Author: Simon Fletcher

Date: 5th December 2018

 

First Ticketmaster and now British Airways – cyber criminals and the tools that they use to compromise information, are evolving faster than ever. The use of skimming is just one form of attack method which is slowly bringing businesses down, one by one.

Although many have jumped to criticise BA’s oversight and inability to spot the malicious code instantly, it’s not so black and white. Hackers are increasingly creating more targeted code to compromise sensitive data, and this is certainly the case with BA.

What’s different about this breach is that Magecart, the criminal group reportedly behind the BA breach, designed custom infrastructure which enabled the malicious code to blend in with that of the host website, avoiding detection for as long as possible.

With this mirroring the successful breach of Ticketmaster’s systems just a few months ago, it is yet another lesson on the evolving nature of skimming attacks and the importance of embedding security into online platforms from the get-go – especially when it comes to the development of payment software.

It’s very easy to point fingers when breaches like this are first revealed, but it’s important to remember that the security industry also has a duty to keep businesses up to date with the new tools employed by hackers and advice around how they can protect themselves.

Although BA’s response was swift, once the damage is done, customers can be very unforgiving. Therefore, taking the time to spot the gaps in your security infrastructure and fixing them at the beginning is crucial.

Despite the constant evolution of these methods, it’s clear that getting the basics right will more often than not help identify and prevent issues within code before it causes irreversible damage. This can be actioned by baking in security within the Software Development Life Cycle (SDLC), placing a firm focus on security, as well as usability, and scanning and testing for any security weaknesses. This means that in the event of even the most vigilant employee failing to notice code that has been tampered with, the necessary measures will be in place to prevent catastrophic consequences.

Penetration testing allows businesses to identify any vulnerabilities within the corporate system and their online platforms, enabling organisations to mitigate the risks before flaws are exploited. It plays a fundamental role in achieving a mature security foundation that can help to prevent not only the most targeted skimming breaches like BA, but cyber attacks of any kind.

It’s time to be proactive and learn from the slip-ups of Ticketmaster and British Airways. To find out more about how we can help you with your penetration testing needs, get in touch with our dedicated team here.

 

Other resources

Cyberfort Colocation Services

Cyberfort has invested heavily in secure infrastructure, making us the perfect colocation service provider to host your mission-critical, sensitive and regulated data.
Find out more >

What can Cyberfort do for you?

Check out our factsheets for detailed information on the matrix of cybersecurity products and services we offer to protect your business.
Find out more >

Cyberfort Deep Dives

Cyberfort’s cybersecurity consultants explore issues in cyber threat intelligence, incident planning and data security. Read our whitepapers to help make decisions that benefit your business.
Find out more >