Tech Time: Counter-espionage measures

Most cyberattacks are, essentially, espionage and call for such counter-espionage defenses as penetration testing, spying on the dark web and guarding against a ransomware attack.

Penetration testing and rotating testing companies is now routine for most credit unions, observes Mark Arnold, VP/advisory services for Denver-based Lares, a credit union-focused data security firm. What’s emerging as a best practice is staging something like a war game where a red team attacks the security barriers and a blue team defends them. Then they blend into a purple team and share what they’ve learned. The teams can be staffed by vendor security pros or by the credit union if it has the resources, he notes. “We offer ride-alongs where we do the attacking and show credit union staff how it’s done,” he explains.

$4.9 billion Veridian Credit Union, Waterloo, Iowa, regularly runs penetration tests, changing testers at least every two years. In addition to attacking networks and servers, testers try to lure staff into compromises like accepting a fake delivery or responding to a fake call from IT, notes CUES member Brett Engstrom, CIO. After five years of trying to compromise staff, the success rate has fallen to almost zero, he adds.

Penetration testing continues to be useful but limited, suggests Paul Love, chief information security and privacy officer for CUES Supplier member CO-OP Financial Services, Rancho Cucamonga, California. Traditional penetration testing is like someone outside a building probing for ways to get in. Something called “compromise testing” has emerged to take a broader assessment, looking for indications that an attacker “is now or has been on your network,” he explains.

 

continue reading »