Community bankers should ensure their processors are aware of the “Poodle” hack and to take steps to block the cyber-attack. Banks and other institutions are susceptible to the attack, which can intercept sensitive data used by website visitors. The name of the hack is an acronym for Padding Oracle On Downgraded Legacy Encryption.
The good news for banks is that Poodle attacks are fairly easy to block. The first step for a company is to check its websites to see if they're vulnerable. There are a several free scanners that check for the presence of flawed encryption that allows it, such as https://www.poodletest.com.
The good news for banks is that Poodle attacks are fairly easy to block. The first step for a company is to check its websites to see if they're vulnerable. There are a several free scanners that check for the presence of flawed encryption that allows it, such as https://www.poodletest.com.
Where a vulnerability exists, a bank needs to apply patches to its website software so that it supports only recent versions of the newer TLS encryption protocol. The tricky part is timing. The problems arise around testing and availability. A system needs to be taken offline for a while to update it, negotiation with other areas of your organization is needed in order to keep 24/7 availability. If your bank's critical servers have redundancy and failover however, IT can test and run the new software on a backup machine before taking it live.
Bank customers also need to defend themselves from Poodle attacks. To do so, they should use the latest versions of browsers, which are rapidly turning off any remaining SSL and only allowing only TLS. Microsoft, Google and Firefox have all committed to removing support for old encryption protocols. To turn off SSLv3, visit https://poodle.io/browsers.html and follow the step-by-step instructions.
Regardless of whether your online banking platform was found to be vulnerable to Poodle, ensure that communication with customers includes an explanation of under what circumstances and through what means you may contact a customer requesting a credential update. Phishing scams may result of the Poodle vulnerability. Instruct your customers to update their credentials directly through your bank’s website, and not by following links contained within emails.
Bank customers also need to defend themselves from Poodle attacks. To do so, they should use the latest versions of browsers, which are rapidly turning off any remaining SSL and only allowing only TLS. Microsoft, Google and Firefox have all committed to removing support for old encryption protocols. To turn off SSLv3, visit https://poodle.io/browsers.html and follow the step-by-step instructions.
Regardless of whether your online banking platform was found to be vulnerable to Poodle, ensure that communication with customers includes an explanation of under what circumstances and through what means you may contact a customer requesting a credential update. Phishing scams may result of the Poodle vulnerability. Instruct your customers to update their credentials directly through your bank’s website, and not by following links contained within emails.
RSS Feed