Following the news that Wonga, the payday lender has experienced a data breach that may affect up to ‘245,000 UK customers’, IT security experts from SailPoint, McAfee, ViaSat Europe, Tenable Network Security, ESET, Micro Focus, Netskope and F5 Networks commented below.
Kevin Cunningham, President & Co-Founder at SailPoint:
“Businesses house more and more sensitive data, therefore everyone from the executive level down needs to ensure there is a collaborative effort from internal staff to protect sensitive customer information and ultimately, the health and longevity of the company.
“In today’s market, it’s a matter of when, not if, a data breach will happen. So the most important factors are prevention, education, and rapid response. When a breach does happen, it’s important to quickly find out how and why it occurred, assess the damage and required response, and put IT controls in place to address future attacks. This is where identity and access management solutions can help, because they can address the immediate pain while also identifying – and mitigating – other areas of exposure.”
Raj Samani, Chief Scientese at McAfee:
“As the financial services industry becomes increasingly digital, corporations need to consider increasingly digital security solutions, such as artificial intelligence and machine learning. This will help protect against current cybercrime tools and tactics, while empowering the financial services industry to detect the next wave of cybercrime – based on intricate analysis of cybercriminals’ behaviour – and remediate these threats as soon as they launch.
“But this can’t operate in silo. The whole industry needs to be thinking about how they evolve to share intelligence. Security is not a competition point.”
Marc Agnew, Vice President at ViaSat Europe:
“The stakes are so high that organisations need to treat cyber-attack not only as a threat, but as an inevitability. Organisations must therefore ensure that all customer data is encrypted, not just the passwords and card details, so that any stolen data is essentially worthless. Inadequately protecting customer data can create massive problems for enterprises and consumers alike. Reacting to an attack appropriately is vital; from isolating and identifying the origin, to taking stock of what has been stolen or affected and making sure those who have been put at risk are notified and protected as soon as possible. By the looks of it, Wonga’s customers were alerted in a timely manner and should be well informed enough to take action. This is all Wonga can do at this stage, but it’ll be interesting to see what happens next and how serious an attack this turns out to be.”
Gavin Millard, Technical Director EMEA at Tenable Network Security:
“A favorite trick by scam artists is to use the data swiped to build up trust and credibility with a target to then request further information they don’t have, so customers should be extra careful dealing with unsolicited calls irrelevant of who they claim to be.”
Mark James, Security Specialist at ESET:
“If we want to use services supplied by others – whether it’s watching a film or borrowing money, we have to trust the company involved. We give them our details, they tell us how they value us as a customer and we get the goods. What more can we do? In theory, nothing – we just have to take them at their word as we have no direct control over how they store our data, what measures are in place to protect our data if it should end up in the wrong hands. All data has a value and the most common data found on the internet is usually the data we cannot change: names, dates of birth, addresses and phone numbers, all of which can be used to phish for more data or attempt identify fraud or theft. Our financial records of course are a little different as this data can be used to directly target your money. If enough data is obtained it may be possible to steal funds directly from your account or in some cases make changes to your account that could enable the attacker to pretty much do as they please. Of course in most cases we can get the money back but it’s the inconvenience of having cards and accounts changed or even frozen while that’s happening.
“If you find yourself concerned or even the victim of a data breach you should contact your bank immediately. Change any passwords for internet or mobile banking and be extra careful when contacted via email, or indeed any kind of messaging process and ensure that you validate who you are talking to. If you’re not 100% sure of the person you’re talking to, be polite, hang up and contact them yourself through an alternate method (if possible in person). Your banks understand the pressure of scammers and they want you to be safe so you should not be penalised for taking extra precautions and in most cases they should encourage it.”
David Mount, Director, Security Solutions Consulting EMEA at Micro Focus:
“While there is a perception that cyberattacks are perpetrated by a teenage lone wolf in their bedroom, the reality couldn’t be further from the truth. Organised cybercrime is more profitable than the drugs trade and has far less risk for the perpetrators, who have become adept at sharing information amongst themselves. To make life harder for these cybercriminals, organisations must recognise the threat of sophisticated attacks today – and work together to keep cyber attackers at bay.
“Businesses should be collaborating around the early indicators of compromise in order to understand the known mitigation path. While attacks can be targeted to specific organisations, finding an indicator of compromise is always the first step. Once Wonga has established further details on how the breach occurred, the company should share this key data with the relevant authorities. Criminal gangs are trying to industrialise the process, so they’re looking for certain types of systems and searching for places to replicate a specific attack. This means the same tactics can be repeated hundreds of times – and the Wonga attack could be repeated elsewhere, leaving thousands of further accounts vulnerable to theft.”
André Stewart, VP EMEA at Netskope:
“Data loss prevention needs to be a key priority for all businesses. Ignoring or downplaying increasingly sophisticated cyber threats is not an option. The EU General Data Protection Regulation (GDPR) – set to come into effect in just over a year – will hold organisations accountable for their data practices. As a result, companies will be forced to take active measures to mitigate any threats to personal privacy, whether that data is stored on-premises or in the cloud. Any companies falling short of these standards could face hefty fines.
“Alongside demonstrating that they have coached employees on the GDPR and secure data handling, employers will also need to provide staff with the tools to do their jobs securely without sacrificing ease and convenience. Ensuring the secure use of cloud services will be a fundamental piece of the compliance puzzle. Remaining vigilant to any unusual user behaviour and implementing technology such as DLP tools can ensure businesses are able to keep a close eye on particularly sensitive data, such as personally identifiable information (PII) of the type stolen in this latest hack. This will be the key to not only preserving customers’ privacy but also achieving GDPR compliance.”
Paul Dignan, Senior Systems Engineer at F5 Networks:
“A successful security strategy protects organisations’ most critical assets, identities and applications by authenticating and authorising the right people to the right data and making sure distinction is made between legitimate access, human access and malicious attempts – whether crafted by bots or malware. Implementing a zero-trust model represents a fundamental change in security management and requires a comprehensive, integrated plan to transition the business to be effective with its cyber risk strategy.”
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.