SlideShare a Scribd company logo
Security trends in the
financial services sector
With money and data both at stake, 2016’s
leading attack target remains a magnet
for cybercrime
IBM X-Force®
Research
Click here to start ▶
2
◀ Previous Next ▶
Executive overview
The financial services sector has been a magnet for
cybercrime for over two decades now, and that was
certainly true again in 2016. As revealed in the 2017
IBM X-Force Threat Intelligence Index, the sector
was attacked more than any other industry, with
the average financial services client organization
monitored by IBM Security Services experiencing
65 percent more attacks than the average client
organization across all industries (see Figure 1).
Moreover, 2016 saw an average 29 percent increase
in attacks on financial services organizations—up
from 1,310 attacks in 20151
to 1,684 in 2016.
Amid these negative findings, there were however
some good tidings. The average financial services
client we monitored experienced 192 security
incidents in 20152
, but only 94 in 2016. A “security
incident” is our most serious classification, so this
is indeed welcome news.
Contents
Executive overview
1 • 2
A global view: publicly
disclosed financial incidents
Where are the “bad guys”?
Insiders versus outsiders
Prevalent methods of
attack in financial services
monitored clients
Recommendations
and mitigations
Protect your enterprise
while reducing cost
and complexity
About IBM Security
About the author
References
Across all
industries
54,681,413
Events
1,019
Attacks
93
Incidents
Financial
services
101,988,746
Events
1,684
Attacks
94
Incidents
Figure 1. Average client organization monitored by IBM Security Services, 2016 cross-industry versus financial services
comparison. (See sidebar “Definition of terms” for definitions of security event, attack and security incident.)
Definition of terms
Security event: Activity on a system or
network detected by a security device
or application.
Attack: A security event that has been
identified by correlation and analytics
tools as malicious activity that is
attempting to collect, disrupt, deny,
degrade or destroy information system
resources or the information itself.
Security incident: An attack or security
event that has been reviewed by IBM
security analysts and deemed worthy of
deeper investigation.
3
◀ Previous Next ▶
Unfortunately, the good news may end here.
IBM®
X-Force®
malware researchers investigating
cybercrime trends and financial malware
campaigns found that some countries experienced
a marked increase in financial cybercrime in 2016.
Cyber gangs continued to sharpen their focus
on business bank accounts, a trend that began
picking up speed in mid-2014, using malware such
as Dyre, Dridex, GozNym and TrickBot to target
business banking services.
2016 also saw a notable rise in publicly reported
Society for Worldwide Interbank Financial
Telecommunication (SWIFT) attacks against the
messaging system used by thousands of banks
and companies to move money around the world.3
The result was that millions of US dollars were
stolen and fraudulently transferred from various
global banks using custom malware to remove
traces of these transactions.
Combined with other analysis disclosed in
this report, these trends and incidents paint a
troublesome picture for the financial services sector.
Fortunately, financial services organizations can
strengthen their cybersecurity immune system with
a focus on mitigating notable security pain points
such as insider threats and financial malware.
Contents
Executive overview
1 • 2
A global view: publicly
disclosed financial incidents
Where are the “bad guys”?
Insiders versus outsiders
Prevalent methods of
attack in financial services
monitored clients
Recommendations
and mitigations
Protect your enterprise
while reducing cost
and complexity
About IBM Security
About the author
References
About this report
This IBM X-Force Research report was created by the
IBM Managed Security Services Threat Research group, a
team of experienced and skilled security analysts working
diligently to keep IBM clients informed and prepared for the
latest cybersecurity threats. This research team analyzes
security data from many internal and external sources,
including event data, activity and trends sourced from
endpoints managed and monitored by IBM.
4
◀ Previous Next ▶
A global view: publicly disclosed
financial incidents
IBM X-Force Interactive Security Incidents data is
a sampling of notable publicly disclosed incidents.4
Included are breaches, which are incidents
resulting in the exfiltration of data. As Figure 2
shows, there was no shortage of cyberattack-
induced financial ruin in 2016. Outages due to
distributed denial of service (DDoS) shut down
online financial institutions’ operations all over
the globe. Malware, including ransomware, was
responsible for millions in losses. One of the banks
targeted in the SWIFT attacks, had USD 81 million
stolen from their customers’ accounts.5
Attackers also turned to an old favorite from their
arsenal of phishing techniques, the Business Email
Compromise (BEC) scam, to trick unwitting victims
out of their money, an issue that hit the victim, but
also became an issue for the banks on either side
of a multi-million dollar fraud that’s hard to cover
by existing insurance. Aside from financial losses,
many compromises resulted in leaks of highly
sensitive financial data. In one bank compromise,
1.4GB of leaked data reportedly included internal
corporate files and customer financial data.6
With over 200 million records compromised in
2016—a 937 percent increase over the 2015 total of
just under 20 million—the financial services sector
ranked third among other industries in terms of
records breached. In terms of publicly disclosed
incidents tracked by IBM X-Force, recent year-over-
year totals have remained flat: 22 publicly disclosed
incidents in 2014, 21 in 2015, and 22 in 2016.
Contents
Executive overview
A global view: publicly
disclosed financial incidents
1 • 2
Where are the “bad guys”?
Insiders versus outsiders
Prevalent methods of
attack in financial services
monitored clients
Recommendations
and mitigations
Protect your enterprise
while reducing cost
and complexity
About IBM Security
About the author
References
5
◀ Previous Next ▶
Contents
Executive overview
A global view: publicly
disclosed financial incidents
1 • 2
Where are the “bad guys”?
Insiders versus outsiders
Prevalent methods of
attack in financial services
monitored clients
Recommendations
and mitigations
Protect your enterprise
while reducing cost
and complexity
About IBM Security
About the author
References
Belgium
BEC scam resulted in the
theft of 70 million euros in
fraudulent wire transfers8
Greece
Hactivists protesting global
corruption targeted banks
in Greece by disrupting
acceess for a full day
through DDoS attacks13
Cyprus
Hactivists shut down
a Cyprus bank website
as part of an ongoing
protest against banking
corruption14
Ukraine
Attackers exploiting the
international banking
system SWIFT stole USD
10 million from a bank15
Qatar
1.4 GB of data was leaked
from a Qatar bank including
intelligence reports on
people of interest12
Russia
High-volume DDoS attack
targeting several Russian
banks disrupted services
for several days16
Canada
Bitcoin exchange forced to
shut down operations after
constant DDoS attacks
over a three-year period11
UK
Over 9,000 customers had
money disappear from their
accounts, believed to be
the Retefe banking Trojan9
Bangladesh
USD 81 million stolen
through account takeover10
India
Several banks targeted
with LeChiffre
crypto-ransomware7
Figure 2. Notable 2016 publicly disclosed financial services security incidents. Source: IBM X-Force Interactive
Security Incidents data.
6
◀ Previous Next ▶
Where are the “bad guys”? Insiders
versus outsiders
Security executives and their teams deal with
numerous attacks every year. To prioritize defenses
and budgets they continually keep tabs on where
threats are coming from. Are they mostly external
attacks, or do insiders make up a large part of their
organization’s overall attack surface?
To discover whether an attack is coming from
inside or outside the organization, security
investigation teams first identify the source
and destination IPs as internal or external, then
further investigate the associated attack pattern
to determine malicious or inadvertent intent. IBM
Managed Security Services (MSS) 2016 data for
the financial services sector (see Figure 3) reveals
more insider than outsider attacks (58 percent to
42 percent) affected organizations, and within the
insider group, many more inadvertent actors (53
percent) were the culprits than malicious insiders
acting against the organization (5 percent).
Among the top five targeted industries—retail,
healthcare, manufacturing, financial services, and
information and communications—the 2017 IBM
X-Force Threat Intelligence Index reveals that in
2016 the financial services industry experienced
the highest level of threat from inadvertent actors.
It’s useful to think of an inadvertent actor as a
compromised system carrying out attacks without
the user being aware of it, as in the “Subvert
Access Control” attack type described in more
detail below. Often it happens when a desktop
client is compromised via malicious email
attachments, clickjacking or phishing, or vulnerable
computer services that have been attacked from
another internal networked system.
Contents
Executive overview
A global view: publicly
disclosed financial incidents
Where are the “bad guys”?
Insiders versus outsiders
Prevalent methods of
attack in financial services
monitored clients
Recommendations
and mitigations
Protect your enterprise
while reducing cost
and complexity
About IBM Security
About the author
References
Source of attacks against
financial services security clients
Outsiders 42%
Inadvertent
actors 53%
Malicious
insiders 5%
Insiders 58%
Figure 3. In 2016, insiders were responsible for more financial
services sector attacks than outsiders.
7
◀ Previous Next ▶
Prevalent methods of attack in
financial services monitored clients
To classify and better understand the types
of threats that affect financial entities, X-Force
has grouped 2016 observed attack types
according to the standard set by the MITRE
Corporation’s CAPEC™
(Common Attack Pattern
Enumeration and Classification) effort (see
Figure 4). As described by MITRE, their system
“organizes attack patterns hierarchically based
on mechanisms that are frequently employed in
exploiting a vulnerability.” The only exception is the
“Indicator” category, which describes conditions
and context of threats and attack patterns.
Contents
Executive overview
A global view: publicly
disclosed financial incidents
Where are the “bad guys”?
Insiders versus outsiders
Prevalent methods of
attack in financial services
monitored clients
1 • 2 • 3 • 4
Recommendations
and mitigations
Protect your enterprise
while reducing cost
and complexity
About IBM Security
About the author
References
Top attacks for monitored financial services security clients
Inject unexpected items
Subvert access control
Manipulate data structures
Collect and analyze information
Indicator
Abuse existing functionality
Manipulate system resources
Employ probabilistic techniques
Engage in deceptive interaction
51%
13%
13%
9%
6%
3%
3%
1%
<1%
Figure 4. Injection-type attacks were the clear leader in the financial services sector in 2016. Source: IBM Managed Security
Services data, January 1 – December 31, 2016.
8
◀ Previous Next ▶
Further details on each attack type appear in the
following sections.
Inject unexpected items
According to IBM MSS analysis of 2016 data, the
number one attack vector, involving the use of
malicious input data to attempt to control or disrupt
a system, targeted 51 percent of the financial
services clients monitored by IBM X-Force. That
figure was notably higher than the cross-industry
average of 42 percent.
Command injections, which include operating
system command injection (OS CMDi) and SQLi,
belong in this category. OS CMDi is also known
as “shell command injection,” after which the
now infamous and widely prevalent Shellshock
vulnerability is named. Shellshock activity, which
surged across all industries before its two-year
anniversary in September 2016, accounted for
just over a quarter of all attacks targeting financial
services organizations in 2016.
SQLi and OS CMDi are perhaps the most
popular attack vectors within this sector because
successful exploitation of these vulnerabilities
can provide attackers with the ability to read,
modify and destroy sensitive data. The personally
identifiable information (PII) in the databases of
financial institutions is highly valued by hackers
because they can sell it for a handsome profit
or hold it hostage, demanding that the financial
institution pay a ransom to get it back or prevent its
public disclosure.
Manipulate data structures
The number two attack vector involved attacks
in which the attacker attempted to gain
unauthorized access through the manipulation
of system data structures. As CAPEC™
states,
“Often, vulnerabilities [such as buffer overflow
vulnerabilities], and therefore exploitability of
these data structures, exist due to ambiguity
and assumption in their design and prescribed
handling.”17
The great majority of the attacks in this
category targeted buffer overflow vulnerabilities.
On a positive note, while the cross-industry client
average for attacks in this category is 32 percent,
the figure in the financial services sector, 13 percent,
is substantially lower. That might be because
attackers view this attack vector as less potentially
successful against financial services targets.
Contents
Executive overview
A global view: publicly
disclosed financial incidents
Where are the “bad guys”?
Insiders versus outsiders
Prevalent methods of
attack in financial services
monitored clients
1 • 2 • 3 • 4
Recommendations
and mitigations
Protect your enterprise
while reducing cost
and complexity
About IBM Security
About the author
References
9
◀ Previous Next ▶
Subvert access control
The number three attack vector, accounting for 13
percent of attacks—substantially higher than the
cross-industry average of three percent—involved
attacks attempting to subvert access control
through the “exploitation of weaknesses, limitations
and assumptions in the mechanisms a target
utilizes to manage identity and authentication.”18
Most of the attacks we observed in this category
involved the exploitation of vulnerabilities in the
target’s client-server communication channel for
authentication and data integrity by leveraging the
implicit trust a server places in what it believes to
be a valid client.
Man-in-the-middle (MITM) attacks, in which
attackers attempt to intercept and relay messages
between two parties (people or systems), falls
under this category. This technique could allow an
attacker to steal the information going back and
forth or insert malicious code into the connection.
Some mobile banking apps have been found to
mishandle the way they transmit data, making them
vulnerable to MITM attacks.19
Collect and analyze information
Attacks focused on the collection and theft
of information made up nearly nine percent
of attacks targeting client devices. Most of
these involved fingerprinting, often viewed
as a kind of reconnaissance that gathers
information on potential targets to discover their
existing weaknesses. Essentially, an attacker
compares output from a target system to known
“fingerprints” that uniquely identify specific details
about the target, such as the type or version of its
operating system or an application. Attackers can
use the information to identify known vulnerabilities
in the target organization’s IT infrastructure and
better prepare their tactical plans.
Indicator
Note that “Indicator” is not a CAPEC™
mechanism
of attack. A cyberthreat indicator consists of
certain observable conditions as well as contextual
information about the condition or pattern. These
events, which accounted for six percent of all
attacks, could indicate either an attempted or a
successful attack on the target system. A large
percentage of the attacks involved targeted
systems experiencing 100 or more external pings in
a short time, which might indicate a compromised
internal host. If compromised, a host could be
attacking other targets or communicating with other
compromised hosts until detected and stopped.
