Stock Exchanges Fear Cyber Threat is Growing

By | July 30, 2013

Posted in: Network Security Trends

Researchers working in the securities sector have warned that stock exchanges around the world have become the targets of cyber-criminals and that the potential exists for attacks that would close down financial markets.

The warning was made in a report issued this month (July 2013) by the International Organization of Securities Commissions (IOSCO) and the World Federation of Exchanges (WFE).

Rohini Tendulkar  of IOSCO and Grégoire Naacke of WFE said a survey of exchanges across the world showed that just over half of them had been victims of cyber-criminals in 2012. Responses were received from 46 exchanges and central counterparties, which were not individually identified but ranged from large to small and represented all geographic regions.

The report was issued as the U.S. Attorney’s Office in Manhattan announced two indictments against Russian national Alexandr Kalinin for allegedly hacking servers used by Nasdaq between November 2008 and October 2010. Reuters reported last week that Kalinin was accused of installing malware that enabled him and others to execute commands to delete, change or steal data.

The IOSCO-WFE report said 89% of exchanges viewed cyber-crime in securities markets as “a potential systemic risk,” citing the possibility of massive financial and reputational impact; loss of confidence; the effect on market availability and integrity; interconnectedness and dependencies in securities markets; and related knock-on effects on market participants.

“Cyber-criminals now include sophisticated and well-resourced actors, undeterred by regulation (given the low likelihood of being caught),” the report by Tendulkar and Naacke said. “These actors are perpetrating attacks against securities markets with the motive of being disruptive and not just for immediate financial gain. The most common forms of attacks against exchanges are disruptive in nature -- separating cyber-crime from traditional financial crime such as fraud and theft.”

The report said future attacks could affect market integrity and efficiency by, for example, taking down critical systems, manipulating information, and moving markets. A simultaneous attack on several interconnected providers of essential services could have knock-on effects for other market actors, it said.

“While impacts have been minimal so far, 100% cyber-security is illusionary and current preventative and disaster recovery measures may not be able to withstand all zero-day coordinated and large-scale attacks in the future,” the researchers said. “By targeting exchanges in different parts of the world, existing information-sharing arrangements may not be enough to facilitate fast communication of an emerging threat or the mounting of a cross-border response,” they said.

“Cyber-crime in securities markets has not manifested systemic impacts at this stage, but the analysis of this report suggests there is potential for it to do so,” Tendulkar and Naacke said.

“Reliance on an outdated understanding of what cyber-crime entails; a perception of safety due to containment of past cyber-attacks; or assumptions around the limited capabilities of cyber-criminals today – may mean we end up ‘bringing a knife to a gun fight’ in the future,” they cautioned. “Worse, a presumption of safety (despite the reach and size of the threat) could open securities markets to a cyber ‘black swan’ event.”

You May Also Be Interested In: