Protecting the Financial Sector from Web-based Attacks

“Securing the browser must be the number one security priority, but doing so requires a completely different approach.”

The financial services sector continues to be a highly prized target for today’s hacker with a 40 percent increase in detected attacks in 2013 alone.

Unfortunately, the trend only continues to intensify with the number of financial services firms reporting losses greater than $10 million more than doubled last year, and the largest attacks are costing upwards of $100 million.

Even though the financial services industry has one of the strongest cyber security postures, the majority of global financial services firms still took more than 24 hours to detect compromises and remediate those threats. While attackers are often able to target and breach systems in less than a day, the average time until these attacks are uncovered often exceeds 200 days. When companies use status-quo security, leaving corporate assets exposed for days, months, and sometimes years is commonplace and seemingly unavoidable.

How is it happening?

There are many sources of risk to financial institutions but one stands out. Multiple studies have shown that over 90 percent of undetected malware infections enter through the web browser. One reason for this is that browsers have become far too complex to be free of bugs and vulnerabilities. They execute multiple types of active content, including Java Script, Java, Flash, Active X, and HTML 5. A flaw in any of these or in the browser engine itself opens the host computer to compromise and ultimately puts the enterprise at risk. These threats don’t just come from the back alleys of the Internet — a Sophos Labs study shows that over 30,000 websites are hacked per day, many due to poor best practices when developing the site.

As a result, the browser has become the Achilles’ heel of modern enterprises. Securing the browser must be the number one security priority, but doing so requires a completely different approach.

Seeking Viable Solutions

The modern threat environment calls for solutions that address vulnerabilities on multiple fronts, complimenting existing security solutions with new capabilities to contain and mitigate attacks.

Because the browser itself can’t be trusted to remain secure, it is critical to keep it isolated from the valuable data and infrastructure in the business. This ensures that any malware that penetrates the browser is contained. If it can’t access local files or processes, the attacker will not be able to take control of the local host. By isolating the attack within a small, restricted environment, nascent compromises can be quickly remediated.

In addition, the browser and any malware that comes through it can normally access any other devices on the local network. As a result, infected endpoints become patient zero in an enterprise-wide outbreak, allowing attackers to jump to and from computers, printers, external hard drives, servers, and other devices. Using a VPN inside the restricted environment terminating outside the secure perimeter can create complete network isolation, keeping all Internet traffic segregated from enterprise networks and away from internal assets.

Lastly, today’s hackers are narrowly targeting their attacks. For anyone not in the target population, the malware remains completely inert. Attackers use this clever tactic to avoid detection and maintain the utility and invisibility of their exploits for as long as possible. The financial sector is particularly subject to this kind of targeted attack. Ironically, precise targeting also opens up an opportunity for the defender. If the target can’t be identified, then the malware will ignore them.

Isolated “island” solutions are no longer appropriate for enterprise security. It is critical that all aspects of operations and security are integrated in terms of monitoring, alerting, deployment, and maintenance. Security tools need to be able to feed their monitoring data to a centralized repository where anomaly detection and alerting tools can consider a holistic view over the entire enterprise at once.

Bottom Line

Without addressing the browser the enterprise is in a perpetual cycle of attack and compromise. Threats now go beyond simple malware to highly targeted attacks, misinformation, and information leaks. The existing browser and security paradigms fail to adequately mitigate any of these vulnerabilities.