Contents
Executive overview
A global view: publicly
disclosed financial incidents
Where are the “bad guys”?
Insiders versus outsiders
Prevalent methods of
attack in financial services
monitored clients
1 • 2 • 3 • 4
Recommendations
and mitigations
Protect your enterprise
while reducing cost
and complexity
About IBM Security
About the author
References
10
◀ Previous Next ▶
Abuse existing functionality
Three percent of attacks involved attempts to
abuse or manipulate “one or more functions of an
application in order to achieve a malicious objective
not originally intended by the application, or to
deplete a resource to the point that the target’s
functionality is affected.”20
Successful attacks in
this category could allow the attacker to obtain
sensitive information or cause a denial of service,
as well as execute arbitrary code on the target.
Manipulate system resources
Attacks attempting to manipulate some aspect of
a system’s resource state or availability accounted
for three percent of all attacks. Resources include
files, applications, libraries and infrastructure, and
configuration information. Successful attacks in this
category could allow the attacker to cause a denial
of service, infect a machine to become a botnet
command-and-control (C&C) server, or execute
arbitrary code on the target.
Employ probabilistic techniques
One percent of attacks involved an attacker
using what CAPEC™ describes as “probabilistic
techniques to explore and overcome security
properties of the target.”21
Most of the activity
involved brute-force password attacks, a tactic
in which an intruder tries to guess a username
and password combination to gain unauthorized
access to a system or data. Most of the attacks
observed by X-Force targeted the Secure Shell
(SSH) service. Users favor SSH because it can
provide secure remote access. The downside is
that it can provide attackers with shell account
access across the network.
Engage in deceptive interaction
Less than one percent of attacks made attempts
to convince a victim to perform an action through
spoofing, such as in a clickjacking attack. In this
type of attack, the attacker attempts to hijack the
victim's click actions and possibly launch further
attacks against the victim.
Contents
Executive overview
A global view: publicly
disclosed financial incidents
Where are the “bad guys”?
Insiders versus outsiders
Prevalent methods of
attack in financial services
monitored clients
1 • 2 • 3 • 4
Recommendations
and mitigations
Protect your enterprise
while reducing cost
and complexity
About IBM Security
About the author
References
11
◀ Previous Next ▶
Recommendations and mitigations
Never neglect training and refreshing
employee awareness
Foster awareness regarding BEC scams and
other phishing scams through education. A variety
of approaches—video, webinars, in-person
instruction—can be used to educate employees.
Programs that simulate phishing attacks could
test employees at regular intervals. Encourage
employees to report suspicious emails for
further investigation.
Apply a cognitive approach to detecting
phishing sites
The financial services industry experienced
a relatively high percentage of attacks from
inadvertent actors or those that unwittingly
introduced threats to the target organization’s
environment. Falling victim to spear phishing is one
of the inadvertent actor’s biggest weaknesses.
They have the power to lure employees to either
download malware, opening the first door to the
attackers, or lead them to a fake website where
their corporate credentials will be stolen.
According to IBM X-Force data, 70 percent of
credentials are stolen in the first hour of a phishing
attack.22
In order to react to a phishing attack
quickly and accurately, machine learning and
cognitive computing need to be incorporated
to help boost the speed and scale of phishing
detection and protection. A cognitive engine
capable of helping detect relevant phishing attacks
as they emerge and then alerting customers about
it is now available in IBM Trusteer Rapport®
.
The new cognitive engine analyzes unstructured
data from suspicious websites, including links,
images, forms, text, scripts, DOM data and URLs.
It can accurately identify a wide variety of phishing
pages, including those that only present users with
an image to elude content analysis and those that
deliver dynamic content to the page to evade web
crawlers. By analyzing text, wording and logos
used on a site, it can further point out the targeted
brand(s) with accuracy and discern whether the
use of a logo is legitimate or suspicious.
Further reduce exposure to insider threats
Mitigating phishing attempts is key to reducing
the threat from inadvertent actors. However, to
further reduce exposure to insider threats, financial
services organizations must combine data security
and identity and access management solutions to
protect their sensitive data and govern the access
of all legitimate users.
Contents
Executive overview
A global view: publicly
disclosed financial incidents
Where are the “bad guys”?
Insiders versus outsiders
Prevalent methods of
attack in financial services
monitored clients
Recommendations
and mitigations
1 • 2
Protect your enterprise
while reducing cost
and complexity
About IBM Security
About the author
References
12
◀ Previous Next ▶
The more users have access to sensitive
information, the greater the chance that someone
will put it at risk, either maliciously or mistakenly.
Companies must ensure they are limiting access
to only those users who absolutely need it, and
that controls stay current as the user population
changes and evolves over time. Similarly, the more
easily accessed the information is, and the more
places it resides, the greater the chances that an
insider, or an outsider with stolen credentials, will
be able to gain access to it for the wrong reasons.
Solutions that include an identity manager and
account-provisioning component, such as IBM
Security Privileged Identity Manager, can help an
organization centrally manage and audit the use of
privileged IDs across different scenarios. Solutions
like IBM Security Guardium®
can help ensure that
sensitive data is appropriately protected.
Solutions such as IBM Surveillance Insight for
Financial Services that adopt a proactive approach
towards managing risk of non-compliant employee
behavior are essential. Solutions able to ingest
unstructured data—such as chat transcripts,
email communications and voice recordings—and
combine it with structured trade transaction data
create a more robust unified surveillance system.
Augment cyber security intelligence capabilities
Security intelligence, a must across all industry
sectors, is especially important in the financial
services sector. It’s critical that organizations
understand the attack vectors to which they are
most vulnerable. Having this knowledge can help
financial services companies stay one step ahead
of criminals and bolster internal and external
detection and protection mechanisms.
But how do security operations teams keep
pace with the myriad of threats and ever-growing
number of attacks targeting their organizations?
Keeping up with threat intelligence is a vital part of
risk awareness. With that, the speed of threat data
far exceeds human capability. Even the most skilled
security professionals can have difficulty sifting
through the sheer volume of security incidents
and available threat data. A solution that combines
cognitive capabilities and analytics, such as IBM
QRadar®
Advisor with Watson®
, augments a
security analyst's ability to identify and understand
sophisticated threats by tapping into unlimited
amounts of unstructured data from blogs, websites,
research papers and the like, and correlating it with
relevant security incidents.
Contents
Executive overview
A global view: publicly
disclosed financial incidents
Where are the “bad guys”?
Insiders versus outsiders
Prevalent methods of
attack in financial services
monitored clients
Recommendations
and mitigations
1 • 2
Protect your enterprise
while reducing cost
and complexity
About IBM Security
About the author
References
13
◀ Previous Next ▶
Protect your enterprise while
reducing cost and complexity
From infrastructure, data and application protection
to cloud and managed security services, IBM
Security Services has the expertise to help
safeguard your company’s critical assets. We
protect some of the most sophisticated networks
in the world and employ some of the best minds in
the business.
IBM offers services to help you optimize your
security program, stop advanced threats, protect
data and safeguard cloud and mobile. Security
Intelligence Operations and Consulting Services
can assess your security posture and maturity
against best practices in security. With IBM
X-Force Incident Response and Intelligence
Services, IBM experts proactively hunt and
respond to threats, and apply the latest threat
intelligence before breaches occur. With IBM
Managed Security Services, you can take
advantage of industry-leading tools, security
intelligence and expertise that can help you
improve your security posture—often at a fraction
of the cost of in-house security resources.
About IBM Security
IBM Security offers one of the most advanced
and integrated portfolios of enterprise security
products and services. The portfolio, supported
by world-renowned IBM X-Force research,
provides security intelligence to help organizations
holistically protect their people, infrastructures,
data and applications, offering solutions for identity
and access management, database security,
application development, risk management,
endpoint management, network security and more.
IBM operates one of the world’s broadest security
research, development and delivery organizations,
monitors billions of security events per day in more
than 130 countries, and holds more than 3,500
security patents.
Contents
Executive overview
A global view: publicly
disclosed financial incidents
Where are the “bad guys”?
Insiders versus outsiders
Prevalent methods of
attack in financial services
monitored clients
Recommendations
and mitigations
Protect your enterprise
while reducing cost
and complexity
About IBM Security
About the author
References
14
◀ Previous Next ▶
About the author
Michelle Alvarez, a Threat
Researcher and Editor for IBM
Managed Security Services,
brings more than 10 years of
industry experience to her
role. Michelle is responsible for researching and
analyzing security trends and developing and
editing security and threat mitigation thought
leadership papers. She joined IBM through the
Internet Security Services (ISS) acquisition in 2006.
At ISS she served as an analyst and contributed
to the development of the X-Force Database, one
of the world's most comprehensive threats and
vulnerabilities database. For many years, Michelle
played an important operational role within the
Information Technology-Information Sharing and
Analysis Center (IT-ISAC), a non-profit, limited
liability corporation formed by members within
the information technology sector. She is a regular
contributor to the IBM-sponsored security blog,
SecurityIntelligence.com, and has her master’s
degree in information technology.
For more information
To learn more about the IBM Security portfolio,
please contact your IBM representative or IBM
Business Partner, or visit:
ibm.com/security
For more information on security services, visit:
ibm.com/security/services
Follow @IBMSecurity on Twitter or visit the IBM
Security Intelligence blog
Contents
Executive overview
A global view: publicly
disclosed financial incidents
Where are the “bad guys”?
Insiders versus outsiders
Prevalent methods of
attack in financial services
monitored clients
Recommendations
and mitigations
Protect your enterprise
while reducing cost
and complexity
About IBM Security
About the author
References
15
◀ Previous Next ▶
1
	 https://www-01.ibm.com/common/ssi/cgi-bin/ssialias?htmlfid=
SE912353USEN
2
	 https://www-01.ibm.com/common/ssi/cgi-bin/ssialias?htmlfid=
SE912353USEN
3
	 http://money.cnn.com/2016/05/20/news/swift-bank-attack-
global-ecuador/
4
	 http://www-03.ibm.com/security/xforce/xfisi/
5
	 https://www.wired.com/2016/05/insane-81m-bangladesh-bank-
heist-heres-know/
6
	 http://www.bankinfosecurity.com/qatar-national-bank-suffers-
massive-breach-a-9068
7
	 http://news.softpedia.com/news/lechiffre-ransomware-hits-three-
indian-banks-causes-millions-in-damages-499350.shtml
8
	 http://www.net-security.org/secworld.php?id=19370
9
	 http://www.independent.co.uk/news/business/news/tesco-bank-
accounts-suspended-transactions-access-frozen-hack-money-
la-a7402006.html
10
	http://thehackernews.com/2016/04/bank-firewall-security.html
11
	https://www.hackread.com/bitcoin-exchange-ddos-attacks/
12
	http://www.databreachtoday.com/qatar-national-bank-suffers-
massive-breach-a-9068
13
	https://www.hackread.com/anonymous-ddos-attack-bank-
greece-website-down/
14
	https://www.hackread.com/oplcarus-hacktivists-ddos-central-
bank-of-cyprus/
15
	http://thehackernews.com/2016/06/ukrainian-bank-swift-hack.html
16
	http://www.theregister.co.uk/2016/11/11/russian_banks_ddos/
17
	https://capec.mitre.org/data/definitions/255.html
18
	https://capec.mitre.org/data/definitions/225.html
19
	http://news.softpedia.com/news/76-ios-apps-including-medical-
and-banking-tools-are-exposing-data-to-hackers-512693.shtml
20
	https://capec.mitre.org/data/definitions/210.html
21
	https://capec.mitre.org/data/definitions/223.html
22
	https://securityintelligence.com/hey-phishing-you-old-foe-catch-
this-cognitive-drift/
Contents
Executive overview
A global view: publicly
disclosed financial incidents
Where are the “bad guys”?
Insiders versus outsiders
Prevalent methods of
attack in financial services
monitored clients
Recommendations
and mitigations
Protect your enterprise
while reducing cost
and complexity
About IBM Security
About the author
References
◀ Previous Next ▶
© Copyright IBM Corporation 2017
IBM Security
Route 100
Somers, NY 10589
Produced in the United States of America
April 2017
IBM, the IBM logo, ibm.com, Guardium, QRadar, Trusteer Rapport, Watson and X-Force are trademarks of
International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service
names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the web at
“Copyright and trademark information” at ibm.com/legal/copytrade.shtml
This document is current as of the initial date of publication and may be changed by IBM at any time. Not all
offerings are available in every country in which IBM operates.
THE INFORMATION IN THIS DOCUMENT IS PROVIDED “AS IS” WITHOUT ANY WARRANTY, EXPRESS OR
IMPLIED, INCLUDING WITHOUT ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
PURPOSE AND ANY WARRANTY OR CONDITION OF NON-INFRINGEMENT. IBM products are warranted
according to the terms and conditions of the agreements under which they are provided.
The client is responsible for ensuring compliance with laws and regulations applicable to it. IBM does not provide
legal advice or represent or warrant that its services or products will ensure that the client is in compliance with any
law or regulation.
Statement of Good Security Practices: IT system security involves protecting systems and information through
prevention, detection and response to improper access from within and outside your enterprise. Improper access
can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse
of your systems, including for use in attacks on others. No IT system or product should be considered completely
secure and no single product, service or security measure can be completely effective in preventing improper use or
access. IBM systems, products and services are designed to be part of a lawful, comprehensive security approach,
which will necessarily involve additional operational procedures, and may require other systems, products or
services to be most effective. IBM DOES NOT WARRANT THAT ANY SYSTEMS, PRODUCTS OR SERVICES ARE
IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE IMMUNE FROM, THE MALICIOUS OR ILLEGAL CONDUCT
OF ANY PARTY.
Contents
Executive overview
A global view: publicly
disclosed financial incidents
Where are the “bad guys”?
Insiders versus outsiders
Prevalent methods of
attack in financial services
monitored clients
Recommendations
and mitigations
Protect your enterprise
while reducing cost
and complexity
About IBM Security
About the author
References
SEL03129-USEN-00

