Companies managing financial services are suffering from more attacks than ever and spending millions to address the problems created by cybercriminals.

In the 2019 Global DNS Threat Report from security company EfficientIP, analysts spoke to 900 respondents from nine countries across North America, Europe, and Asia. They found that on average, companies were suffering from 10 attacks a year and were forced to spend $1,304,790 to restore services after each DNS attack.

This means institutions like banks are spending up to $13 million per year to address DNS attacks. More than 80% of companies that spoke to EfficientIP said they experienced an attack last year.

SEE: Special report: A winning strategy for cybersecurity (free PDF) (TechRepublic)

A heavy cost to businesses

Financial services were paying more than any other sector and, in 2017, they were paying $924,390 for a single DNS attack. The number of attacks in 2018 was nearly 40% higher than the year before, and almost 50% of financial services organizations told EfficientIP they were hit with DNS-based phishing scams.

“Financial services organizations have always been the gatekeepers of customers’ money, providing vital services people expect to be able to use all day and night,” said David Williamson, CEO of EfficientIP.  “With so much at stake, the networks of financial services organizations are a predictable, prime target for DNS attacks.”

The massive cost of these attacks was only one downside that respondents reported. In addition to the money it takes to restore systems, the money lost during downtime was crushing. Almost 50% of companies said they experienced cloud service downtime, and nearly 70% saw in-house application downtime.

“DNS attacks are moving away from pure brute-force to more sophisticated attacks acting from the internal network,” the report said. “This will force organizations to use intelligent mitigation tools to cope with insider threats.”

The GDPR effect

One positive note mentioned in the study is the effect the GDPR has had on security awareness in Europe. Organizations gave high marks to the legislation, nearly 80% said it spurred network security upgrades and general innovation. More than 80% said it had an effect on how their employees understood data privacy, and 64% said they saw heightened consumer trust.

“Organizations see a positive impact from GDPR legislation, feeling it will sustain the need to deploy stronger security defenses. Ongoing data privacy compliance initiatives strategies in other countries (CLOUD Act, NISD, PDPA, etc.) will also benefit,” the report said.

SEE: EU GDPR policy (TechRepublic Premium)

Security still lags

The more startling aspects of the report have to do with prevention. Almost 70% of responding organizations had security systems that did not perform any DNS traffic analysis for their internal threat intelligence program. About half of all companies that spoke to EfficientIP said they used little to no automation in their security systems. 

“What is a surprise is these organizations are not amplifying their security measures. They are big targets with costly breaches coming thick and fast,” Williamson added. “As our research shows, DNS security is a business imperative for the financial sector if hackers are to be kept at bay and to prevent services from caving in on themselves.”

Cybersecurity Insider Newsletter

Strengthen your organization’s IT security defenses by keeping abreast of the latest cybersecurity news, solutions, and best practices. Delivered Tuesdays and Thursdays

Sign up today

Also see