Reply to thread

Message

<blockquote data-quote="cruelsister" data-source="post: 1087178" data-attributes="member: 7463">This would be a difficult test to perform. A User can be impacted by a Bank breach in either of 2 ways:1). External (Due to the User)- a). a Phishing email. Protection against this would be a Dumb Detection of malicious web links by the User’s anti-malware application. You already test for this more broadly, and singling out those that only apply to Banking sites would be both time-consuming as well as redundant.b). Data Stealers- Malware certainly can be on the Users’ System that would harvest Login data and would result in a breach. These things are covered more generally in your testing already.2). Internal (due to the Bank site itself). a). A malware breach of a specific Bank could be due to a number of factors including the quality of THEIR anti-malware defenses as well as the competence of the Folk monitoring it.b). A hack of the legitimate Bank website itself (like a cross-site scripting attack or exploiting a XSS vulnerability).c). 15-20% of breaches are initiated by someone working within the organization itself.So, for a Banking test you already cover the External threats, and the Internal threats are not possible to test due to their type and diversity.</blockquote>

[QUOTE="cruelsister, post: 1087178, member: 7463"] This would be a difficult test to perform. A User can be impacted by a Bank breach in either of 2 ways: 1). External (Due to the User)- a). a Phishing email. Protection against this would be a Dumb Detection of malicious web links by the User’s anti-malware application. You already test for this more broadly, and singling out those that only apply to Banking sites would be both time-consuming as well as redundant. b). Data Stealers- Malware certainly can be on the Users’ System that would harvest Login data and would result in a breach. These things are covered more generally in your testing already. 2). Internal (due to the Bank site itself). a). A malware breach of a specific Bank could be due to a number of factors including the quality of THEIR anti-malware defenses as well as the competence of the Folk monitoring it. b). A hack of the legitimate Bank website itself (like a cross-site scripting attack or exploiting a XSS vulnerability). c). 15-20% of breaches are initiated by someone working within the organization itself. So, for a Banking test you already cover the External threats, and the Internal threats are not possible to test due to their type and diversity. [/QUOTE]

Verification