More Related Content

What's hot

UW - IMT 552-JPMorgan Chase & Co. Risk Assessment
UW - IMT 552-JPMorgan Chase & Co. Risk AssessmentUW - IMT 552-JPMorgan Chase & Co. Risk Assessment
UW - IMT 552-JPMorgan Chase & Co. Risk Assessment
Akshay Ajgaonkar
 
Accenture re-organizing-todays-cyber-threats
Accenture re-organizing-todays-cyber-threatsAccenture re-organizing-todays-cyber-threats
Accenture re-organizing-todays-cyber-threats
Lapman Lee ✔
 
IBM 2015 Cyber Security Intelligence Index
IBM 2015 Cyber Security Intelligence IndexIBM 2015 Cyber Security Intelligence Index
IBM 2015 Cyber Security Intelligence Index
Andreanne Clarke
 
Financial Institutions, Merchants, and the Race Against Cyberthreats
Financial Institutions, Merchants, and the  Race Against CyberthreatsFinancial Institutions, Merchants, and the  Race Against Cyberthreats
Financial Institutions, Merchants, and the Race Against Cyberthreats
EMC
 
Fraud & Abuse Report 2020 by Arkose LabsFraud report q1 2020
Fraud & Abuse Report 2020 by Arkose LabsFraud report q1 2020Fraud & Abuse Report 2020 by Arkose LabsFraud report q1 2020
Fraud & Abuse Report 2020 by Arkose LabsFraud report q1 2020
Jeff Martinez
 
Ce hv8 module 13 hacking web applications
Ce hv8 module 13 hacking web applications Ce hv8 module 13 hacking web applications
Ce hv8 module 13 hacking web applications
Mehrdad Jingoism
 
The digital economy and cybersecurity
The digital economy and cybersecurityThe digital economy and cybersecurity
The digital economy and cybersecurity
Mark Albala
 
Final cyber risk report 24 feb
Final cyber risk report 24 febFinal cyber risk report 24 feb
Final cyber risk report 24 feb
mharbpavia
 
Article global it systems are now even more vulnerable - paul wright
Article  global it systems are now even more vulnerable - paul wrightArticle  global it systems are now even more vulnerable - paul wright
Article global it systems are now even more vulnerable - paul wright
Paul Wright MSc
 
Symantec Intelligence Report - Oct 2015
Symantec Intelligence Report - Oct 2015Symantec Intelligence Report - Oct 2015
Symantec Intelligence Report - Oct 2015
CheapSSLUSA
 
ISTR Internet Security Threat Report 2019
ISTR Internet Security Threat Report 2019ISTR Internet Security Threat Report 2019
ISTR Internet Security Threat Report 2019
- Mark - Fullbright
 
Cyber Crime is Wreaking Havoc
Cyber Crime is Wreaking HavocCyber Crime is Wreaking Havoc
BLURRING BOUNDARIES
BLURRING BOUNDARIESBLURRING BOUNDARIES
BLURRING BOUNDARIES
- Mark - Fullbright
 
The 10 Fastest Growing Cyber Security Companies of 2017
The 10 Fastest Growing Cyber Security Companies of 2017The 10 Fastest Growing Cyber Security Companies of 2017
The 10 Fastest Growing Cyber Security Companies of 2017
Insights success media and technology pvt ltd
 
Cyber Claims: GDPR and business email compromise drive greater frequencies
Cyber Claims: GDPR and business email compromise drive greater frequenciesCyber Claims: GDPR and business email compromise drive greater frequencies
Cyber Claims: GDPR and business email compromise drive greater frequencies
Δρ. Γιώργος K. Κασάπης
 
Who is the next target and how is big data related ulf mattsson
Who is the next target and how is big data related   ulf mattssonWho is the next target and how is big data related   ulf mattsson
Who is the next target and how is big data related ulf mattsson
Ulf Mattsson
 
idg_secops-solutions
idg_secops-solutionsidg_secops-solutions
idg_secops-solutions
Jonny Nässlander
 
September 2019 part 9
September 2019 part 9September 2019 part 9
September 2019 part 9
seadeloitte
 
Securing Cyber Space- Eljay Robertson
Securing Cyber Space- Eljay RobertsonSecuring Cyber Space- Eljay Robertson
Securing Cyber Space- Eljay Robertson
Eljay Robertson
 

What's hot (19)

UW - IMT 552-JPMorgan Chase & Co. Risk Assessment
UW - IMT 552-JPMorgan Chase & Co. Risk AssessmentUW - IMT 552-JPMorgan Chase & Co. Risk Assessment
UW - IMT 552-JPMorgan Chase & Co. Risk Assessment
 
Accenture re-organizing-todays-cyber-threats
Accenture re-organizing-todays-cyber-threatsAccenture re-organizing-todays-cyber-threats
Accenture re-organizing-todays-cyber-threats
 
IBM 2015 Cyber Security Intelligence Index
IBM 2015 Cyber Security Intelligence IndexIBM 2015 Cyber Security Intelligence Index
IBM 2015 Cyber Security Intelligence Index
 
