Capital One hacking holds important lessons for Singapore
MONDAY'S announcement by US bank Capital One that data on some 106 million customers in America was stolen by a software engineer has shaken up the banking industry. This is one of the biggest ever data breaches.
The hacker, 33-year-old Paige Thompson from Seattle, went by the moniker "erratic" online and used to work for Amazon Web Services (AWS). It is yet unclear if her actions were driven solely by criminal intent. But one major concern is, prima facie, the relative ease with which she managed to get into the highly secure database of a bank that is not just the 10th largest in the US but one with a long-held reputation for its digital prowess.
Predictably, questions have again been raised about how safe consumer data is in the hands of service providers. Data, especially personal data, has become the new currency of today's rapidly digitalising global economy. For hackers, there is financial profit to be gained from selling such data, but there could be even more nefarious motives. The Capital One breach, which occurred in March, is but the latest that has come to light in a string of high-profile data break-ins across the world, including Singapore. Other big names that fell victim to cyber attacks include credit monitoring firm Equifax and Internet giant Yahoo.
Despite the all-too-frequent regularity in which breaches occur, the good news is that for every breach that is reported, cyber defences thwart literally hundreds of hacking attempts. According to a Cisco study, in 2018 Asia-Pacific companies faced six cyber threats every minute.
In the Capital One incident, information available so far indicate that Thompson accessed a firewall that was not properly configured and used basic hacking tools such as an anonymous browser and a virtual private network (VPN). The bank got to know of the breach only through an anonymous e-mail tip-off after she had apparently boasted about her exploits on social media.
To be clear, current security systems used by large organisations like banks - not least one as tech-savvy as Capital One - are mostly highly robust and fairly state-of-the-art, thanks to the use of technologies such as machine learning and artificial intelligence. So what went wrong? These systems are geared to thwart hacking attempts by criminal gangs, many of whom have the support of nation-states. These hackers use a number of sophisticated techniques, including what is known in cyber security lingo as APT or advanced persistent threat. In an APT, the hacking attempt could last for months using a combination of different methods, such as customised malware that could compromise employees' personal devices and, from there, gain access to a particular network.
It is possible that the Capital One hacker was successful because she used a less sophisticated method that exploited a known vulnerability with the help of insider knowledge. As companies increasingly put valuable data in the cloud on third-party servers, the network becomes more complicated. Thus, many more such vulnerabilities are likely to go undetected. A network's cyber defence is only as strong as its weakest link.
As Singapore increasingly uses the cloud to store the voluminous data generated every day, the Capital One hacking is yet another lesson that cyber breaches can happen from the most unexpected quarters. There is a need for a 360-degree view for cyber security.
