KUALA LUMPUR (Aug 24): The financial sector is ill-equipped to effectively tackle the ongoing threat of firmware-related supply chain attacks.
US-based firmware and hardware infrastructure service provider Eclypsium and tech market research firm Vanson Bourne in a report titled "The Firmware Security in Financial Services Supply Chains" covering 350 IT security decision-makers in the financial sector, specifically those based in the US, Canada, Singapore, Australia, New Zealand, and Malaysia said the findings not only expose the state of firmware security and the lack of preventive controls or remediation tactics, but also shed light on the complacency and lack of awareness regarding current security measures.
The report said 92% of chief information security officers (CISOs) in finance believe adversaries are better equipped at weaponising firmware than their teams are at securing it.
Additionally, it said three out of four acknowledge gaps in awareness concerning the organisation’s firmware blind spot.
Consequently, 88% of those surveyed admit to experiencing a firmware-related cyber-attack in the last two years alone, it said.
The report added that more alarming is the consensus around little-to-no dedicated investment or resources, and general lack of skills to tackle one of the biggest threats in cybersecurity today.
It said data shows:
- Over half (55%) were victims of a firmware-level compromise more than once in the past two years.
- Almost four in ten rate data loss (and a GDPR breach) as the leading consequence for an attack, equally ranked is the fear of losing critical security controls.
- Destruction of critical devices (35%), customer loss (34%) and adversary access to other devices (34%) were all equally noted as a detrimental impact following a firmware-related attack.
The research said financial services organisations are leading targets of cyberattacks.
It said that explains why they are the vanguards for adopting new protection technologies all while under the constant watchful eye of regulators and other industries waiting to follow their lead as they strive to combat ever evolving attack vectors.
Yet it said in the case of securing firmware and the hardware supply chain, there are potential blind spots.
It said a shift in priorities is critical if we are going to effectively protect the technology supply chain.
Financial organisations must continue to serve as trailblazers and close the firmware security gap.