Financial Institutions, Merchants, and the Race Against Cyberthreats
Financial Institutions, Merchants, and the  Race Against CyberthreatsFinancial Institutions, Merchants, and the  Race Against Cyberthreats
Financial Institutions, Merchants, and the Race Against Cyberthreats
 
Fraud & Abuse Report 2020 by Arkose LabsFraud report q1 2020
Fraud & Abuse Report 2020 by Arkose LabsFraud report q1 2020Fraud & Abuse Report 2020 by Arkose LabsFraud report q1 2020
Fraud & Abuse Report 2020 by Arkose LabsFraud report q1 2020
 
Ce hv8 module 13 hacking web applications
Ce hv8 module 13 hacking web applications Ce hv8 module 13 hacking web applications
Ce hv8 module 13 hacking web applications
 
The digital economy and cybersecurity
The digital economy and cybersecurityThe digital economy and cybersecurity
The digital economy and cybersecurity
 
Final cyber risk report 24 feb
Final cyber risk report 24 febFinal cyber risk report 24 feb
Final cyber risk report 24 feb
 
Article global it systems are now even more vulnerable - paul wright
Article  global it systems are now even more vulnerable - paul wrightArticle  global it systems are now even more vulnerable - paul wright
Article global it systems are now even more vulnerable - paul wright
 
Symantec Intelligence Report - Oct 2015
Symantec Intelligence Report - Oct 2015Symantec Intelligence Report - Oct 2015
Symantec Intelligence Report - Oct 2015
 
ISTR Internet Security Threat Report 2019
ISTR Internet Security Threat Report 2019ISTR Internet Security Threat Report 2019
ISTR Internet Security Threat Report 2019
 
Cyber Crime is Wreaking Havoc
Cyber Crime is Wreaking HavocCyber Crime is Wreaking Havoc
Cyber Crime is Wreaking Havoc
 
BLURRING BOUNDARIES
BLURRING BOUNDARIESBLURRING BOUNDARIES
BLURRING BOUNDARIES
 
The 10 Fastest Growing Cyber Security Companies of 2017
The 10 Fastest Growing Cyber Security Companies of 2017The 10 Fastest Growing Cyber Security Companies of 2017
The 10 Fastest Growing Cyber Security Companies of 2017
 
Cyber Claims: GDPR and business email compromise drive greater frequencies
Cyber Claims: GDPR and business email compromise drive greater frequenciesCyber Claims: GDPR and business email compromise drive greater frequencies
Cyber Claims: GDPR and business email compromise drive greater frequencies
 
Who is the next target and how is big data related ulf mattsson
Who is the next target and how is big data related   ulf mattssonWho is the next target and how is big data related   ulf mattsson
Who is the next target and how is big data related ulf mattsson
 
idg_secops-solutions
idg_secops-solutionsidg_secops-solutions
idg_secops-solutions
 
September 2019 part 9
September 2019 part 9September 2019 part 9
September 2019 part 9
 
Securing Cyber Space- Eljay Robertson
Securing Cyber Space- Eljay RobertsonSecuring Cyber Space- Eljay Robertson
Securing Cyber Space- Eljay Robertson
 

Similar to Sel03129 usen

IBM Security Services
IBM Security ServicesIBM Security Services
IBM Security Services
Rainer Mueller
 
Cyber Security Planning 101
Cyber Security Planning 101Cyber Security Planning 101
Cyber Security Planning 101
Welch LLP
 
White Paper :- Spear-phishing, watering hole and drive-by attacks :- The New ...
White Paper :- Spear-phishing, watering hole and drive-by attacks :- The New ...White Paper :- Spear-phishing, watering hole and drive-by attacks :- The New ...
White Paper :- Spear-phishing, watering hole and drive-by attacks :- The New ...
Invincea, Inc.
 
The IBM X-Force 2016 Cyber Security Intelligence Index
The IBM X-Force 2016 Cyber Security Intelligence IndexThe IBM X-Force 2016 Cyber Security Intelligence Index
The IBM X-Force 2016 Cyber Security Intelligence Index
Kanishka Ramyar
 
CYBERSECURITY STRATEGIES FOR SAFEGUARDING CUSTOMER’S DATA AND PREVENTING FINA...
CYBERSECURITY STRATEGIES FOR SAFEGUARDING CUSTOMER’S DATA AND PREVENTING FINA...CYBERSECURITY STRATEGIES FOR SAFEGUARDING CUSTOMER’S DATA AND PREVENTING FINA...
CYBERSECURITY STRATEGIES FOR SAFEGUARDING CUSTOMER’S DATA AND PREVENTING FINA...
ijsc
 
Cybersecurity Strategies for Safeguarding Customer’s Data and Preventing Fina...
Cybersecurity Strategies for Safeguarding Customer’s Data and Preventing Fina...Cybersecurity Strategies for Safeguarding Customer’s Data and Preventing Fina...
Cybersecurity Strategies for Safeguarding Customer’s Data and Preventing Fina...
ijsc
 
220715_Cybersecurity: What's at stake?
220715_Cybersecurity: What's at stake?220715_Cybersecurity: What's at stake?
220715_Cybersecurity: What's at stake?
Spire Research and Consulting
 
Insider_Threats_in_Healthcare_1651617236.pdf
Insider_Threats_in_Healthcare_1651617236.pdfInsider_Threats_in_Healthcare_1651617236.pdf
Insider_Threats_in_Healthcare_1651617236.pdf
ramsetl
 
Cyber Security Threats | IIA Boise Chapter
Cyber Security Threats | IIA Boise ChapterCyber Security Threats | IIA Boise Chapter
Cyber Security Threats | IIA Boise Chapter
Patricia M Watson
 
Cyber
CyberCyber
Cyber
windows21
 
Cyber Security index
Cyber Security indexCyber Security index
Cyber Security index
sukiennong.vn
 
Cyber Liability - Insurance Risk Management and Preparation
Cyber Liability - Insurance Risk Management and PreparationCyber Liability - Insurance Risk Management and Preparation
Cyber Liability - Insurance Risk Management and Preparation
Eric Reehl
 
JPMorgan Chase & Co. -Risk Assessment Report
JPMorgan Chase & Co. -Risk Assessment ReportJPMorgan Chase & Co. -Risk Assessment Report
JPMorgan Chase & Co. -Risk Assessment Report
Divya Kothari
 
Protecting the brand—cyber-attacks and the reputation of the enterprise
Protecting the brand—cyber-attacks and the reputation of the enterprise Protecting the brand—cyber-attacks and the reputation of the enterprise
Protecting the brand—cyber-attacks and the reputation of the enterprise
The Economist Media Businesses
 
2021 Cybersecurity Recap: How Did We Fare Last Year?
2021 Cybersecurity Recap: How Did We Fare Last Year? 2021 Cybersecurity Recap: How Did We Fare Last Year?
2021 Cybersecurity Recap: How Did We Fare Last Year?
XNSPY
 
IMT 552-JPMorgan Chase & Co. Risk Assessment v05
IMT 552-JPMorgan Chase & Co. Risk Assessment v05IMT 552-JPMorgan Chase & Co. Risk Assessment v05
IMT 552-JPMorgan Chase & Co. Risk Assessment v05
Daniel Kapellmann Zafra
 
Aon Cyber Newsletter v10
Aon Cyber Newsletter v10Aon Cyber Newsletter v10
Aon Cyber Newsletter v10
Graeme Cross
 
Cybersecurity | Risk. Impact. Innovations.
Cybersecurity | Risk. Impact. Innovations.Cybersecurity | Risk. Impact. Innovations.
Cybersecurity | Risk. Impact. Innovations.
Vertex Holdings
 
The new MFA security gap deciphered — Real-world guide on how to fix it For C...
The new MFA security gap deciphered — Real-world guide on how to fix it For C...The new MFA security gap deciphered — Real-world guide on how to fix it For C...
The new MFA security gap deciphered — Real-world guide on how to fix it For C...
Elena Barkovskaya
 
Dell Technologies Cyber Security playbook
Dell Technologies Cyber Security playbookDell Technologies Cyber Security playbook
Dell Technologies Cyber Security playbook
Margarete McGrath
 

Similar to Sel03129 usen (20)

IBM Security Services
IBM Security ServicesIBM Security Services
IBM Security Services
 
Cyber Security Planning 101
Cyber Security Planning 101Cyber Security Planning 101
Cyber Security Planning 101
 
White Paper :- Spear-phishing, watering hole and drive-by attacks :- The New ...
White Paper :- Spear-phishing, watering hole and drive-by attacks :- The New ...White Paper :- Spear-phishing, watering hole and drive-by attacks :- The New ...
White Paper :- Spear-phishing, watering hole and drive-by attacks :- The New ...
 
The IBM X-Force 2016 Cyber Security Intelligence Index
The IBM X-Force 2016 Cyber Security Intelligence IndexThe IBM X-Force 2016 Cyber Security Intelligence Index
The IBM X-Force 2016 Cyber Security Intelligence Index
 
CYBERSECURITY STRATEGIES FOR SAFEGUARDING CUSTOMER’S DATA AND PREVENTING FINA...
CYBERSECURITY STRATEGIES FOR SAFEGUARDING CUSTOMER’S DATA AND PREVENTING FINA...CYBERSECURITY STRATEGIES FOR SAFEGUARDING CUSTOMER’S DATA AND PREVENTING FINA...
CYBERSECURITY STRATEGIES FOR SAFEGUARDING CUSTOMER’S DATA AND PREVENTING FINA...
 
Cybersecurity Strategies for Safeguarding Customer’s Data and Preventing Fina...
Cybersecurity Strategies for Safeguarding Customer’s Data and Preventing Fina...Cybersecurity Strategies for Safeguarding Customer’s Data and Preventing Fina...
Cybersecurity Strategies for Safeguarding Customer’s Data and Preventing Fina...
 
220715_Cybersecurity: What's at stake?
220715_Cybersecurity: What's at stake?220715_Cybersecurity: What's at stake?
220715_Cybersecurity: What's at stake?
 
Insider_Threats_in_Healthcare_1651617236.pdf
Insider_Threats_in_Healthcare_1651617236.pdfInsider_Threats_in_Healthcare_1651617236.pdf
Insider_Threats_in_Healthcare_1651617236.pdf
 
Cyber Security Threats | IIA Boise Chapter
Cyber Security Threats | IIA Boise ChapterCyber Security Threats | IIA Boise Chapter
Cyber Security Threats | IIA Boise Chapter
 
Cyber
CyberCyber
Cyber
 
Cyber Security index
Cyber Security indexCyber Security index
Cyber Security index
 
Cyber Liability - Insurance Risk Management and Preparation
Cyber Liability - Insurance Risk Management and PreparationCyber Liability - Insurance Risk Management and Preparation
Cyber Liability - Insurance Risk Management and Preparation
 
JPMorgan Chase & Co. -Risk Assessment Report
JPMorgan Chase & Co. -Risk Assessment ReportJPMorgan Chase & Co. -Risk Assessment Report
JPMorgan Chase & Co. -Risk Assessment Report
 
Protecting the brand—cyber-attacks and the reputation of the enterprise
Protecting the brand—cyber-attacks and the reputation of the enterprise Protecting the brand—cyber-attacks and the reputation of the enterprise
Protecting the brand—cyber-attacks and the reputation of the enterprise
 
2021 Cybersecurity Recap: How Did We Fare Last Year?
2021 Cybersecurity Recap: How Did We Fare Last Year? 2021 Cybersecurity Recap: How Did We Fare Last Year?
2021 Cybersecurity Recap: How Did We Fare Last Year?
 
