While it may not seem too surprising, but 64 percent of 650 IT and IT security experts from 351 banks said they suffered some sort of distributed denial of service (DDoS) attack at the financial institution they work for, a new survey said.
DDoS attacks typically involve hackers using malware-infected computers to bombard systems with such large amounts of traffic that they cease to function.
Only 37 percent of respondents described their banks’ ability to prevent DDoS attacks as effective or very effective, while the remainder said the measures in place were either somewhat effective (30 percent), not effective (23 percent) or unsure about how effective they had been (10 percent), according to the survey by the Ponemon Institute and commissioned by Corero Network Security. Fewer than half (43 percent) said their institutions’ efforts to detect DDoS attacks were either effective or very effective.
Half of the respondents to the survey said the “most critical barrier to preventing DDoS attacks” was either banks having insufficient personnel and in-house expertise (26 percent) or inadequate or insufficient technologies (24 percent), while 15 percent said budget constraints were the biggest barrier to stopping such attacks.
The Ponemon Institute said it estimated each retail bank experienced an average of 2.8 DDoS attacks in the last year. It added 78 percent of respondents to its survey expect DDoS attacks to continue or significantly increase in 2013.
“It really comes as no surprise that DDoS attacks are one of the most severe security risks cited by the banking industry and these results clearly demonstrate the level to which they are being targeted on a continued basis,” said Dr. Larry Ponemon, chairman and founder of the Ponemon Institute. “When such an attack occurs, the time and efforts of IT staff are devoted to dealing with the problem instead of managing other IT operational and security priorities. This leaves financial institutions open to more dangerous attacks that further compromise their infrastructure.”
The survey respondents said banks were most commonly relying on traditional firewall protections and on-premises anti-DDoS technology to repel DDoS attacks, but Marty Meyer, president of Corero, warned those measures may not be provide sufficient defense.
“The belief that traditional perimeter security technologies such as firewalls are able to protect against today’s DDoS attacks is lulling not only financial institutions but organizations across every sector into a false sense of security,” Meyer said. “Many organizations assume traditional firewalls can provide protection against DDoS and Zero-Day exploits at the perimeter, yet this is not what they were designed to do and therefore attacks are still getting through.”
“Organizations need to add first line of defense solutions that can provide this protection and are able to remove all of the ‘noise’ at the perimeter before it hits the network so that firewalls and servers can optimally work on the functions they were originally designed for,” he added.
The survey respondents had classed Zero Day attacks as the most severe security threat facing banks.