In the ever evolving landscape of cyber risk, cyber insurance is more important than ever. This is a policy that is specifically tailored to the cybersecurity and information security needs of your institution, potentially covering incidents such as ransomware, cyber extortion, data destruction, and more. To engage with insurers and take out such a policy, the broker will be asking for information around how you secure your institution, including your user access practices and how you are managing to least privilege. CEO and Founder Zach Duke spends a few minutes sharing the cautionary tale of the National Bank of Blacksburg as well as some things to consider when working to secure this type of insurance. Watch the video then read on for further discussion.
The FDIC requires that within a financial institution’s budget there must be a specific allocation for cybersecurity elements. That is, that there is money going toward services, programs, and coverage related to this item. More than just a requirement, though, it is important that your institution structures the budget in such a way that you can feel confident in your cybersecurity and information security abilities. Because “cybersecurity” can tend to be a rather nebulous term, sometimes getting lumped together with all things IT, Founder and CEO Zach Duke spends a few minutes discussing how to have fruitful conversations and create an effective budget around this element. Watch the video below for more information.
Earlier we discussed the frequency of user access reviews and how often they should be completed. You can read that blog here. It seems that there is a direct correlation between user access review frequency and the difficulties associated with those reviews. A highly manual process will inherently prohibit increased frequency due to increased time requirements. President and CEO Zach Duke talks about the challenges these reviews pose to you and/or your staff, and some next steps on how to make that process a little simpler. Take a couple minutes to watch the video below.
User access reviews can be a complex, time consuming process. Coupled with the regulatory expectations regarding these reviews and their frequency, they prove to be an arduous task that is far too often hindered by reliance on legacy systems. We believe everyone deserves a simple approach to cybersecurity, and user access reviews are no exception. President and CEO Zach Duke asks some questions regarding user access, and FINOSEC would like to hear your feedback on your experiences and opinions on this matter. Watch the video below for more information.
The ever evolving landscape of cybersecurity and cyber risk presents a unique challenge. As the threats and associated risks continually change, it can be difficult to stay abreast of the latest recommendations, guidance, and best practices. FINOSEC President and CEO Zach Duke spent some time talking to Joel Williquette, Senior Vice President of Operational Risk Policy for the ICBA to discuss some practical cybersecurity tips for community banks. We have linked the entire conversation at the bottom of this post, but here are 5 of the key takeaways in considering how to identify, evaluate, and address cybersecurity risks at your institution.
For the 18th year, October serves as Cybersecurity Awareness Month. With the evolving trends in cyber risk, the diversity of cyber attacks, and the breadth of exposure nearly everyone faces in regards to their digital footprint, it is more important than ever to be cyber smart. The CISA and the National Cyber Security Alliance have declared October a month to focus on educating everyone about their responsibility in maintaining a resilient cybersecurity posture. Below we discuss what that means for you as a financial institution, as well as share key ways you can capitalize on this educational momentum by focusing on 4 primary pillars.
FINOSEC President and CEO Zach Duke has spent a few minutes breaking down the Ransomware Self Assessment Tool. This tool was created by the Conference of State Bank Supervisors, and was crafted to help mitigate the risks associated with Ransomware. Furthermore, it serves as an effective communication piece that demonstrates to upper level management how the institution is actively being protected against this particular risk. Watch the short video below for what this tool includes and how it could serve you.
The FFIEC has released an update titled “Authentication and Access to Financial Institution Services and Systems.” It replaces two previously released FFIEC issued pieces: "Authentication in an Internet Banking Environment" released in 2005, and the "Supplement to Authentication in an Internet Banking Environment" released in 2011. The guidance has been expanded to include employees, third party vendors, and APIs with increased expectation in regards to controls and risk management. This update is clearly focused on an understanding of the threat landscape, having a current risk assessment, ensuring layered security, and a general increase in authentication implementation. Take a few minutes to watch FINOSEC President and CEO Zach Duke unpack this information.
The FFIEC AIO (Architecture, Infrastructure, and Operations) is an update to the operations handbook that was released on June 30, 2021. It doubles the size of the existing operations booklet released in 2004, and provides some considerable changes in regulatory expectations. It includes some expanded guidance from the previous booklet (on items such as hardware and software inventories, and environmental controls) as well as brand new areas of guidance (including increased accountability for board and senior management, third party risk management, and evolving technologies).
The sophistication of cyber attacks continues to grow. According to the Accenture Cost of Cybercrime Study, the average cost of a breach in financial services is $13 Million. As a financial institution, we have to be right 100% of the time while Cyber Criminals only need to be right once.