UniCredit’s recent databreach is the the third security incident at Italy’s top bank in recent years (the others related to the time periods September and October 2016, and July 2017). The lender has said that the latest breach related to a 2015 file containing emails and phone numbers of millions of Italian clients. Since this incident the bank has invested 2.4 billion euros in new IT systems in order to strengthen cybersecurity.
The bank has indicated it has launched an internal investigation into how the breach took place. The bank has also informed relevant authorities, including law enforcement. Impacted customers will be informed by post or via online banking.
To understand the implications, James Carder, CISO and VP of LogRhythm Labs spoke with Digital Journal. Carder highlights why breaches are a recurring trend for financial institutions and the proper security strategies that need to be implemented to forgo future breaches of this type.
Carder begins by looking at the financial sector: “The financial industry continues to be inundated with breaches, and unfortunately, this latest breach from Italian bank UniCredit is a part of a recurring theme.”
Many of the issue stem from the way that cybersecurity is approached. Carder notes that “even though the bank vies that it has invested in billions of euros worth of upgrades to boost its cybersecurity program in the past few years, this data breach unveils how inadequately cybersecurity tools are implemented and utilized – and proof that you cannot just throw a bunch of money at the problem.”
This means that new solutions are required, as Carder recommends: “In today’s modern, data-centric landscape, customers’ personally identifiable information is more vulnerable to attack than ever before. There is no doubt that there are thousands of financial institutions with sensitive data stored that have similarly been compromised and have yet to find the threat.”
New solutions require a relook at current approaches, and invariably need a new strategy, according to Carder: “If they want to prevent security incidents from transforming into catastrophic breaches, they must have a coherent strategy; leverage the latest in detection, automation, and orchestration technologies; and ensure that these tools are bi-directionally integrated and battle tested.”
