Banking & Insurance
Context
Cybercrime has become a major threat for all companies, now far exceeding traditional crime. With the digital revolution, financial institutions are now more than ever subject to this kind of threat, which has been mentioned twice (“data or money theft” and “blocking operations or infrastructure”) among the top 5 global risks, alongside geopolitical risks.
Intrusion into financial institutions’ IT systems has tripled between 2012 and 2017, according to a study conducted by Accenture and the American research institute Ponemon (03/2018) among 254 companies in seven countries (France, Italy, Japan, United States, Germany, Italy, Australia).
The banking supervisors pay particular attention to this subject, which is considered as a systemic risk. The financial institutions are invited to integrate this type of risk into the calculation of capital by quantifying Cyber risk scenarios as well as in their business continuity plans and to strengthen controls on systems. It is essential to provide a level of system protection adapted to these new threats above and beyond these necessary measures.
Types of threats
Over the last few years, two famous cases have appeared in the news. The first is the Carbanak attack, with the theft of more than €1 billion from about 100 financial institutions in around 40 countries. The second was the attack on the Bangladesh central bank via SWIFT.
Most of these attacks are based on the takeover of employees’ workstations, which are used to bounce to vulnerable systems or to place payment orders using the financial institution’s usual tools, after a silent observation period of several weeks.
The most notorious illustration of this case is NotPetya, which has led to the complete shutdown of several companies in several countries by rendering all computer systems (workstations and servers) inoperative. The strike was devastating, and a French company lost around 10,000 systems in less than 2 hours.
This type of attack is based on the same principle as ransomware (ransom request after encryption of files) except that it does not offer a decryption key. NotPetya exploited so-called “lateral” infections (which spread directly from an infected system to a healthy adjacent system), which increased the rate of infection.
TEHTRIS protects the banking & insurance sector
In response to sophisticated new attack techniques, which are continuously being improved, traditional defenses, such as firewalls, anti-intrusion systems and anti-virus systems, have shown their limits. Especially when they are bypassed to make an attack undetectable within authorized flows. There is therefore a need for a defense system adapted to new forms of attacks, known or unknown.
That is what TEHTRIS offers through its XDR Platform cyber defense arsenal, which is designed to be the ultimate weapon against cyber attacks by combining Endpoint Detection and Response (EDR) functions with subsequent intrusion detection features: workstation audit, event correlation (SIEM) both on the network and on systems, implementation of “honeypots” (fake servers that can detect an intrusion on the network). Furthermore, TEHTRIS XDR Platform is capable of detecting vulnerabilities that could be exploited on systems.
