Lydia Dwyer on our Product Management team tipped me off to a recent report released by IntSights that revealed that the financial industry is now the most-attacked industry by cybercriminals and that that the volume of security incidents continues to grow.
Banks are a prime target for cyberattacks. Banks store and utilize a large volume of confidential data surrounding their client’s personal information, account information, and other data. For bank leaders, it’s important to understand the unique challenges and regulations you must meet to protect this data. Attacks may range from malware, phishing or DDoS, to sophisticated compound attacks that use multiple methods at once to infiltrate the organizations and compromise security. You must be prepared to prevent, detect, and remediate any potential security incidents.
Picture this: you walk up to an ATM that’s the same brand as your bank. The ATM itself is in a well-lit area, there are lots of families walking around, and there’s even a police officer right on the corner. Everything seems safe, right? You slide your card into the ATM, conduct your transaction, and conclude your business as normal.
Smaller financial institutions, such as credit unions, need to keep their systems well-protected from cybercriminals, whether they're insiders or those operating from outside of the organizations. To do so, credit unions must first understand just how important IT security is. They must also come to terms with how their IT security capabilities are likely more limited than larger firms with more spending capital. When they accomplish both, they can take the appropriate measures to protect themselves.
The threat from cybercriminals is real, and credit unions must be on the constant lookout for potential breaches. These institutions are very vulnerable to cyber attacks because of their smaller size, and don't always have the IT infrastructure and resources to thwart cyber attacks like their larger counterparts, according to a new 2016 Beazley Breach Response Insights report.
"You're being tested every day, whether you realize it or not," said David Luchtel, Vice President of IT Infrastructure and Operations at WSECU, according to Credit Union Times.
Credit unions face major challenges when protecting financial data in today’s threat landscape. In addition to protecting consumer data and financial records, IT security teams must also deal with compliance mandates for FFIEC and a patchwork of federal, state, and other industry regulations. With so many regulations and areas to consider, the task of securing a network from breaches and vulnerabilities while meeting compliance requirements can seem overwhelming. That task has become even more onerous with the National Credit Union Administration (NCUA) buckling down even further on FFIEC compliance to ensure that credit unions are as secure as possible, given how many data breaches are still happening in the financial services industry today.
News broke in late April 2016 that Qatar National Bank (QNB), the second largest financial institution in Africa and the Middle East, had suffered a massive data breach. Details of this compromise have been hard to come by, and what hackers and other groups might be doing with the data leaked from QNB remain a matter of speculation for now. QNB has since released two statements that provide a few details about the intrusion.
Banks, credit unions, and other financial institutions face major challenges when protecting financial data in today’s threat landscape and must also deal with compliance mandates for GLBA, FFIEC, SOX, PCI, and a patchwork of federal, state, and other industry regulations. For example, In March of this year, the National Futures Association enacted its Cybersecurity Interpretive Notice to help structure and strengthen members’ information security programs. These guidelines suggest that each member firm establish a written governance framework, assess and prioritize IT risks, defend specifically against identified threats and vulnerabilities, create incident response plans, and provide continuous employee training. These guidelines build on the SEC’s Cybersecurity Examination Initiative conducted by the Office of Compliance Inspections and Examinations (OCIE), which focus on six key areas in its audits:
- Cybersecurity Governance and Risk Assessments
- Access Rights and Controls
- Data Loss Prevention (DLP)
- Vendor Management
- Cybersecurity Incident Response
- Cybersecurity Awareness & Training
Banks, credit unions, and other financial institutions face major challenges when protecting financial data in today’s threat landscape. In addition to protecting consumer data and financial records, IT security teams also deal with auditing mandates for GLBA, FFIEC, SOX, PCI, and a patchwork of federal, state, and other industry regulations. In 2014, the Federal Financial Institutions Examination Council announced a new effort focusing on cyber security, including an audit of an organization’s ability to manage cyber security and mitigate cyber risk. The task of monitoring thousands of network and system events can seem overwhelming. EiQ’s SOCVue® hybrid SaaS security services help overcome these challenges by providing the right people, process, and technology in order to deliver increased security visibility and guidance to effectively reduce cyber risks and meet compliance requirements.
In the world of cyber security, sometimes there’s good news and sometimes there’s bad news. The Telegraph recently reported that a fortuitous spelling mistake in an online bank transfer stopped a nearly $1 billion (that’s billion, with a B) heist last month involving the Bangladesh central bank and the Federal Reserve Bank of New York. That’s the good news. The bad news is that the thieves, who are still unknown, managed to get away with more than $80 million, which comprises one of the largest known bank heists in history (authorities report that some of that money has since been recovered).