What Is Automated Red Teaming?
Read More
Picus | September 14, 2022
London, UK, 14 September 2022 – Picus Security, the pioneer of Breach and Attack Simulation (BAS) technology, today released cyber incident data obtained from the UK’s Financial Conduct Authority (FCA). Through a Freedom of Information (FOI) request, Picus can reveal a steep rise in Distributed Denial-of-Service (DDoS) attacks reported to the regulator. 25% of cyber incidents submitted to the FCA in the first half of 2022 involved DDoS, compared to 4% in 2021.
Picus believes the primary reason for the significant increase in DDoS attacks is UK finance firms being targeted by nation-state attackers and hacktivists during the ongoing Russia-Ukraine conflict. DDoS attacks, including sophisticated ‘carpet-bombing’, are often used against providers of critical infrastructure to disrupt operations and deny access to vital services.
The observed rise in DDoS attacks also coincides with a reported increase in DDoS for hire websites and ransomware operators using DDoS as a tactic to pressure and extort money from targets.
Other key findings of Picus Security’s FOI, which also considers 2021 data obtained from the FCA, include:
Read Picus Security’s blog for more in-depth insights.
“DDoS attacks are a concern for financial institutions, with their ability to disrupt operations and even bring them down entirely,” said Dr. Suleyman Ozarslan, Picus Security Co-Founder and VP of Picus Labs. “UK financial institutions are in the crossfire of the ongoing war between Russia and Ukraine and have become a direct target for nation-state attackers and hacktivists seeking to disrupt Ukraine’s allies.
“While it’s encouraging that financial firms reported fewer cyber incidents in the first half of 2022 than they did during the equivalent period in 2021 there is no time for complacency. As threats evolve, financial institutions must continue to proactively harden their defenses. This includes validating that security controls and processes provide protection against the latest risks.”
Notes for editors – Methodology
The UK’s Financial Conduct Authority (FCA) regulates the activity of more than 50,000 financial services firms. If any of these businesses suffer a material cyber incident, they must notify the FCA immediately. According to the FCA, a material incident is defined as a cyber incident that:
In July 2022, Picus Security issued a Freedom of Information (FOI) request to the FCA to understand the degree to which cybercrime had impacted the UK finance sector in the first half of 2022 (Jan 1st-30th June)
* Note: In H1 2021, the FCA received an unusually high number of ransomware reports, including a large spike in March 2021. The 2022 data could be considered a return to ‘normal’, being more on par with the figures reported in the second half of 2021.
About Picus Security
Picus Security is the pioneer of Breach and Attack Simulation (BAS). The Picus Complete Security Control Validation Platform is trusted by leading organizations worldwide to continuously validate the effectiveness of security controls against cyber-attacks and supply actionable mitigation insights to optimize them.
Picus has offices in North America, Europe and APAC and is supported by a global network of channel and alliance partners.
The company is dedicated to helping security professionals become more threat-centric and via its Purple Academy offers free online training to share the latest offensive and defensive cybersecurity strategies.
For more information, visit www.picussecurity.com