Many criminals are motivated by money, so it stands to reason that the financial services industry is one of the sectors most targeted by cybercrime. The European Central Bank (ECB) is doing what it can to thwart attacks on financial systems and has announced a new cyber-attack simulation tool.
The tool, designed for banks, stock exchanges and other financial firms is a capture the flag (CTF)–style cyber-attack simulator. ECB told Reuters, “The test objectives...are the flags that the [red team] provider must attempt to capture during the test as it progresses through the scenarios.”
Many cybercriminals leverage known vulnerabilities and are able to exploit those networks that remain unpatched, as was the case with the Equifax breach. The more determined and sophisticated attackers will patiently search for unknown flaws, which is exactly what the red teams (RTs) are doing with these types of cyber-attack simulation tools.
RT hackers come in and exploit the vulnerabilities they find so that these ethical hackers are able to identify flaws that can be fixed before a malicious actor discovers them.
Attacks on financial industries result in revenue loss, as well as information loss. According to a recently released report from Accenture, the cost of a breach in the financial sector has tripled over the past five years, making financial services crimes more costly than those in any other industry.
The 2018 IBM X-Force Threat Intelligence Index found that financial services experienced the highest volume of security incidents and the third-highest volume of attacks for the second year in a row. In 2017, injection attacks were the number-one attack vector across all industries.
“Losses due to cybercrime are a growing issue for financial organizations across the globe, and seeing this sector top the chart is not a surprise. Attackers are committing direct monetary theft from bank accounts by using phishing and credential stealing malware, as well as running malicious code to intercept online transactions,” the report said.