Financial sector faces era of cyber mega heists

Full data sets

Full data sets are valuable commodities on the underground market and can be used for a wide range of crime, including fraud and financial account take-overs.

In the past 18 months, said Oerting, there has been much more aggressive use of advanced malware tools in attacks targeting several areas of business activity at financial institutions.

“These tools now also include the capability to detect surveillance cameras inside banks, which indicates a convergence of physical and cyber crime,” he said.

This trend requires organisations to think of security more broadly and to consider all aspects of security together, so the physical and cyber aspects of an attack can be linked more easily.

Another key trend in cyber attacks by elite crime groups is that they are aiming to penetrate organisations more deeply and with more stealth than before.

“Advanced persistent threats (APTs) are not the exception any more, they are more the general rule when it comes to this group of attackers,” said Oerting.

Wide range of techniques

Adversaries are using a wider range of techniques, from detectable malware to complex database manipulation and human behaviour-mimicking components, threat researchers have found.

“These, used in combination with stolen user credentials, pose a significant challenge to traditional security systems, which are no longer adequate to deal with the threat,” said Oerting.

A new approach is needed in view of the fact that malware is now being designed to target at the service or application level, he said.

“Malware such as the Dridex Trojan – which is emerging as the mother of all malware – is extremely complex and is increasingly updated to provide more services to elite crime groups,” said Oerting.

“We are also seeing an increase in the use of things like fileless malware and attacks that use legitimate admin tools such as Microsoft’s Windows PowerShell configuration management framework.”

Significant threat

According to financial sector researchers, criminal groups aligned with nation states also pose a significant threat at the high end of cyber crime.

“This more professional approach to cyber crime by elite groups is a growing concern,” said Oerting, adding that this is something financial institutions are having to deal with on top of the normal, lower-level attacks.

In the face of these new elite crime groups, Oerting believes that just as chief information security officers have had to evolve from being purely technical to look at people and processes in the security context, they now have to move to a broader, more comprehensive view of security that combines physical and cyber security.

“Criminals will use any means they can to achieve their aims, so that means we can no longer consider physical and cyber security separately, but instead need an end-to-end view on security,” he said.

Using this approach, organisations should first seek to identify their “crown jewels”, where that data resides and who has access to it, and then put adequate protection around it and ensure there is a high level of “cyber hygiene” across the organisation.

Next, organisations must focus on building security by design into all products, services and processes.

“The third thing organisation need to ensure they are doing is educating staff so that security is part of the corporate culture, and finally formalise a broader view of security,” said Oerting.

This is what Barclays has done by broadening Oerting’s role as group chief information security officer to include all security.

“I now have responsibility for physical security, cyber security, group intelligence, group investigations and group resilience because it is all about resilience,” he said. “But to provide that, you need to look at your physical security, not just your cyber security.

“If criminals are unable to achieve their aims because our cyber defences are too strong, then they will look for ways around that, such as uploading malware internally either by getting physical access to the network or using blackmail or some other means to get an insider to do it for them.”

Oerting also believes banks need to work even more closely together to fight a common enemy by sharing as much information about attackers and attack methods as possible.