Vsevolod IVANOV, CEO of InfoWatch Com­pany told during NBJ interview about the latest technologies that will protect financial business from targeted hacker attacks.

NBJ: The topic of our conversation is the targeted cyber-attacks on banks. Does this mean that there are random cyber-attacks contrary to such actions?

V. IVANOV: Yes it does, there are occasion­al attacks, the weapon of which is massive­ly distributed malware. Targeted attacks involve a specific purpose and malicious program is developed for a certain type victim. In its turn, the targeted attacks are divided into two classes. The first one relates to the denial of an organization var­ious information systems, usually these are DDoS-attacks (Distributed Denial of Ser­vice). The second class is presented by the attacks, which are characterized by secre­cy, complexity and high degree of organiza­tion. Attackers create unique malware, yet unknown to antivirus industry. Their goal is to inflict a serious financial and reputation-al damage to a bank. Accordingly a prepara­tion takes place: sometimes attackers have been studying information systems for sev­eral months, special protection, the peculi­arities of a credit institution infrastructure. Then a program is developed which bypass­es all protection measures.

NBJ: What are the areas of banking systems which are often targeted by cyber-attacks?

V. IVANOV: Hackers attack computers of op­erators, loan officers, employees, confirm­ing RB payments, bank processing centres with the help of malicious software that can, for example, redirect large transactions to the criminal accounts. In our practice, there was a case when a hundred million rubles payment was transferred to the ac­count opened in Cyprus, and then the pro­gram self-destructed. This "Trojan" may be at the processing centre and send to crimi­nal accounts not the entire amount but only a percentage, and it is so small that no one gives any attention to this fact.

Legal entity computers become the object of targeted attacks. When these cli­ents perform their payments via RB systems "Trojan" replaces the final transaction ben­eficiary and a sum of money is transferred to criminals.

Hackers are also targeted on custom­er database through which you can obtain confidential information about some busi­ness practices, logistics schemes, real off-shores of this or that company. As the leak­age result, the company becomes a victim of all kinds of manipulations up to forcible takeover by rivals.

According to experts, if this or that company has become their target, the suc­cessful implementation of a program that can bypass a security system is a matter of time.

NBJ: What can a bank set against cyber-attacks?

V. IVANOV: The prevention of such threats is the use of current versions of antivirus programs, information protection means, device and system integrity control, and the tools for software updates.

The solution proposed by InfoWatch can detect such attacks by using a com­pletely new technology - dynamic detec­tion of targeted attacks. The first product is InfoWatch Targeted Attack Detector. The service is provided on a project basis. It is optimal for detecting a single attack when there is a suspicion that a bank was already attacked. It performs a constant monitor­ing and evaluation of changes in the status of a customer IT infrastructure during a month. Hacker activities inevitably lead to abnormal changes in the operation of at least one of the banking systems. InfoWatch analytical system determines the causes of these abnormalities, detects malware and identifies targeted attacks. If an antivirus can be compared with the alarm, and a fire­wall with a castle, then our software is a guard, which patrols the bank building and checks that all is clock-work. According to the detector performance results a customer receives a report detailing the state of infor­mation resources by listing the revealed ev­idences of targeted attacks, as well as a list of recommendations from InfoWatch com­pany analysts.

The second product is InfoWatch Tar­geted Attack Monitor. It is granted with an annual license. A system administrator has the ability to observe a system state every day, independently detect and prevent tar­geted attacks. I worked in the banking busi­ness for many years. Frankly, the perfor­mance of this product made a strong impres­sion on me. It's the software that is necessary for credit institutions today.