IMT 552-JPMorgan Chase & Co. Risk Assessment v05
IMT 552-JPMorgan Chase & Co. Risk Assessment v05IMT 552-JPMorgan Chase & Co. Risk Assessment v05
IMT 552-JPMorgan Chase & Co. Risk Assessment v05
 
Aon Cyber Newsletter v10
Aon Cyber Newsletter v10Aon Cyber Newsletter v10
Aon Cyber Newsletter v10
 
Cybersecurity | Risk. Impact. Innovations.
Cybersecurity | Risk. Impact. Innovations.Cybersecurity | Risk. Impact. Innovations.
Cybersecurity | Risk. Impact. Innovations.
 
The new MFA security gap deciphered — Real-world guide on how to fix it For C...
The new MFA security gap deciphered — Real-world guide on how to fix it For C...The new MFA security gap deciphered — Real-world guide on how to fix it For C...
The new MFA security gap deciphered — Real-world guide on how to fix it For C...
 
Dell Technologies Cyber Security playbook
Dell Technologies Cyber Security playbookDell Technologies Cyber Security playbook
Dell Technologies Cyber Security playbook
 

More from Andrey Apuhtin

Shadow pad technical_description_pdf
Shadow pad technical_description_pdfShadow pad technical_description_pdf
Shadow pad technical_description_pdf
Andrey Apuhtin
 
Ftc cdt-vpn-complaint-8-7-17
Ftc cdt-vpn-complaint-8-7-17Ftc cdt-vpn-complaint-8-7-17
Ftc cdt-vpn-complaint-8-7-17
Andrey Apuhtin
 
Hutchins redacted indictment
Hutchins redacted indictmentHutchins redacted indictment
Hutchins redacted indictment
Andrey Apuhtin
 
Dr web review_mob_july_2017
Dr web review_mob_july_2017Dr web review_mob_july_2017
Dr web review_mob_july_2017
Andrey Apuhtin
 
Nexusguard d do_s_threat_report_q1_2017_en
Nexusguard d do_s_threat_report_q1_2017_enNexusguard d do_s_threat_report_q1_2017_en
Nexusguard d do_s_threat_report_q1_2017_en
Andrey Apuhtin
 
Pandalabs отчет за 1 квартал 2017
Pandalabs   отчет за 1 квартал 2017Pandalabs   отчет за 1 квартал 2017
Pandalabs отчет за 1 квартал 2017
Andrey Apuhtin
 
Cldap threat-advisory
Cldap threat-advisoryCldap threat-advisory
Cldap threat-advisory
Andrey Apuhtin
 
Lookout pegasus-android-technical-analysis
Lookout pegasus-android-technical-analysisLookout pegasus-android-technical-analysis
Lookout pegasus-android-technical-analysis
Andrey Apuhtin
 
Rand rr1751
Rand rr1751Rand rr1751
Rand rr1751
Andrey Apuhtin
 
Apwg trends report_q4_2016
Apwg trends report_q4_2016Apwg trends report_q4_2016
Apwg trends report_q4_2016
Andrey Apuhtin
 
Browser history
Browser historyBrowser history
Browser history
Andrey Apuhtin
 
Software
SoftwareSoftware
Software
Andrey Apuhtin
 
Antivirus
AntivirusAntivirus
Antivirus
Andrey Apuhtin
 
Https interception
Https interceptionHttps interception
Https interception
Andrey Apuhtin
 
Wilssc 006 xml
Wilssc 006 xmlWilssc 006 xml
Wilssc 006 xml
Andrey Apuhtin
 
News berthaume-sentencing-jan2017
News berthaume-sentencing-jan2017News berthaume-sentencing-jan2017
News berthaume-sentencing-jan2017
Andrey Apuhtin
 
Windows exploitation-2016-a4
Windows exploitation-2016-a4Windows exploitation-2016-a4
Windows exploitation-2016-a4
Andrey Apuhtin
 
Mw stj 08252016_2
Mw stj 08252016_2Mw stj 08252016_2
Mw stj 08252016_2
Andrey Apuhtin
 
150127iotrpt
150127iotrpt150127iotrpt
150127iotrpt
Andrey Apuhtin
 

More from Andrey Apuhtin (20)

Shadow pad technical_description_pdf
Shadow pad technical_description_pdfShadow pad technical_description_pdf
Shadow pad technical_description_pdf
 
Ftc cdt-vpn-complaint-8-7-17
Ftc cdt-vpn-complaint-8-7-17Ftc cdt-vpn-complaint-8-7-17
Ftc cdt-vpn-complaint-8-7-17
 
Hutchins redacted indictment
Hutchins redacted indictmentHutchins redacted indictment
Hutchins redacted indictment
 
Dr web review_mob_july_2017
Dr web review_mob_july_2017Dr web review_mob_july_2017
Dr web review_mob_july_2017
 
Dmarc
DmarcDmarc
Dmarc
 
Nexusguard d do_s_threat_report_q1_2017_en
Nexusguard d do_s_threat_report_q1_2017_enNexusguard d do_s_threat_report_q1_2017_en
Nexusguard d do_s_threat_report_q1_2017_en
 
Pandalabs отчет за 1 квартал 2017
Pandalabs   отчет за 1 квартал 2017Pandalabs   отчет за 1 квартал 2017
Pandalabs отчет за 1 квартал 2017
 
Cldap threat-advisory
Cldap threat-advisoryCldap threat-advisory
Cldap threat-advisory
 
Lookout pegasus-android-technical-analysis
Lookout pegasus-android-technical-analysisLookout pegasus-android-technical-analysis
Lookout pegasus-android-technical-analysis
 
Rand rr1751
Rand rr1751Rand rr1751
Rand rr1751
 
Apwg trends report_q4_2016
Apwg trends report_q4_2016Apwg trends report_q4_2016
Apwg trends report_q4_2016
 
Browser history
Browser historyBrowser history
Browser history
 
Software
SoftwareSoftware
Software
 
Antivirus
AntivirusAntivirus
Antivirus
 
Https interception
Https interceptionHttps interception
Https interception
 
Wilssc 006 xml
Wilssc 006 xmlWilssc 006 xml
Wilssc 006 xml
 
News berthaume-sentencing-jan2017
News berthaume-sentencing-jan2017News berthaume-sentencing-jan2017
News berthaume-sentencing-jan2017
 
Windows exploitation-2016-a4
Windows exploitation-2016-a4Windows exploitation-2016-a4
Windows exploitation-2016-a4
 
Mw stj 08252016_2
Mw stj 08252016_2Mw stj 08252016_2
Mw stj 08252016_2
 
150127iotrpt
150127iotrpt150127iotrpt
150127iotrpt
 

Recently uploaded

ThaiPy meetup - Indexes and Django
ThaiPy meetup - Indexes and DjangoThaiPy meetup - Indexes and Django
ThaiPy meetup - Indexes and Django
akshesh doshi
 
Discover the Power of ONEMONITAR: The Ultimate Mobile Spy App for Android Dev...
Discover the Power of ONEMONITAR: The Ultimate Mobile Spy App for Android Dev...Discover the Power of ONEMONITAR: The Ultimate Mobile Spy App for Android Dev...
Discover the Power of ONEMONITAR: The Ultimate Mobile Spy App for Android Dev...
onemonitarsoftware
 
Top 10 Tips To Get Google AdSense For Your Website
Top 10 Tips To Get Google AdSense For Your WebsiteTop 10 Tips To Get Google AdSense For Your Website
Top 10 Tips To Get Google AdSense For Your Website
e-Definers Technology
 
React Native vs Flutter - SSTech System
React Native vs Flutter  - SSTech SystemReact Native vs Flutter  - SSTech System
React Native vs Flutter - SSTech System
SSTech System
 
introduction of Ansys software and basic and advance knowledge of modelling s...
introduction of Ansys software and basic and advance knowledge of modelling s...introduction of Ansys software and basic and advance knowledge of modelling s...
introduction of Ansys software and basic and advance knowledge of modelling s...
sachin chaurasia
 
What is OCR Technology and How to Extract Text from Any Image for Free
What is OCR Technology and How to Extract Text from Any Image for FreeWhat is OCR Technology and How to Extract Text from Any Image for Free
What is OCR Technology and How to Extract Text from Any Image for Free
TwisterTools
 
Ported to Cloud with Wing_ Blue ZnZone app from _Hexagonal Architecture Expla...
Ported to Cloud with Wing_ Blue ZnZone app from _Hexagonal Architecture Expla...Ported to Cloud with Wing_ Blue ZnZone app from _Hexagonal Architecture Expla...
Ported to Cloud with Wing_ Blue ZnZone app from _Hexagonal Architecture Expla...
Asher Sterkin
 
NYC 26-Jun-2024 Combined Presentations.pdf
NYC 26-Jun-2024 Combined Presentations.pdfNYC 26-Jun-2024 Combined Presentations.pdf
NYC 26-Jun-2024 Combined Presentations.pdf
AUGNYC
 
Abortion pills in Fujairah *((+971588192166*)☎️)¥) **Effective Abortion Pills...
Abortion pills in Fujairah *((+971588192166*)☎️)¥) **Effective Abortion Pills...Abortion pills in Fujairah *((+971588192166*)☎️)¥) **Effective Abortion Pills...
Abortion pills in Fujairah *((+971588192166*)☎️)¥) **Effective Abortion Pills...
Medical / Health Care (+971588192166) Mifepristone and Misoprostol tablets 200mg
 
Cultural Shifts: Embracing DevOps for Organizational Transformation
Cultural Shifts: Embracing DevOps for Organizational TransformationCultural Shifts: Embracing DevOps for Organizational Transformation
Cultural Shifts: Embracing DevOps for Organizational Transformation
Mindfire Solution
 
ENISA Threat Landscape 2023 documentation
ENISA Threat Landscape 2023 documentationENISA Threat Landscape 2023 documentation
ENISA Threat Landscape 2023 documentation
sofiafernandezon
 
BITCOIN HEIST RANSOMEWARE ATTACK PREDICTION
BITCOIN HEIST RANSOMEWARE ATTACK PREDICTIONBITCOIN HEIST RANSOMEWARE ATTACK PREDICTION
BITCOIN HEIST RANSOMEWARE ATTACK PREDICTION
ssuser2b426d1
 
Attendance Tracking From Paper To Digital
Attendance Tracking From Paper To DigitalAttendance Tracking From Paper To Digital
Attendance Tracking From Paper To Digital
Task Tracker
 
dachnug51 - All you ever wanted to know about domino licensing.pdf
dachnug51 - All you ever wanted to know about domino licensing.pdfdachnug51 - All you ever wanted to know about domino licensing.pdf
dachnug51 - All you ever wanted to know about domino licensing.pdf
DNUG e.V.
 
