Insider Threats Continue to Attack Financial Services

MBA (10/3/2008 ) Palaparty, Vijay
Financial services institutions face greater data breach risk from insiders than external or partner sources, according to the 2008 Verizon Business Data Breach Investigations Report. The report also finds deceit and misuse as the most common forms of attack.

“Enterprises should assess their security strategies knowing that challenges differ significantly and that a one-size-fits-all approach is rarely effective,” said Peter Tippett, vice president of research and intelligence at Verizon Business Security Solutions, Basking Ridge, N.J., and one of the authors of the report. “Good security does not lend itself to a cookie cutter approach. Understanding what happens when a data breach occurs is critical to prevention.”
End-users were responsible for 53 percent of breaches in institutions while IT administrators accounted for 31 percent. Eight percent of breaches were instigated by agents or spies and an additional 8 percent were from anonymous sources.

Furthermore, external risks, though reported small in number among financial services institutions, were proportionately larger in North America, the report said. “This is in line with a trend among cases of more targeted, focused, multi-faceted attacks aimed at financial services institutions, especially in the United States,” it said.

Errors accounted for 45 percent of threats and attacks; deceit and misuse accounted for 42 percent and 32 percent of breaches, respectively. Hacking accounted for 26 percent of attacks and malcode accounted for 32 percent.

“In financial services institutions, hacking falls behind deceit and misuse,” Tippett said. “In general, we find a much more balanced set of tactics in use against financial firms, likely due to a more hardened security posture that makes them less vulnerable to automated attack tools.”

Web applications and physical access, which accounted for 41 percent and 35 percent of attack pathways, respectively, were most popular among attackers, the report said. In terms of difficulty of attacks, the report said financial services institutions seem more difficult to compromise. “Within other industries, preventing breaches would have required implementation of more advanced or costly controls,” it said. “Financial services firms take security very seriously and boast rather larger budgets and mature programs for managing information risk.”

Fifty-two percent of attacks were motivated by payment card data among financial services institutions. Personally identifiable information ranked second at 33 percent and authentication credentials were of interest to 27 percent of attackers. “Financial services institutions have a great deal of customer PII, particularly firms specializing in such services as data warehousing in addition to other data desirable to criminals for various reasons,” Tippett said.

“Authentication credentials, for instance, are sought after because they allow the prospect of increased privileges and access for subsequent illicit activities," Tippett said. "Criminals aren’t only interested in quick cash; compromises to intellectual property account for a substantial portion of breaches in the financial services industry.”

Fifty percent of data breaches were made aware to financial services companies through a third party. Thirty-three percent of breaches were made aware by an alert or notification by an employee, though insiders accounted for a majority of the breaches. Event monitoring or log analysis accounted for 8 percent of reporting.