Feeds

'Most US banks' were DDoSed last year - survey

One in 10 banking IT bods say 'budget constraints' an issue

The Power of One eBook: Top reasons to choose HP BladeSystem

Nearly two-thirds of retail banks experienced at least one distributed denial of service (DDoS) attack in the past year, according to a new survey.

In a new report, (12-page/941KB PDF) commissioned by Corero Network Security, 64 per cent of 650 IT and IT security experts from 351 banks said a DDoS attack had been carried out on the financial institution they work for. More than 10 DDoS attacks were carried out on 7 per cent of banks, it said. DDoS attacks typically involve hackers using malware-infected computers to bombard systems with such large amounts of traffic that they cease to function.

Only 37 per cent of respondents described their banks' ability to prevent DDoS attacks as effective or very effective, whilst the remainder said the measures in place were either somewhat effective (30 per cent), not effective (23 per cent) or unsure about how effective they had been (10 per cent). Fewer than half (43 per cent) said that their institutions' efforts to detect DDoS attacks were either effective or very effective.

Half of the respondents to the survey, which was conducted by the Ponemon Institute on behalf of Corero, said that the "most critical barrier to preventing DDoS attacks" was either banks having insufficient personnel and in-house expertise (26 per cent) or inadequate or insufficient technologies (24 per cent), whilst a further 15 per cent said budget constraints were the biggest barrier to stopping such attacks.

The Ponemon Institute said that it estimated that each retail bank experienced an average of 2.8 DDoS attacks in the last year. It added that 78% of respondents to its survey expect DDoS attacks to continue or significantly increase in 2013.

"It really comes as no surprise that DDoS attacks are one of the most severe security risks cited by the banking industry and these results clearly demonstrate the level to which they are being targeted on a continued basis,” Dr Larry Ponemon, chairman and founder of the Ponemon Institute, said in a statement. "When such an attack occurs, the time and efforts of IT staff are devoted to dealing with the problem instead of managing other IT operational and security priorities. This leaves financial institutions open to more dangerous attacks that further compromise their infrastructure."

The survey respondents said that banks were most commonly relying on traditional firewall protections and on-premises anti-DDoS technology to repel DDoS attacks, but Marty Meyer, president of Corero, warned that those measures may not be provide sufficient defence.

"The belief that traditional perimeter security technologies such as firewalls are able to protect against today’s DDoS attacks is lulling not only financial institutions but organisations across every sector into a false sense of security," said Meyer said. "Many organisations assume traditional firewalls can provide protection against DDoS and Zero-Day exploits at the perimeter, yet this is not what they were designed to do and therefore attacks are still getting through."

"Organsations need to add first line of defence solutions that can provide this protection and are able to remove all of the ‘noise’ at the perimeter before it hits the network so that firewalls and servers can optimally work on the functions they were originally designed for," he added.

The survey respondents had classed 'Zero-Day' attacks as the most severe security threat facing banks. The term refers to attacks that exploit a previously unknown weakness in organisations' systems.

Copyright © 2012, Out-Law.com

Out-Law.com is part of international law firm Pinsent Masons.

Designing a Defense for Mobile Applications

More from The Register

next story
DARPA-derived secure microkernel goes open source tomorrow
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.