Google ML-Kit - Understanding on-device machine learning
Google ML-Kit - Understanding on-device machine learningGoogle ML-Kit - Understanding on-device machine learning
Google ML-Kit - Understanding on-device machine learning
VishrutGoyani1
 
MVP Mobile Application - Codearrest.pptx
MVP Mobile Application - Codearrest.pptxMVP Mobile Application - Codearrest.pptx
MVP Mobile Application - Codearrest.pptx
Mitchell Marsh
 
Safe Work Permit Management Software for Hot Work Permits
Safe Work Permit Management Software for Hot Work PermitsSafe Work Permit Management Software for Hot Work Permits
Safe Work Permit Management Software for Hot Work Permits
sheqnetworkmarketing
 
Splunk_Remote_Work_Insights_Overview.pptx
Splunk_Remote_Work_Insights_Overview.pptxSplunk_Remote_Work_Insights_Overview.pptx
Splunk_Remote_Work_Insights_Overview.pptx
sudsdeep
 
Independence Day Hasn’t Always Been a U.S. Holiday.pdf
Independence Day Hasn’t Always Been a U.S. Holiday.pdfIndependence Day Hasn’t Always Been a U.S. Holiday.pdf
Independence Day Hasn’t Always Been a U.S. Holiday.pdf
Livetecs LLC
 
Break data silos with real-time connectivity using Confluent Cloud Connectors
Break data silos with real-time connectivity using Confluent Cloud ConnectorsBreak data silos with real-time connectivity using Confluent Cloud Connectors
Break data silos with real-time connectivity using Confluent Cloud Connectors
confluent
 

Recently uploaded (20)

ThaiPy meetup - Indexes and Django
ThaiPy meetup - Indexes and DjangoThaiPy meetup - Indexes and Django
ThaiPy meetup - Indexes and Django
 
Discover the Power of ONEMONITAR: The Ultimate Mobile Spy App for Android Dev...
Discover the Power of ONEMONITAR: The Ultimate Mobile Spy App for Android Dev...Discover the Power of ONEMONITAR: The Ultimate Mobile Spy App for Android Dev...
Discover the Power of ONEMONITAR: The Ultimate Mobile Spy App for Android Dev...
 
Top 10 Tips To Get Google AdSense For Your Website
Top 10 Tips To Get Google AdSense For Your WebsiteTop 10 Tips To Get Google AdSense For Your Website
Top 10 Tips To Get Google AdSense For Your Website
 
React Native vs Flutter - SSTech System
React Native vs Flutter  - SSTech SystemReact Native vs Flutter  - SSTech System
React Native vs Flutter - SSTech System
 
introduction of Ansys software and basic and advance knowledge of modelling s...
introduction of Ansys software and basic and advance knowledge of modelling s...introduction of Ansys software and basic and advance knowledge of modelling s...
introduction of Ansys software and basic and advance knowledge of modelling s...
 
What is OCR Technology and How to Extract Text from Any Image for Free
What is OCR Technology and How to Extract Text from Any Image for FreeWhat is OCR Technology and How to Extract Text from Any Image for Free
What is OCR Technology and How to Extract Text from Any Image for Free
 
Ported to Cloud with Wing_ Blue ZnZone app from _Hexagonal Architecture Expla...
Ported to Cloud with Wing_ Blue ZnZone app from _Hexagonal Architecture Expla...Ported to Cloud with Wing_ Blue ZnZone app from _Hexagonal Architecture Expla...
Ported to Cloud with Wing_ Blue ZnZone app from _Hexagonal Architecture Expla...
 
NYC 26-Jun-2024 Combined Presentations.pdf
NYC 26-Jun-2024 Combined Presentations.pdfNYC 26-Jun-2024 Combined Presentations.pdf
NYC 26-Jun-2024 Combined Presentations.pdf
 
Abortion pills in Fujairah *((+971588192166*)☎️)¥) **Effective Abortion Pills...
Abortion pills in Fujairah *((+971588192166*)☎️)¥) **Effective Abortion Pills...Abortion pills in Fujairah *((+971588192166*)☎️)¥) **Effective Abortion Pills...
Abortion pills in Fujairah *((+971588192166*)☎️)¥) **Effective Abortion Pills...
 
Cultural Shifts: Embracing DevOps for Organizational Transformation
Cultural Shifts: Embracing DevOps for Organizational TransformationCultural Shifts: Embracing DevOps for Organizational Transformation
Cultural Shifts: Embracing DevOps for Organizational Transformation
 
ENISA Threat Landscape 2023 documentation
ENISA Threat Landscape 2023 documentationENISA Threat Landscape 2023 documentation
ENISA Threat Landscape 2023 documentation
 
BITCOIN HEIST RANSOMEWARE ATTACK PREDICTION
BITCOIN HEIST RANSOMEWARE ATTACK PREDICTIONBITCOIN HEIST RANSOMEWARE ATTACK PREDICTION
BITCOIN HEIST RANSOMEWARE ATTACK PREDICTION
 
Attendance Tracking From Paper To Digital
Attendance Tracking From Paper To DigitalAttendance Tracking From Paper To Digital
Attendance Tracking From Paper To Digital
 
dachnug51 - All you ever wanted to know about domino licensing.pdf
dachnug51 - All you ever wanted to know about domino licensing.pdfdachnug51 - All you ever wanted to know about domino licensing.pdf
dachnug51 - All you ever wanted to know about domino licensing.pdf
 
Google ML-Kit - Understanding on-device machine learning
Google ML-Kit - Understanding on-device machine learningGoogle ML-Kit - Understanding on-device machine learning
Google ML-Kit - Understanding on-device machine learning
 
MVP Mobile Application - Codearrest.pptx
MVP Mobile Application - Codearrest.pptxMVP Mobile Application - Codearrest.pptx
MVP Mobile Application - Codearrest.pptx
 
Safe Work Permit Management Software for Hot Work Permits
Safe Work Permit Management Software for Hot Work PermitsSafe Work Permit Management Software for Hot Work Permits
Safe Work Permit Management Software for Hot Work Permits
 
Splunk_Remote_Work_Insights_Overview.pptx
Splunk_Remote_Work_Insights_Overview.pptxSplunk_Remote_Work_Insights_Overview.pptx
Splunk_Remote_Work_Insights_Overview.pptx
 
Independence Day Hasn’t Always Been a U.S. Holiday.pdf
Independence Day Hasn’t Always Been a U.S. Holiday.pdfIndependence Day Hasn’t Always Been a U.S. Holiday.pdf
Independence Day Hasn’t Always Been a U.S. Holiday.pdf
 
Break data silos with real-time connectivity using Confluent Cloud Connectors
Break data silos with real-time connectivity using Confluent Cloud ConnectorsBreak data silos with real-time connectivity using Confluent Cloud Connectors
Break data silos with real-time connectivity using Confluent Cloud Connectors
 

