Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

From reading a lot of info on this website I came to the conclusion that if someone with enough skill really badly wants to gain access somewhere, then there is absolutely nothing stopping them from doing so. Additionally I learned that getting access to a company computer is much easier than a singular computer at home.

However I am completely confused. What exactly prevents someone from for example, stalking one(or more) of the bank employees, getting information on them and then gaining access into their system? As far as I have seen financial fields have one of the most soul sucking programming tasks which usually end up in small amount of security holes. So what would prevent someone from waltzing into the bank's system, causing gigantic chaos (not for sake of stealing money, but for sake of screwing them up), and then walk out.

For example I know from internal sources that this has one of the worst security methods implemented. This makes me assume that this is not the first software that a bank would release that would allow data to be stolen and/or modified.

Does this actually happen but the banks do not care because they suffer very small damages? Or is a bank completely impossible to get into and destroy data?

share|improve this question
17  
In a nutshell: your premise is invalid: banks do get hacked. However, they have a lot of infrastructure in place to trace the perpetrators, to keep going if a subsystem fails, and to put a muzzle on people reporting incidents. Also, compared with their total budget, the damages do end up fairly small most of the time. –  Gilles Nov 7 '13 at 21:26
    
If someone with enough skill really badly wants to gain access... - Well, what is enough skill to break into, let's say, some Google servers? And if you have that amount of skill, you already work there. –  Jeyekomon Nov 7 '13 at 22:23
    
They don't? That's news to me... Citation please. –  Fiasco Labs Nov 8 '13 at 2:43
    
Even if you do manage it, get caught and you're in big trouble. And just as there's no 100% solid way to secure an organisation, there's no 100% solid way to hide an infiltration. –  AlbeyAmakiir Nov 8 '13 at 5:24
    
They do, often, but not usually seriously. They have massive amounts of security measures in place, and a key part of this is the early detection of attacks. By noticing sooner they limit damage, and what they lose they write off. One of the most valuable system cracks of all time was CitiBank, when their VAX/VMS system was hacked in the 80s. –  Owen Nov 8 '13 at 14:32

7 Answers 7

up vote 16 down vote accepted

I think it's fair to say that the idea that any large organisation is entirely impervious to attack has been proven false over the last five years or so. Everyone from nation states through large corporations, security consultancies and other security minded companies have had breaches.

One reason that a bank hasn't been thrown into "complete chaos" as you put it is likely down to a combination of the security measures they have in place to react to attacks, the size and complexity of their systems and the motivations of people who have the resources to effectively attack them.

If you think about people who are most motivated to attack banking systems, it's criminals who want to steal money from them. From their perspective there's no reason to cause chaos, they want to get in, steal things and get away without being noticed, if possible.

share|improve this answer
    
So no one has ever attempted to try and just destroy it as a practice challenge? And you are saying then that banks are just good at recovering rather than protecting data? –  Quillion Nov 7 '13 at 21:43
1  
Exactly, recovery is an important part of business continuity management –  Lucas Kauffman Nov 7 '13 at 21:54
1  
@Quillion what I'm saying is that the level of resources and skills necessary to completely destroy a large/complex organisation like a bank aren't something many/any actors would waste on a "practice run" :) I would say that banks are (relative to other organisations) good at protecting and recovering. but these days protection is not absolute so recovery becomes more important.. –  Rоry McCune Nov 7 '13 at 21:57
1  
Also helps that banks are still running really old hardware like AS/400 for core payment processing, which most regular blackhat folk don't have much experience with ;) –  Polynomial Nov 7 '13 at 22:09
1  
Oh, and things like PCI-DSS help control the isolation of payment systems, too. –  Polynomial Nov 7 '13 at 22:11

To turn a quick profit, It is easier to go after end users. This is why there are so many phishing attacks and password stealing Trojans.

Banks internet-facing operations tend to be well secured. The internal office environments less so, although they tend to have good AV. This stops casual metasploit users, although an advanced attacker with zero day exploits could readily compromise an internal workstation through the browser, and proceed to a major attack.

I expect at the moment both the NSA and Chinese have large scale hacks at many banks around the world. But they wouldn't be so crass as to just wipe the bank. It's far more valuable to quietly sit and harvest data. If they did decide to wipe the bank, there would be backups, but it would be incredibly hard to resume day-to-day operations - your looking at weeks even with crack teams of contractors on it. The bank would be commercially destroyed.

I read that during the 2nd gulf war the US could have done this to Iraqi banks, but they made a strategic decision not to.

It's a scary world out there :)

share|improve this answer
    
Do you have some source about the 2nd gulf war? I would be interested in reading more on this. –  Marc-Andre Nov 8 '13 at 14:07
    
@Marc-Andre there's some info here: infosecisland.com/blogview/… I originally read about this on the Dailydave list, which is worth following. –  paj28 Nov 8 '13 at 14:11
    
Thanks a lot to you! –  Marc-Andre Nov 8 '13 at 14:14

When one secure a box, he puts several defenses layer so, would some "hacker" defeat a protection, the immediate consequences will be limited, and by the time a defeats the next following protection layers his action will hopefully be detected and neutralized.

