Bank Hackers Steal Millions via Malware
So what defenses should an organization employ to prevent these types of attacks?From this non-technical article, it looks like they penetrated employees' computers and used their credentials, which makes sense because it's probably the weakest link.It reminds me the philosophy/motivation behind Qubes OS [1]: there is no server security without client security.What are banks running on employee computers these days?  I'm guessing Windows.  Do they have anything beyond what typical corporate IT does to Windows machines (install virus checkers, auto updates, most users don't have root)?Clearly that's not sufficient.  It sounds like you want some kind of strict compartmentalization like Qubes.  There's probably no reason that an e-mail client like Outlook needs to share any state with whatever app they used to manage accounts.  Besides perhaps sharing a clipboard for cutting and pasting a tiny amount of info.The machines probably need secure boot and attestation of the root file system state too.  It's pretty bad that in this attack and I think in the Anthem case that attackers were inside their network for such a long period without detection.I also remember a DEFCON talk where a penetration tester said the hardest site he ever worked on was where they had a strict "star" network topology.  None of the computers in the enterprise could talk to each other or even see each other.  All communication had to be proxied through a central hub, which would audit all the connections.Do any banks do that now?  Is there any reason they couldn't in practice?  I imagine that there isn't really a need for two tellers in the same office to be sharing files directly with each other.  Let alone tellers in different offices.  I've never worked at a bank do I have no idea what their networks are like.  Possibly there would be some uptime concerns with a centralized system like that.I'm just brainstorming and wondering if anyone has direct work-related experience.[1] https://qubes-os.org/