Feeds

'Most US banks' were DDoSed last year - survey

One in 10 banking IT bods say 'budget constraints' an issue

Securing Web Applications Made Simple and Scalable

Nearly two-thirds of retail banks experienced at least one distributed denial of service (DDoS) attack in the past year, according to a new survey.

In a new report, (12-page/941KB PDF) commissioned by Corero Network Security, 64 per cent of 650 IT and IT security experts from 351 banks said a DDoS attack had been carried out on the financial institution they work for. More than 10 DDoS attacks were carried out on 7 per cent of banks, it said. DDoS attacks typically involve hackers using malware-infected computers to bombard systems with such large amounts of traffic that they cease to function.

Only 37 per cent of respondents described their banks' ability to prevent DDoS attacks as effective or very effective, whilst the remainder said the measures in place were either somewhat effective (30 per cent), not effective (23 per cent) or unsure about how effective they had been (10 per cent). Fewer than half (43 per cent) said that their institutions' efforts to detect DDoS attacks were either effective or very effective.

Half of the respondents to the survey, which was conducted by the Ponemon Institute on behalf of Corero, said that the "most critical barrier to preventing DDoS attacks" was either banks having insufficient personnel and in-house expertise (26 per cent) or inadequate or insufficient technologies (24 per cent), whilst a further 15 per cent said budget constraints were the biggest barrier to stopping such attacks.

The Ponemon Institute said that it estimated that each retail bank experienced an average of 2.8 DDoS attacks in the last year. It added that 78% of respondents to its survey expect DDoS attacks to continue or significantly increase in 2013.

"It really comes as no surprise that DDoS attacks are one of the most severe security risks cited by the banking industry and these results clearly demonstrate the level to which they are being targeted on a continued basis,” Dr Larry Ponemon, chairman and founder of the Ponemon Institute, said in a statement. "When such an attack occurs, the time and efforts of IT staff are devoted to dealing with the problem instead of managing other IT operational and security priorities. This leaves financial institutions open to more dangerous attacks that further compromise their infrastructure."

The survey respondents said that banks were most commonly relying on traditional firewall protections and on-premises anti-DDoS technology to repel DDoS attacks, but Marty Meyer, president of Corero, warned that those measures may not be provide sufficient defence.

"The belief that traditional perimeter security technologies such as firewalls are able to protect against today’s DDoS attacks is lulling not only financial institutions but organisations across every sector into a false sense of security," said Meyer said. "Many organisations assume traditional firewalls can provide protection against DDoS and Zero-Day exploits at the perimeter, yet this is not what they were designed to do and therefore attacks are still getting through."

"Organsations need to add first line of defence solutions that can provide this protection and are able to remove all of the ‘noise’ at the perimeter before it hits the network so that firewalls and servers can optimally work on the functions they were originally designed for," he added.

The survey respondents had classed 'Zero-Day' attacks as the most severe security threat facing banks. The term refers to attacks that exploit a previously unknown weakness in organisations' systems.

Copyright © 2012, Out-Law.com

Out-Law.com is part of international law firm Pinsent Masons.

Mobile application security vulnerability report

More from The Register

next story
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.