Vectra today announced that many global financial services organizations are targeted by sophisticated cyberattackers in an attempt to steal critical data and personally-identifiable information (PII).
As part of key findings in the new 2018 Spotlight Report on financial services, Vectra disclosed that cyberattackers build hidden tunnels to break into networks and steal critical data and personal information. These tunnels are used to remotely control an attack, known as command-and-control, and steal data, known as exfiltration, while remaining largely undetected.
“Cyberattackers continue to innovate by using hidden tunnels to blend in with normal traffic, evade strong access controls, and exfiltrate financial data,” said Jon Oltsik, senior principal analyst at the Enterprise Strategy Group. “The Vectra report provides insights into these attacker behaviors and details what cybercriminals are willing to do to steal personal and private financial information.”
According to the Vectra report, security breaches across multiple industries continue in an upward trajectory, and the financial services industry is no exception. But while financial services firms didn’t experience the same volume of breaches as other industries, they still face considerable risk as lucrative targets of cyberattackers in search of a windfall.
Vectra found the same type of attacker behaviors across the financial services industry as those that led to the 2017 Equifax data breach. The Equifax breach resulted in the theft of driver’s license numbers, email addresses, Social Security numbers and other personal information from 145.6 million consumers, according to a company filing with the Securities and Exchange Commission. After the breach occurred, it reportedly went undetected for 78 days.
Information in the 2018 Spotlight Report from Vectra is based on observations and data from the 2018 RSA Conference Edition of the Attacker Behavior Industry Report. The report reveals attacker behaviors and trends in networks from 246 opt-in customers in financial services and 13 other industries.
From August 2017 through January 2018, the Cognito cyberattack-detection and threat-hunting platform from Vectra monitored network traffic and collected metadata from more than 4.5 million devices and workloads from customer cloud, data center and enterprise environments. The analysis of this metadata provides a better understanding about attacker behaviors and trends as well as business risks, enabling Vectra customers to avoid catastrophic data breaches.
“Every industry has a profile of network and user behaviors that relate to specific business models, applications and users,” said Chris Morales, head of security analytics at Vectra. “Attackers will mimic and blend in with these behaviors, making them difficult to expose.”
“What stands out the most is the presence of hidden tunnels, which attackers use to evade strong access controls, firewalls and intrusion detection systems,” Morales added. “The same hidden tunnels enable attackers to sneak out of networks, undetected, with stolen data.”
Key findings from the report include:
Cognito Detect and its equally powerful AI counterpart, Cognito Recall, are the cornerstones of the Cognito platform. Cognito Detect automates the real-time detection of hidden attackers in cloud and data center workloads and user and internet-of-things devices while giving Cognito Recall a logical starting point to perform AI-assisted threat hunting and conduct conclusive incident investigations.
The data in spotlight report is based on anonymized metadata from Vectra customers who have opted to share detection metrics. The Cognito platform identifies behaviors that indicate in-progress attacks by directly monitoring all traffic and relevant logs, including traffic to and from the internet, internal traffic between network devices, and virtualized workloads in private data centers and public clouds. This analysis provides important visibility into advanced phases of attacks.