Feeds

'Most US banks' were DDoSed last year - survey

One in 10 banking IT bods say 'budget constraints' an issue

Intelligent flash storage arrays

Nearly two-thirds of retail banks experienced at least one distributed denial of service (DDoS) attack in the past year, according to a new survey.

In a new report, (12-page/941KB PDF) commissioned by Corero Network Security, 64 per cent of 650 IT and IT security experts from 351 banks said a DDoS attack had been carried out on the financial institution they work for. More than 10 DDoS attacks were carried out on 7 per cent of banks, it said. DDoS attacks typically involve hackers using malware-infected computers to bombard systems with such large amounts of traffic that they cease to function.

Only 37 per cent of respondents described their banks' ability to prevent DDoS attacks as effective or very effective, whilst the remainder said the measures in place were either somewhat effective (30 per cent), not effective (23 per cent) or unsure about how effective they had been (10 per cent). Fewer than half (43 per cent) said that their institutions' efforts to detect DDoS attacks were either effective or very effective.

Half of the respondents to the survey, which was conducted by the Ponemon Institute on behalf of Corero, said that the "most critical barrier to preventing DDoS attacks" was either banks having insufficient personnel and in-house expertise (26 per cent) or inadequate or insufficient technologies (24 per cent), whilst a further 15 per cent said budget constraints were the biggest barrier to stopping such attacks.

The Ponemon Institute said that it estimated that each retail bank experienced an average of 2.8 DDoS attacks in the last year. It added that 78% of respondents to its survey expect DDoS attacks to continue or significantly increase in 2013.

"It really comes as no surprise that DDoS attacks are one of the most severe security risks cited by the banking industry and these results clearly demonstrate the level to which they are being targeted on a continued basis,” Dr Larry Ponemon, chairman and founder of the Ponemon Institute, said in a statement. "When such an attack occurs, the time and efforts of IT staff are devoted to dealing with the problem instead of managing other IT operational and security priorities. This leaves financial institutions open to more dangerous attacks that further compromise their infrastructure."

The survey respondents said that banks were most commonly relying on traditional firewall protections and on-premises anti-DDoS technology to repel DDoS attacks, but Marty Meyer, president of Corero, warned that those measures may not be provide sufficient defence.

"The belief that traditional perimeter security technologies such as firewalls are able to protect against today’s DDoS attacks is lulling not only financial institutions but organisations across every sector into a false sense of security," said Meyer said. "Many organisations assume traditional firewalls can provide protection against DDoS and Zero-Day exploits at the perimeter, yet this is not what they were designed to do and therefore attacks are still getting through."

"Organsations need to add first line of defence solutions that can provide this protection and are able to remove all of the ‘noise’ at the perimeter before it hits the network so that firewalls and servers can optimally work on the functions they were originally designed for," he added.

The survey respondents had classed 'Zero-Day' attacks as the most severe security threat facing banks. The term refers to attacks that exploit a previously unknown weakness in organisations' systems.

Copyright © 2012, Out-Law.com

Out-Law.com is part of international law firm Pinsent Masons.

Intelligent flash storage arrays

More from The Register

next story
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
Oi, Europe! Tell US feds to GTFO of our servers, say Microsoft and pals
By writing a really angry letter about how it's harming our cloud business, ta
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.