This is for a simple box. Now with a bank which is one of the largest international institution, main body of the financial system, you just multiply these layers at the whole company level, and restrict at the minimum the interaction within them, and for each interaction you define very strict procedures imposing that, the most potential impact has this interaction, the most people must be involved (in such domains the four-eyes principle is widely applied).

By distributing widely the responsibilities and the data, you distribute the power, so when a part of the bank gets hacked (or if an employee turns against the system) it provides very little power so the few backup restoration and access cancellation would most likely annihilate the damages.

However, no system can never be taken as 100% safe, and that's why what you describe just happens from time to time. For instance, here in France, just a few years ago a trader defeated these protections and caused a loss of 4.9 billions of dollars to his bank (see Jérôme Kerviel ; interesting to note that the most critical danger are not external hackers as one may think, but internal employees...), and yes, as you said, it was a "gigantic chaos".

So, to answer your question, banks actually get hacked, as any other information systems, but hopefully due to their size this does not happens very often.

share|improve this answer
1  
Jerome Kerviel example is bad, he just used bots to deals automatically, and they end up screwing everything up. (Unhauthorized trading != taking the system) –  DrakaSAN Nov 8 '13 at 11:53
    
@DrakaSAN: bots used to deal automatically are just, as far as I know, daily tools for nowadays traders (see high frequency trading ). Jérôme Kerviel used forged emails to gain privileges and avoid some human controls, and exploited the system to insert non-existent operations in order to counter balance his own and avoid automatic controls. Yes, maybe he did not got 'root' privilege on any server, however I think that such kind of actions are not as off-topic as that... –  GZBK Nov 8 '13 at 13:35
    
Interesting, I didn t knew he had gone that far, don t know how to say it in english so in french: "je retire ce que j ai dit". Thanks for the info. –  DrakaSAN Nov 8 '13 at 14:15
    
Here's the fixed link en.wikipedia.org/wiki/J%C3%A9r%C3%B4me_Kerviel –  Thomas Eding Nov 9 '13 at 17:22
    
@ThomasEding: Thank you, copy-paste issue now rectified in my post, now Jérôme Kerviel name correctly links to the english page. –  GZBK Nov 10 '13 at 9:42

While it sounds odd to someone who is focused only on the technical aspects of hacking into a bank, one reason banks are more secure than many organizations is that they have a comprehensive set of information security policies. These policies guide the organization through many areas that help protect their customers.

A good example is a policy that defines exactly who should have access to what information. By ensuring that only the people in department X can edit the accounts, they limit the ability of an attacker who might be trying to social engineer his way into the accounts. Another policy might be that all passwords are 16+ characters long, and another might state that people with access to cash may not have access to systems, etc. They could have policies on firewalls, IDP devices, USB devices, smart phones, Wi-Fi authentication, etc. A bank might have dozens or even hundreds of these policies.

It's all part of an overall strategy called "defense in depth". Just as you wouldn't call a bank secure simply because their fence gate is locked, you don't rely only on firewalls to stop attackers.

share|improve this answer

Let's debunk a misconception: banks do get hacked, they are just (way) more controlled then the average company. From my experience as a penetration tester, it is not unusual for banks and financial firms to have vulnerable systems, but there are elements that make them harder to succesfully attack.

First of all, banks usually respect the minimum privilege principle, reducing the people allowed to do certain tasks (critical or not) to a limited group. This practice effectively reduces phishing capabilities and also provides a specific perimeter whenever a problem arises (e.g. attack, fraud).

Furthermore, specific country laws often require banks to thorougly monitor and log activities on their systems, making it harder to perform an attack without being detected in a short amount of time. Also consider that money trails can be followed and stopped (within certain limits) if considered fraudolent.

Finally, banks usually perform several security assessments of their critical applications, especially the ones exposed on the Internet and used by their clients. This effectively lowers the risk of getting hacked, but doesn't eliminate the risk entirely.

In the end, no system is completely secure and the human factor can indeed be the weak link. However, in a heavily controlled environment, such as the one found in banking companies, the efficacy of attacks (external and internal) is mitigated by the severe security implemented.

share|improve this answer

The critical resource assuring the security of banks is, surprisingly, not technical at all. :)

Most importantly, banks maintain large internal security departments staffed with considerable number of security specialists. Banks are more or less the only organizations who are capable of footing the bill for this sort of operation.

The rest is rather simple: internal security guys are constantly performing audits and security stings. In fact, bank fraud instigated by employees is very common (dozens of cases per year per bank), but we seldom hear of these things, because normally fraud is rather quickly identified by the security guys, damage reverted and the offenders get kicked out (in a fairly hush hush manner, as to not spoil the bank reputation).

To summarize, the technology is not quite ready yet to solve social problems, thus big battalions and good shots are still necessary to maintain proper security.

share|improve this answer

Banks usually buy huge systems to prevent these kinds of attacks and discover vulnerabilities with a click of a button (Qualys for example). Money isn't a problem when it comes to banks. Mostly they do not need high skilled personnel to defend their systems.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.