Sel03129 usen

  • 1. Security trends in the financial services sector With money and data both at stake, 2016’s leading attack target remains a magnet for cybercrime IBM X-Force® Research Click here to start ▶
  • 2. 2 ◀ Previous Next ▶ Executive overview The financial services sector has been a magnet for cybercrime for over two decades now, and that was certainly true again in 2016. As revealed in the 2017 IBM X-Force Threat Intelligence Index, the sector was attacked more than any other industry, with the average financial services client organization monitored by IBM Security Services experiencing 65 percent more attacks than the average client organization across all industries (see Figure 1). Moreover, 2016 saw an average 29 percent increase in attacks on financial services organizations—up from 1,310 attacks in 20151 to 1,684 in 2016. Amid these negative findings, there were however some good tidings. The average financial services client we monitored experienced 192 security incidents in 20152 , but only 94 in 2016. A “security incident” is our most serious classification, so this is indeed welcome news. Contents Executive overview 1 • 2 A global view: publicly disclosed financial incidents Where are the “bad guys”? Insiders versus outsiders Prevalent methods of attack in financial services monitored clients Recommendations and mitigations Protect your enterprise while reducing cost and complexity About IBM Security About the author References Across all industries 54,681,413 Events 1,019 Attacks 93 Incidents Financial services 101,988,746 Events 1,684 Attacks 94 Incidents Figure 1. Average client organization monitored by IBM Security Services, 2016 cross-industry versus financial services comparison. (See sidebar “Definition of terms” for definitions of security event, attack and security incident.) Definition of terms Security event: Activity on a system or network detected by a security device or application. Attack: A security event that has been identified by correlation and analytics tools as malicious activity that is attempting to collect, disrupt, deny, degrade or destroy information system resources or the information itself. Security incident: An attack or security event that has been reviewed by IBM security analysts and deemed worthy of deeper investigation.
  • 3. 3 ◀ Previous Next ▶ Unfortunately, the good news may end here. IBM® X-Force® malware researchers investigating cybercrime trends and financial malware campaigns found that some countries experienced a marked increase in financial cybercrime in 2016. Cyber gangs continued to sharpen their focus on business bank accounts, a trend that began picking up speed in mid-2014, using malware such as Dyre, Dridex, GozNym and TrickBot to target business banking services. 2016 also saw a notable rise in publicly reported Society for Worldwide Interbank Financial Telecommunication (SWIFT) attacks against the messaging system used by thousands of banks and companies to move money around the world.3 The result was that millions of US dollars were stolen and fraudulently transferred from various global banks using custom malware to remove traces of these transactions. Combined with other analysis disclosed in this report, these trends and incidents paint a troublesome picture for the financial services sector. Fortunately, financial services organizations can strengthen their cybersecurity immune system with a focus on mitigating notable security pain points such as insider threats and financial malware. Contents Executive overview 1 • 2 A global view: publicly disclosed financial incidents Where are the “bad guys”? Insiders versus outsiders Prevalent methods of attack in financial services monitored clients Recommendations and mitigations Protect your enterprise while reducing cost and complexity About IBM Security About the author References About this report This IBM X-Force Research report was created by the IBM Managed Security Services Threat Research group, a team of experienced and skilled security analysts working diligently to keep IBM clients informed and prepared for the latest cybersecurity threats. This research team analyzes security data from many internal and external sources, including event data, activity and trends sourced from endpoints managed and monitored by IBM.
  • 4. 4 ◀ Previous Next ▶ A global view: publicly disclosed financial incidents IBM X-Force Interactive Security Incidents data is a sampling of notable publicly disclosed incidents.4 Included are breaches, which are incidents resulting in the exfiltration of data. As Figure 2 shows, there was no shortage of cyberattack- induced financial ruin in 2016. Outages due to distributed denial of service (DDoS) shut down online financial institutions’ operations all over the globe. Malware, including ransomware, was responsible for millions in losses. One of the banks targeted in the SWIFT attacks, had USD 81 million stolen from their customers’ accounts.5 Attackers also turned to an old favorite from their arsenal of phishing techniques, the Business Email Compromise (BEC) scam, to trick unwitting victims out of their money, an issue that hit the victim, but also became an issue for the banks on either side of a multi-million dollar fraud that’s hard to cover by existing insurance. Aside from financial losses, many compromises resulted in leaks of highly sensitive financial data. In one bank compromise, 1.4GB of leaked data reportedly included internal corporate files and customer financial data.6 With over 200 million records compromised in 2016—a 937 percent increase over the 2015 total of just under 20 million—the financial services sector ranked third among other industries in terms of records breached. In terms of publicly disclosed incidents tracked by IBM X-Force, recent year-over- year totals have remained flat: 22 publicly disclosed incidents in 2014, 21 in 2015, and 22 in 2016. Contents Executive overview A global view: publicly disclosed financial incidents 1 • 2 Where are the “bad guys”? Insiders versus outsiders Prevalent methods of attack in financial services monitored clients Recommendations and mitigations Protect your enterprise while reducing cost and complexity About IBM Security About the author References
  • 5. 5 ◀ Previous Next ▶ Contents Executive overview A global view: publicly disclosed financial incidents 1 • 2 Where are the “bad guys”? Insiders versus outsiders Prevalent methods of attack in financial services monitored clients Recommendations and mitigations Protect your enterprise while reducing cost and complexity About IBM Security About the author References Belgium BEC scam resulted in the theft of 70 million euros in fraudulent wire transfers8 Greece Hactivists protesting global corruption targeted banks in Greece by disrupting acceess for a full day through DDoS attacks13 Cyprus Hactivists shut down a Cyprus bank website as part of an ongoing protest against banking corruption14 Ukraine Attackers exploiting the international banking system SWIFT stole USD 10 million from a bank15 Qatar 1.4 GB of data was leaked from a Qatar bank including intelligence reports on people of interest12 Russia High-volume DDoS attack targeting several Russian banks disrupted services for several days16 Canada Bitcoin exchange forced to shut down operations after constant DDoS attacks over a three-year period11 UK Over 9,000 customers had money disappear from their accounts, believed to be the Retefe banking Trojan9 Bangladesh USD 81 million stolen through account takeover10 India Several banks targeted with LeChiffre crypto-ransomware7 Figure 2. Notable 2016 publicly disclosed financial services security incidents. Source: IBM X-Force Interactive Security Incidents data.
  • 6. 6 ◀ Previous Next ▶ Where are the “bad guys”? Insiders versus outsiders Security executives and their teams deal with numerous attacks every year. To prioritize defenses and budgets they continually keep tabs on where threats are coming from. Are they mostly external attacks, or do insiders make up a large part of their organization’s overall attack surface? To discover whether an attack is coming from inside or outside the organization, security investigation teams first identify the source and destination IPs as internal or external, then further investigate the associated attack pattern to determine malicious or inadvertent intent. IBM Managed Security Services (MSS) 2016 data for the financial services sector (see Figure 3) reveals more insider than outsider attacks (58 percent to 42 percent) affected organizations, and within the insider group, many more inadvertent actors (53 percent) were the culprits than malicious insiders acting against the organization (5 percent). Among the top five targeted industries—retail, healthcare, manufacturing, financial services, and information and communications—the 2017 IBM X-Force Threat Intelligence Index reveals that in 2016 the financial services industry experienced the highest level of threat from inadvertent actors. It’s useful to think of an inadvertent actor as a compromised system carrying out attacks without the user being aware of it, as in the “Subvert Access Control” attack type described in more detail below. Often it happens when a desktop client is compromised via malicious email attachments, clickjacking or phishing, or vulnerable computer services that have been attacked from another internal networked system. Contents Executive overview A global view: publicly disclosed financial incidents Where are the “bad guys”? Insiders versus outsiders Prevalent methods of attack in financial services monitored clients Recommendations and mitigations Protect your enterprise while reducing cost and complexity About IBM Security About the author References Source of attacks against financial services security clients Outsiders 42% Inadvertent actors 53% Malicious insiders 5% Insiders 58% Figure 3. In 2016, insiders were responsible for more financial services sector attacks than outsiders.
  • 7. 7 ◀ Previous Next ▶ Prevalent methods of attack in financial services monitored clients To classify and better understand the types of threats that affect financial entities, X-Force has grouped 2016 observed attack types according to the standard set by the MITRE Corporation’s CAPEC��� (Common Attack Pattern Enumeration and Classification) effort (see Figure 4). As described by MITRE, their system “organizes attack patterns hierarchically based on mechanisms that are frequently employed in exploiting a vulnerability.” The only exception is the “Indicator” category, which describes conditions and context of threats and attack patterns. Contents Executive overview A global view: publicly disclosed financial incidents Where are the “bad guys”? Insiders versus outsiders Prevalent methods of attack in financial services monitored clients 1 • 2 • 3 • 4 Recommendations and mitigations Protect your enterprise while reducing cost and complexity About IBM Security About the author References Top attacks for monitored financial services security clients Inject unexpected items Subvert access control Manipulate data structures Collect and analyze information Indicator Abuse existing functionality Manipulate system resources Employ probabilistic techniques Engage in deceptive interaction 51% 13% 13% 9% 6% 3% 3% 1% <1% Figure 4. Injection-type attacks were the clear leader in the financial services sector in 2016. Source: IBM Managed Security Services data, January 1 – December 31, 2016.
  • 8. 8 ◀ Previous Next ▶ Further details on each attack type appear in the following sections. Inject unexpected items According to IBM MSS analysis of 2016 data, the number one attack vector, involving the use of malicious input data to attempt to control or disrupt a system, targeted 51 percent of the financial services clients monitored by IBM X-Force. That figure was notably higher than the cross-industry average of 42 percent. Command injections, which include operating system command injection (OS CMDi) and SQLi, belong in this category. OS CMDi is also known as “shell command injection,” after which the now infamous and widely prevalent Shellshock vulnerability is named. Shellshock activity, which surged across all industries before its two-year anniversary in September 2016, accounted for just over a quarter of all attacks targeting financial services organizations in 2016. SQLi and OS CMDi are perhaps the most popular attack vectors within this sector because successful exploitation of these vulnerabilities can provide attackers with the ability to read, modify and destroy sensitive data. The personally identifiable information (PII) in the databases of financial institutions is highly valued by hackers because they can sell it for a handsome profit or hold it hostage, demanding that the financial institution pay a ransom to get it back or prevent its public disclosure. Manipulate data structures The number two attack vector involved attacks in which the attacker attempted to gain unauthorized access through the manipulation of system data structures. As CAPEC™ states, “Often, vulnerabilities [such as buffer overflow vulnerabilities], and therefore exploitability of these data structures, exist due to ambiguity and assumption in their design and prescribed handling.”17 The great majority of the attacks in this category targeted buffer overflow vulnerabilities. On a positive note, while the cross-industry client average for attacks in this category is 32 percent, the figure in the financial services sector, 13 percent, is substantially lower. That might be because attackers view this attack vector as less potentially successful against financial services targets. Contents Executive overview A global view: publicly disclosed financial incidents Where are the “bad guys”? Insiders versus outsiders Prevalent methods of attack in financial services monitored clients 1 • 2 • 3 • 4 Recommendations and mitigations Protect your enterprise while reducing cost and complexity About IBM Security About the author References
  • 9. 9 ◀ Previous Next ▶ Subvert access control The number three attack vector, accounting for 13 percent of attacks—substantially higher than the cross-industry average of three percent—involved attacks attempting to subvert access control through the “exploitation of weaknesses, limitations and assumptions in the mechanisms a target utilizes to manage identity and authentication.”18 Most of the attacks we observed in this category involved the exploitation of vulnerabilities in the target’s client-server communication channel for authentication and data integrity by leveraging the implicit trust a server places in what it believes to be a valid client. Man-in-the-middle (MITM) attacks, in which attackers attempt to intercept and relay messages between two parties (people or systems), falls under this category. This technique could allow an attacker to steal the information going back and forth or insert malicious code into the connection. Some mobile banking apps have been found to mishandle the way they transmit data, making them vulnerable to MITM attacks.19 Collect and analyze information Attacks focused on the collection and theft of information made up nearly nine percent of attacks targeting client devices. Most of these involved fingerprinting, often viewed as a kind of reconnaissance that gathers information on potential targets to discover their existing weaknesses. Essentially, an attacker compares output from a target system to known “fingerprints” that uniquely identify specific details about the target, such as the type or version of its operating system or an application. Attackers can use the information to identify known vulnerabilities in the target organization’s IT infrastructure and better prepare their tactical plans. Indicator Note that “Indicator” is not a CAPEC™ mechanism of attack. A cyberthreat indicator consists of certain observable conditions as well as contextual information about the condition or pattern. These events, which accounted for six percent of all attacks, could indicate either an attempted or a successful attack on the target system. A large percentage of the attacks involved targeted systems experiencing 100 or more external pings in a short time, which might indicate a compromised internal host. If compromised, a host could be attacking other targets or communicating with other compromised hosts until detected and stopped. Contents Executive overview A global view: publicly disclosed financial incidents Where are the “bad guys”? Insiders versus outsiders Prevalent methods of attack in financial services monitored clients 1 • 2 • 3 • 4 Recommendations and mitigations Protect your enterprise while reducing cost and complexity About IBM Security About the author References
