Secure? Don't Bank on it!

It sounds like the plot for a Mission Impossible film – a man posing as an IT engineer steps up to the reception desk at a UK branch of Santander and declares he is here to install some hardware.

He was – but probably not the sort of hardware the receptionist might have been expecting.

However, he is allowed to gain access to the bank’s interior and he has already breached the first level of IT Security.

(I’m not sure if you would class the receptionist as hardware, software or perhaps part of the infrastructure – but they, and all of your people, are a fundamental part of your IT security, if not the foundation.)

With access to a PC and using what to the untrained eye looked like a normal piece of hardware (actually a device which would allow him to capture all the information that goes to the screen, keyboard and mouse of a computer), he attempts to hack into the bank’s network. 

Sticking to the script of a mainstream heist movie, the ‘engineer’ and his accomplices were caught red handed just before he was about to activate the device.  12 people have now been arrested in total.

If the device had been successful, in a worst case scenario it would have shown every single activity on the bank’s system, and the would-be hackers would have been able to contact the device from a remote location, and therefore control everything. 

Not to mention the millions of pounds at stake.

Hopefully, it would never have got to that stage, even if the device had been activated.  If the bank had all the proper monitoring and security on their systems, an alien device such as this could have been recognised immediately and action would be able to be taken.

Still, this was a significant attempt to control the bank’s systems and perhaps even scarier, the device they used was actually fairly simplistic, but could do a whole lot of damage.

At an event TSG held last year we welcomed James Lyne, Sophos’ Director of Technology Strategy to speak to our guests about the tools now available to hackers, and he demonstrated something similar to what was used in the Santander attempt.  Here’s the clip:

Minimising the risk of this sort of thing happening to your business shouldn’t be complicated.  The basic principles are the same, whether you’re a global bank or a small business with a few members of staff.

Technology certainly plays a fundamental role in your IT Security set up, but a well-defined policy and practices are just as important.

Also, hacking isn’t the ‘specialist’ art it once was.  The tools to hack are now widely available and don’t cost a huge amount – there are just people, often technically unskilled people, with the motive to steal data or money.

In fact in most of these hacking cases, it’s not just about the kit or a piece of malicious code.   Often you still need people with the brass monkeys to walk in the building and plant a device of some sort, and this is where your staff are your first line of defence.

As far as the technology side is concerned, keeping your malware protected, Anti Virus, mail defence etc. up to date is crucial.  And these days there are so many potential entry points (or ‘weak spots’) that a unified management solution (or ‘UTM’) should be the very least you have to protect yourself.

And if you want visibility of what’s going on across your IT environment, then TSG SystemCare is hard to beat.