We learned about the importance of a System Map in Step One: Building the Foundation, last week.

This week, we are discussing Step 2 – Start with the Most Important. In this critical step in the user access review process, you will identify the most important systems by identifying the high-risk activities each system performs.

Do you believe the full title? Or do you believe the parenthetic comments are a better descriptor? Here’s a simple and universal truth of the human condition: we tend to avoid tasks we think will be hard. Or complicated. Or time consuming. Or all three!

Financial institutions have long viewed user access reviews as a double edged sword. On one hand, regulators require them. They’re a crucial component in managing to least privilege. But they’re a challenge to conduct on a regular schedule. And if you have to rely on legacy technology and outdated manual processes, the frustrations can compound logarithmically.

But you don’t need to be stuck in the past. Help is on the way.

Cybersecurity insurance is an increasingly important component of your financial institution’s overall information security program. When a data breach or other hostile technology event occurs, cybersecurity insurance proceeds can provide funds to repair your hardware, recover intellectual property, and even pay for the work you do to reverse adverse reputational impacts.

Alpharetta, GA (November 8, 2022) - Finosec announced that the user access reporting process no longer needs to be labor intensive or complicated, thanks to their User Access Reporting solution. The Finosec solution operates smoothly in tandem with financial institutions and supports more than 100 financial systems and has reviewed more than 11 million user permissions.

Cybersecurity Awareness Month occurs in October. The US Cybersecurity and Infrastructure Agency (CISA) created it to increase general awareness of emerging online threats and how best to avoid them.

The practice of user access reporting within financial institutions has historically been an arduous process that relies on archaic technology and is both time and labor intensive. While generating multiple user access reports per year would be ideal, many financial institutions, through no fault of their own, often find they can only produce the bare minimum amount of reporting required annually. But as cyber risks continue to grow and the regulatory requirements continue to increase, it is vital that financial institutions can quickly and easily produce these reports, and with increased frequency. 

Contracts are typically dense, highly detailed documents that can be hard to navigate. After wading through strikingly specific legal verbiage, it can be difficult to ascertain whether or not the contracts are accomplishing everything they claim to be. As a result, financial institutions may wonder how they can feel confident in signing such a document. Systematically and thoroughly reading and reviewing the contract before agreeing to its terms are vital, but knowing how to do that well can be tough. Prior to conducting a review, you’ll need to understand the expectations of the relationship: which products/services were selected, any prerequisites or additional costs to implement, term(s) of the agreement, and the stakeholders. Conducting a contract review is vital to reduce overall risk, ensure that the provisions are correct, and provide both sides with the opportunity to fully understand what they are agreeing to before the final signing decision is made. Regulatory requirements mandate that each institution is responsible for reviewing and understanding vendor contracts and/or agreements - but that is easier said than done.

The ever evolving landscape of cybersecurity and cyber risk presents a unique challenge. As the threats and associated risks continually change, it can be difficult to stay abreast of the latest recommendations, guidance, and best practices. FINOSEC President and CEO Zach Duke spent some time talking to Joel Williquette, Senior Vice President of Operational Risk Policy for the ICBA to discuss some practical cybersecurity tips for community banks. We have linked the entire conversation at the bottom of this post, but here are 5 of the key takeaways in considering how to identify, evaluate, and address cybersecurity risks at your institution.