Protecting Financial Institutions from DDoS Attacks

DDoS attacks on financial institutions continue to be a major threat for businesses and administrative agencies across the internet. For financial institutions, the need to protect themselves from the security issues present in distributed denial of service (DDoS) attacks is a critical business requirement.

The financial industry is a longstanding target for application and network layer DDoS attacks. Despite the emergence of newer industries like bitcoin and the continued rise in attacks on crypto-currency, the threat remains in the financial sector. Targeted and botnet attacks cause slow website response times and prevent customers from accessing their online banking and trading websites. The attacks also serve as diversionary tactics by criminals looking for ways to compromise sensitive data, commit fraud and steal private and financial data.

DDoS Services: More Available, with More Persistent Attacks

According to analysis from the Global DDoS Threat Landscape Q4 2017 report, both network layer and application layer DDoS attacks are getting more persistent. The report points to the growing ease with which bad actors can launch multiple DDoS attacks.

In addition, botnet-for-hire services are now readily available for anyone to purchase. These malicious programs provide the foundation for launching a potentially devastating distributed denial of service attack on a financial institution. DDoS attacks can make banking websites unavailable resulting in lost revenues, reputation damage and a loss in customer confidence. If a bad actor’s intent is fraud, a financial agency may also experience liquidity and capital risks.

As a response to the attacks, the Federal Financial Institutions Examination Council (FFIEC) requires banks and similar institutions regulated by the US federal government to periodically monitor their networks for DDoS attacks. The Council recommends a checklist of steps to address the problem including setting up a program to assess risk to IT systems, monitoring internet traffic to the institution’s website to detect attacks and being prepared to activate incident response plans with internet service providers (ISP). More than anything else, the FFIEC regulations encourage financial agents to hire pre-contracted third-party vendors for help managing internet-based traffic flow seen with DDoS attacks.

Automatic Mitigation of Repeat Attacks

Even though the threat of DDoS attacks on websites and network server resources persists, there are a number of ways that financial institutions can block and mitigate these attacks. For more details about best practices and a way to ensure automatic mitigation of repeat attacks, read our whitepaper Protecting Financial Institutions from DDoS Attacks.

Whether you’re looking to strengthen your security posture or get information on how to keep your website highly available and improve user experience, the paper explains in detail the different DDoS threats and discusses reliable and road-tested mitigation strategies.