white hat hacking and penetration testing. Since there isn’t a single piece of technology that will be able to stop every threat, those cracks in the system that are both easy access points and lead to sensitive data should be the ones focused on first. Remember, cybercriminals are just human beings looking for the fastest and most financially rewarding way to do their jobs.
It’s also important to remember that employees are a part of the system as well. An employee who is uneducated about security can be just as dangerous to data as any other digital or physical entry point. One way to test for employee vulnerabilities is to simply conduct test attacks. Many CIOs will send out fake phishing attacks to see if their employees will provide login credentials or click on malicious links. If a high number of employees fail the test, security teams know it is an area that demands added focus.
Cybercriminals are always looking for new ways to penetrate networks. IT security teams should be doing the same as well. By conducting threat intelligence research, cybersecurity teams will be able to better monitor existing vulnerabilities and identify new threats before they take hold within the network.
Best practices for better security
Once IT teams begin to like cybercriminals they are better prepared to pro-actively and offensively implement robust strategies to defeat attempts at compromising their networks:
- Identify weaknesses: How do you address cloud and IoT vulnerabilities? Have your employees been trained in safe e-mail management and other everyday security issues? Utilise penetration-testing services to find out where your greatest liabilities are and start there.
- Focus on compliance, data privacy and regulations: The financial services industry is so heavily regulated specifically because of the high value of its data and dollars and the vulnerability of its customers and clients. Violations can be expensive and destroy credibility. Conduct regular, and even automated audits to ensure that all regulations are being met, and if not, find solutions to quickly shore up these weak points.
- Meet with the C-suite: The role of the C-suite with regards to security has transformed. Cybersecurity threats put a company’s finances and value at risk, and increase the need for mature strategies to safeguard a company’s data, resources, reputation, and brand. As a strategic business and risk management executive, the C-suite should have significant oversight and guidance in these areas. They can no longer be IT-only considerations.
- Implement an end-to-end security strategy that provides:
- Operational visibility at scale; an effective solution should provide the ability to run multiple security applications without degrading performance.
- The ability to integrate an adaptive architecture that’s designed to incorporate multiple security vendors’ products to enable security against threats from IoT to the perimeter, across the network, and into the data centre – both on premises and in the cloud.
- Advanced threat protection, which provides up-to-date defences against the latest attacks. Many of the recent data breaches have fooled or evaded legacy security solutions.
- Unified threat intelligence and management. In this way, all components – networks and other elements of the infrastructure – can be easily managed from one place.
For the financial services sector, cybersecurity is one of the primary business imperatives that firms must put front and centre to not only safeguard their clients’ financial data, but to also serve as a business enabler and drive innovation to stay ahead of the growing threat landscape.
Financial services IT teams that think like cybercriminals will be able to take an offensive approach to security. Understanding what makes the organisation an attractive target and how malicious actors will attempt to gain entry, will lead to a more secure network and reduce the number of costly data breaches that impact the organisation. Implementing these best practices will enable secure services that deliver the peace of mind that their networks are secure and protected from even the most sophisticated attacks.
Opera launches built-in VPN on Android browser
Opera has released a new version of its mobile browser, which features a built-in virtual private network service.
Opera has released a new version of its mobile browser, Opera for Android 51, which features a built-in VPN (virtual private network) service.
A VPN allows users to create a secure connection to a public network, and is particularly useful if users are unsure of the security levels of the public networks that they use often.
The new VPN in Opera for Android 51 is free, unlimited and easy to use. When enabled, it gives users greater control of their online privacy and improves online security, especially when connecting to public Wi-Fi hotspots such as coffee shops, airports and hotels. The VPN will encrypt Internet traffic into and out of their mobile devices, which reduces the risk of malicious third parties collecting sensitive information.
“There are already more than 650 million people using VPN services globally. With Opera, any Android user can now enjoy a free and no-log service that enhances online privacy and improves security,” said Peter Wallman, SVP Opera Browser for Android.
When users enable the VPN included in Opera for Android 51, they create a private and encrypted connection between their mobile device and a remote VPN server, using strong 256-bit encryption algorithms. When enabled, the VPN hides the user’s physical location, making it difficult to track their activities on the internet.
The browser VPN service is also a no-log service, which means that the VPN servers do not log and retain any activity data, all to protect users privacy.
“Users are exposed to so many security risks when they connect to public Wi-Fi hotspots without a VPN,” said Wallman. “Enabling Opera VPN means that users makes it difficult for third parties to steal information, and users can avoid being tracked. Users no longer need to question if or how they can protect their personal information in these situations.”
According to a report by the Global World Index in 2018, the use of VPNs on mobile devices is rising. More than 42 percent of VPN users on mobile devices use VPN on a daily basis, and 35 percent of VPN users on computers use VPN daily.
The report also shows that South African VPN users said that their main reason for using a VPN service is to remain anonymous while they are online.
“Young people in particular are concerned about their online privacy as they increasingly live their lives online,” said Wallman. “Opera for Android 51 makes it easy to benefit from the security and anonymity of VPN , especially for those may not be aware of how to set these up.”
Setting up the Opera VPN is simple. Users just tap on the browser settings, go to VPN and enable the feature according to their preference. They can also select the region of their choice.
The built-in VPN is free, which means that users don’t need to download additional apps on their smartphones or pay additional fees as they would for other private VPN services. With no sign-in process, users don’t need to log in every time they want to use it.
Opera for Android is available for download in Google Play. The rollout of the new version of Opera for Android 51 will be done gradually per region.
Future of the car is here
Three new cars, with vastly different price-tags, reveal the arrival of the future of wheels, writes ARTHUR GOLDSTUCK
Just a few months ago, it was easy to argue that the car of the future was still a long way off, at least in South Africa. But a series of recent car launches have brought the high-tech vehicle to the fore in startling ways.
The Jaguar i-Pace electric vehicle (EV), BMW 330i and the Datsun Go have little in common, aside from representing an almost complete spectrum of car prices on the local market. Their tags start, respectively, at R1.7-million, R650 000 and R150 000.
Such a widely disparate trio of vehicles do not exactly come together to point to the future. Rather, they represent different futures for different segments of the market. But they also reveal what we can expect to become standard in most vehicles produced in the 2020s.
The i-Pace may be out of reach of most South Africans, but it ushers in two advances that will resonate throughout the EV market as it welcomes new and more affordable cars. It is the first electric vehicle in South Africa to beat the bugbear of range anxiety.
Unlike the pioneering “old” Nissan Leaf, which had a range of up to about 150km, and did not lend itself to long distance travel, the i-Pace has a 470km range, bringing it within shouting distance of fuel-powered vehicles. A trip from Johannesburg to Durban, for example, would need just one recharge along the way.
And that brings in the other major advance: the i-Pace is the first EV launched in South Africa together with a rapid public charging network on major routes. It also comes with a home charging kit, which means the end of filling up at petrol stations.
The Jaguar i-Pace dispels one further myth about EVs: that they don’t have much power under the hood. A test drive around Gauteng revealed not only a gutsy engine, but acceleration on a par with anything in its class, and enough horsepower to enhance the safety of almost any overtaking situation.
Specs for the Jaguar i-Pace include:
- All-wheel drive
- Twin motors with a combined 294kW and 696Nm
- 0-100km/h in 4.8s
- 90kWh Lithium-ion battery, delivering up to 470km range
- Eight-year/160 000km battery warranty
- Two-year/34 000km service intervals
Click here to read about BMW’s self-driving technology, and how Datsun makes smart technology affordable.