  • 10. 10 ◀ Previous Next ▶ Abuse existing functionality Three percent of attacks involved attempts to abuse or manipulate “one or more functions of an application in order to achieve a malicious objective not originally intended by the application, or to deplete a resource to the point that the target’s functionality is affected.”20 Successful attacks in this category could allow the attacker to obtain sensitive information or cause a denial of service, as well as execute arbitrary code on the target. Manipulate system resources Attacks attempting to manipulate some aspect of a system’s resource state or availability accounted for three percent of all attacks. Resources include files, applications, libraries and infrastructure, and configuration information. Successful attacks in this category could allow the attacker to cause a denial of service, infect a machine to become a botnet command-and-control (C&C) server, or execute arbitrary code on the target. Employ probabilistic techniques One percent of attacks involved an attacker using what CAPEC™ describes as “probabilistic techniques to explore and overcome security properties of the target.”21 Most of the activity involved brute-force password attacks, a tactic in which an intruder tries to guess a username and password combination to gain unauthorized access to a system or data. Most of the attacks observed by X-Force targeted the Secure Shell (SSH) service. Users favor SSH because it can provide secure remote access. The downside is that it can provide attackers with shell account access across the network. Engage in deceptive interaction Less than one percent of attacks made attempts to convince a victim to perform an action through spoofing, such as in a clickjacking attack. In this type of attack, the attacker attempts to hijack the victim's click actions and possibly launch further attacks against the victim. Contents Executive overview A global view: publicly disclosed financial incidents Where are the “bad guys”? Insiders versus outsiders Prevalent methods of attack in financial services monitored clients 1 • 2 • 3 • 4 Recommendations and mitigations Protect your enterprise while reducing cost and complexity About IBM Security About the author References
  • 11. 11 ◀ Previous Next ▶ Recommendations and mitigations Never neglect training and refreshing employee awareness Foster awareness regarding BEC scams and other phishing scams through education. A variety of approaches—video, webinars, in-person instruction—can be used to educate employees. Programs that simulate phishing attacks could test employees at regular intervals. Encourage employees to report suspicious emails for further investigation. Apply a cognitive approach to detecting phishing sites The financial services industry experienced a relatively high percentage of attacks from inadvertent actors or those that unwittingly introduced threats to the target organization’s environment. Falling victim to spear phishing is one of the inadvertent actor’s biggest weaknesses. They have the power to lure employees to either download malware, opening the first door to the attackers, or lead them to a fake website where their corporate credentials will be stolen. According to IBM X-Force data, 70 percent of credentials are stolen in the first hour of a phishing attack.22 In order to react to a phishing attack quickly and accurately, machine learning and cognitive computing need to be incorporated to help boost the speed and scale of phishing detection and protection. A cognitive engine capable of helping detect relevant phishing attacks as they emerge and then alerting customers about it is now available in IBM Trusteer Rapport® . The new cognitive engine analyzes unstructured data from suspicious websites, including links, images, forms, text, scripts, DOM data and URLs. It can accurately identify a wide variety of phishing pages, including those that only present users with an image to elude content analysis and those that deliver dynamic content to the page to evade web crawlers. By analyzing text, wording and logos used on a site, it can further point out the targeted brand(s) with accuracy and discern whether the use of a logo is legitimate or suspicious. Further reduce exposure to insider threats Mitigating phishing attempts is key to reducing the threat from inadvertent actors. However, to further reduce exposure to insider threats, financial services organizations must combine data security and identity and access management solutions to protect their sensitive data and govern the access of all legitimate users. Contents Executive overview A global view: publicly disclosed financial incidents Where are the “bad guys”? Insiders versus outsiders Prevalent methods of attack in financial services monitored clients Recommendations and mitigations 1 • 2 Protect your enterprise while reducing cost and complexity About IBM Security About the author References
  • 12. 12 ◀ Previous Next ▶ The more users have access to sensitive information, the greater the chance that someone will put it at risk, either maliciously or mistakenly. Companies must ensure they are limiting access to only those users who absolutely need it, and that controls stay current as the user population changes and evolves over time. Similarly, the more easily accessed the information is, and the more places it resides, the greater the chances that an insider, or an outsider with stolen credentials, will be able to gain access to it for the wrong reasons. Solutions that include an identity manager and account-provisioning component, such as IBM Security Privileged Identity Manager, can help an organization centrally manage and audit the use of privileged IDs across different scenarios. Solutions like IBM Security Guardium® can help ensure that sensitive data is appropriately protected. Solutions such as IBM Surveillance Insight for Financial Services that adopt a proactive approach towards managing risk of non-compliant employee behavior are essential. Solutions able to ingest unstructured data—such as chat transcripts, email communications and voice recordings—and combine it with structured trade transaction data create a more robust unified surveillance system. Augment cyber security intelligence capabilities Security intelligence, a must across all industry sectors, is especially important in the financial services sector. It’s critical that organizations understand the attack vectors to which they are most vulnerable. Having this knowledge can help financial services companies stay one step ahead of criminals and bolster internal and external detection and protection mechanisms. But how do security operations teams keep pace with the myriad of threats and ever-growing number of attacks targeting their organizations? Keeping up with threat intelligence is a vital part of risk awareness. With that, the speed of threat data far exceeds human capability. Even the most skilled security professionals can have difficulty sifting through the sheer volume of security incidents and available threat data. A solution that combines cognitive capabilities and analytics, such as IBM QRadar® Advisor with Watson® , augments a security analyst's ability to identify and understand sophisticated threats by tapping into unlimited amounts of unstructured data from blogs, websites, research papers and the like, and correlating it with relevant security incidents. Contents Executive overview A global view: publicly disclosed financial incidents Where are the “bad guys”? Insiders versus outsiders Prevalent methods of attack in financial services monitored clients Recommendations and mitigations 1 • 2 Protect your enterprise while reducing cost and complexity About IBM Security About the author References
  • 13. 13 ◀ Previous Next ▶ Protect your enterprise while reducing cost and complexity From infrastructure, data and application protection to cloud and managed security services, IBM Security Services has the expertise to help safeguard your company’s critical assets. We protect some of the most sophisticated networks in the world and employ some of the best minds in the business. IBM offers services to help you optimize your security program, stop advanced threats, protect data and safeguard cloud and mobile. Security Intelligence Operations and Consulting Services can assess your security posture and maturity against best practices in security. With IBM X-Force Incident Response and Intelligence Services, IBM experts proactively hunt and respond to threats, and apply the latest threat intelligence before breaches occur. With IBM Managed Security Services, you can take advantage of industry-leading tools, security intelligence and expertise that can help you improve your security posture—often at a fraction of the cost of in-house security resources. About IBM Security IBM Security offers one of the most advanced and integrated portfolios of enterprise security products and services. The portfolio, supported by world-renowned IBM X-Force research, provides security intelligence to help organizations holistically protect their people, infrastructures, data and applications, offering solutions for identity and access management, database security, application development, risk management, endpoint management, network security and more. IBM operates one of the world’s broadest security research, development and delivery organizations, monitors billions of security events per day in more than 130 countries, and holds more than 3,500 security patents. Contents Executive overview A global view: publicly disclosed financial incidents Where are the “bad guys”? Insiders versus outsiders Prevalent methods of attack in financial services monitored clients Recommendations and mitigations Protect your enterprise while reducing cost and complexity About IBM Security About the author References
  • 14. 14 ◀ Previous Next ▶ About the author Michelle Alvarez, a Threat Researcher and Editor for IBM Managed Security Services, brings more than 10 years of industry experience to her role. Michelle is responsible for researching and analyzing security trends and developing and editing security and threat mitigation thought leadership papers. She joined IBM through the Internet Security Services (ISS) acquisition in 2006. At ISS she served as an analyst and contributed to the development of the X-Force Database, one of the world's most comprehensive threats and vulnerabilities database. For many years, Michelle played an important operational role within the Information Technology-Information Sharing and Analysis Center (IT-ISAC), a non-profit, limited liability corporation formed by members within the information technology sector. She is a regular contributor to the IBM-sponsored security blog, SecurityIntelligence.com, and has her master’s degree in information technology. For more information To learn more about the IBM Security portfolio, please contact your IBM representative or IBM Business Partner, or visit: ibm.com/security For more information on security services, visit: ibm.com/security/services Follow @IBMSecurity on Twitter or visit the IBM Security Intelligence blog Contents Executive overview A global view: publicly disclosed financial incidents Where are the “bad guys”? Insiders versus outsiders Prevalent methods of attack in financial services monitored clients Recommendations and mitigations Protect your enterprise while reducing cost and complexity About IBM Security About the author References
  • 15. 15 ◀ Previous Next ▶ 1 https://www-01.ibm.com/common/ssi/cgi-bin/ssialias?htmlfid= SE912353USEN 2 https://www-01.ibm.com/common/ssi/cgi-bin/ssialias?htmlfid= SE912353USEN 3 http://money.cnn.com/2016/05/20/news/swift-bank-attack- global-ecuador/ 4 http://www-03.ibm.com/security/xforce/xfisi/ 5 https://www.wired.com/2016/05/insane-81m-bangladesh-bank- heist-heres-know/ 6 http://www.bankinfosecurity.com/qatar-national-bank-suffers- massive-breach-a-9068 7 http://news.softpedia.com/news/lechiffre-ransomware-hits-three- indian-banks-causes-millions-in-damages-499350.shtml 8 http://www.net-security.org/secworld.php?id=19370 9 http://www.independent.co.uk/news/business/news/tesco-bank- accounts-suspended-transactions-access-frozen-hack-money- la-a7402006.html 10 http://thehackernews.com/2016/04/bank-firewall-security.html 11 https://www.hackread.com/bitcoin-exchange-ddos-attacks/ 12 http://www.databreachtoday.com/qatar-national-bank-suffers- massive-breach-a-9068 13 https://www.hackread.com/anonymous-ddos-attack-bank- greece-website-down/ 14 https://www.hackread.com/oplcarus-hacktivists-ddos-central- bank-of-cyprus/ 15 http://thehackernews.com/2016/06/ukrainian-bank-swift-hack.html 16 http://www.theregister.co.uk/2016/11/11/russian_banks_ddos/ 17 https://capec.mitre.org/data/definitions/255.html 18 https://capec.mitre.org/data/definitions/225.html 19 http://news.softpedia.com/news/76-ios-apps-including-medical- and-banking-tools-are-exposing-data-to-hackers-512693.shtml 20 https://capec.mitre.org/data/definitions/210.html 21 https://capec.mitre.org/data/definitions/223.html 22 https://securityintelligence.com/hey-phishing-you-old-foe-catch- this-cognitive-drift/ Contents Executive overview A global view: publicly disclosed financial incidents Where are the “bad guys”? Insiders versus outsiders Prevalent methods of attack in financial services monitored clients Recommendations and mitigations Protect your enterprise while reducing cost and complexity About IBM Security About the author References
  • 16. ◀ Previous Next ▶ © Copyright IBM Corporation 2017 IBM Security Route 100 Somers, NY 10589 Produced in the United States of America April 2017 IBM, the IBM logo, ibm.com, Guardium, QRadar, Trusteer Rapport, Watson and X-Force are trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the web at “Copyright and trademark information” at ibm.com/legal/copytrade.shtml This document is current as of the initial date of publication and may be changed by IBM at any time. Not all offerings are available in every country in which IBM operates. THE INFORMATION IN THIS DOCUMENT IS PROVIDED “AS IS” WITHOUT ANY WARRANTY, EXPRESS OR IMPLIED, INCLUDING WITHOUT ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND ANY WARRANTY OR CONDITION OF NON-INFRINGEMENT. IBM products are warranted according to the terms and conditions of the agreements under which they are provided. The client is responsible for ensuring compliance with laws and regulations applicable to it. IBM does not provide legal advice or represent or warrant that its services or products will ensure that the client is in compliance with any law or regulation. Statement of Good Security Practices: IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single product, service or security measure can be completely effective in preventing improper use or access. IBM systems, products and services are designed to be part of a lawful, comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective. IBM DOES NOT WARRANT THAT ANY SYSTEMS, PRODUCTS OR SERVICES ARE IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE IMMUNE FROM, THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY. Contents Executive overview A global view: publicly disclosed financial incidents Where are the “bad guys”? Insiders versus outsiders Prevalent methods of attack in financial services monitored clients Recommendations and mitigations Protect your enterprise while reducing cost and complexity About IBM Security About the author References SEL03129-USEN-00