78% of Russian financial companies are unable to withstand a large-scale cyberattack.
This follows from the analytical survey of Positive Technologies (Izvestia have its results). Banks don’t know how to behave in case of such an incident, where to go and what documents to prepare, experts told Izvestia. Credit institutions themselves claim that everything isn’t so bad and the number of hacker attacks is decreasing.
Not armed
According to a report by Positive Technologies, only 22% of respondents from the financial industry believe that their company is ready to repel powerful and long-lasting cyber attacks. 54% of participants noted that investigations of incidents are carried out by own power, although half of them aren’t sure that the qualification of their specialists is enough. The main goal of hackers is to steal money. This is the answer chosen by 76% of the survey participants. The second most popular goal is data theft or spy (63%). Respondents could choose more than one answer.
The most common and effective way to penetrate the corporate network is to send emails containing malware (phishing). According to Positive Technologies, 75% of Russian banks are vulnerable to such attacks.
Representatives of the financial sector can be attacked in tens and even hundreds of times more often than companies from other industries, said Andrey Arsenyev, the head of the Department of Analytics and special projects of InfoWatch. This is due to the fact that banks and financial institutions have monetary resources and large volumes of client information.
Without panic
The situation is not as bad as it may seem at first glance, bankers say that most credit institutions are protected from cyber attacks. A very small part of hackers reach their goals, said the representatives of VTB Bank, Rosbank and Otkritie Holding. According to Vyacheslav Yashkin, Director of the information security Department of AK Bars Bank, no more than 0.1% of attacks are successful.
Credit institutions that devoted to a risk-oriented approach and spend money on their security, as a rule, are well protected, said Vyacheslav Kasimov, Director of the information security Department, Credit Bank of Moscow. But banks, which follow only the rules prescribed in certain standards, have a high risk of becoming victims of cyber attacks, he added.
The Central Bank didn’t answer the question about the degree of protection of Russian banks.
Better to keep silence
Now financial institutions are obliged to report incidents only to the regulator. But in Russia there is no law requiring the disclosure of information to the wide public about cyber attacks, so there are no statistics in the public domain, said the representative of the company Doctor Web. No one likes to take a trash out of the house, he explained, but there have been cases when a a cyber incident did a huge damage to the large bank or an insurance company .
According to Oleg Gubka, business development director of the information security company Avanpost, the bank from the top 100 failed to provide a loan, because the client received a more favorable offer from a rival bank in all respects (except for the price), repeating the original offer. With the help of a cyberattack, competitors were able to gain access to confidential information about the details of the upcoming deal.
According to a survey by Kaspersky company, two-thirds of financial institutions in Russia already use or plan to start using in the next year services to investigate and eliminate the consequences of cyber incidents.