A new study says financial services organizations experienced an average of 10 attacks a year and spent an average of $1.3 million to restore services after each DNS attack.
Companies managing financial services are suffering from more attacks than ever and spending millions to address the problems created by cybercriminals.
In the 2019 Global DNS Threat Report from security company EfficientIP, analysts spoke to 900 respondents from nine countries across North America, Europe, and Asia. They found that on average, companies were suffering from 10 attacks a year and were forced to spend $1,304,790 to restore services after each DNS attack.
This means institutions like banks were spending up to $13 million per year to address DNS attacks. More than 80% of companies that spoke to EfficientIP said they experienced an attack last year.
A heavy cost to businesses
Financial services were paying more than any other sector and, in 2017, they were paying $924,390 for a single DNS attack. The number of attacks in 2018 was nearly 40% higher than the year before, and almost 50% of financial services organizations told EfficientIP they were hit with DNS-based phishing scams.
"Financial services organizations have always been the gatekeepers of customers' money, providing vital services people expect to be able to use all day and night," said David Williamson, CEO of EfficientIP. "With so much at stake, the networks of financial services organizations are a predictable, prime target for DNS attacks."
SEE: Special report: A winning strategy for cybersecurity (free PDF) (TechRepublic)
The massive cost of these attacks was only one downside that respondents reported. In addition to the money it takes to restore systems, the money lost during downtime was crushing. Almost 50% of companies said they experienced cloud service downtime, and nearly 70% saw in-house application downtime.
"DNS attacks are moving away from pure brute-force to more sophisticated attacks acting from the internal network," the report said. "This will force organizations to use intelligent mitigation tools to cope with insider threats."
The GDPR effect
One positive note in the study is the effect the GDPR has had on security awareness in Europe. Organizations gave high marks to the legislation, with nearly 80% saying it spurred network security upgrades and general innovation.
More than 80% said it had an effect on how their employees understood data privacy, and 64% said they saw heightened consumer trust.
"Organizations see a positive impact from GDPR legislation, feeling it will sustain the need to deploy stronger security defenses. Ongoing data privacy compliance initiatives strategies in other countries (CLOUD Act, NISD, PDPA, etc.) will also benefit," the report said.
Security still lags
The more startling aspects of the report have to do with prevention. Almost 70% of responding organizations had security systems that did not perform any DNS traffic analysis for their internal threat intelligence program. About half of all companies that spoke to EfficientIP said they were using little to no automation in their security systems.
"What is a surprise is these organizations are not amplifying their security measures. They are big targets with costly breaches coming thick and fast," Williamson added. "As our research shows, DNS security is a business imperative for the financial sector if hackers are to be kept at bay and to prevent services from caving in on themselves."
Cybersecurity Insider Newsletter
Strengthen your organization's IT security defenses by keeping abreast of the latest cybersecurity news, solutions, and best practices. Delivered Tuesdays and Thursdays
Sign up today Sign up today
0 Comments