How a bank knows it has been hacked

David Gura Oct 3, 2014
HTML EMBED:
COPY

How a bank knows it has been hacked

David Gura Oct 3, 2014
HTML EMBED:
COPY

Hackers got into JPMorgan Chase’s network over the summer, and according to the bank, that breach compromised 76 million households and 7 million small businesses. The bank says there is no evidence hackers got a hold of account information, just names and addresses, e-mails and phone numbers, but those data are valuable. 

Companies often learn their systems have been breached from third parties. According to Anton Chuvakin, a vice president in Gartner’s security and risk management group, law enforcement will call if they spot stolen data on underground forums.

“Oh, by the way, we are seeing your data here,” might be the message from law enforcement, he says. “What’s up with that?”

These days, big banks spend big on their own security. JPMorgan has allocated $250 million.

When a bank discovers a breach, “you’re going to have a big senior management powwow,” says Julie Conroy, research director for the Aite Group’s retail banking practice, who covers data security. Management will put into place a “security incident response plan,” “and the forensic analysis is very much like what you see at a crime scene,” she says.

It’s methodical, and according to Martin Lindner, a cybersecurity specialist at Carnegie Mellon University’s Software Engineering Institute, banks keep logs of everything that happens on their servers. “So, in theory, they can go back to all those logs, replay them, and see what happened that was the thing that appears to be nefarious,” he explains. That is a lot of information, and going through that is time-consuming.

Forensics is just one part of a “security incident response plan.” There is also remediation and communication. With this breach, tens of millions of people are at risk. Lawrence Baxter, the William B. McGuire Professor of the Practice of Law at Duke University, says hackers could use what they have gathered to phish for more information using, say, an official-looking e-mail message.

“You may only get a half of one percent of the customer base fooled by it, but that’s enough,” he says, to cause more damage to customers’ bank accounts, and also to the bank’s reputation.

Marketplace is on a mission.

We believe Main Street matters as much as Wall Street, economic news is made relevant and real through human stories, and a touch of humor helps enliven topics you might typically find…well, dull.

Through the signature style that only Marketplace can deliver, we’re on a mission to raise the economic intelligence of the country—but we don’t do it alone. We count on listeners and readers like you to keep this public service free and accessible to all. Will you become a partner in our mission today?

Your donation is critical to the future of public service journalism. Support our work today – for as little as $5 – and help us keep making people smarter.