Picture this: you walk up to an ATM that’s the same brand as your bank. The ATM itself is in a well-lit area, there are lots of families walking around, and there’s even a police officer right on the corner. Everything seems safe, right? You slide your card into the ATM, conduct your transaction, and conclude your business as normal.
Smaller financial instiutions, such as credit unions, need to keep their systems well-protected from cybercriminals, whether they're insiders or those operating from outside of the organizations. To do so, credit unions must first understand just how important IT security is. They must also come to terms with how their IT security capabilities are likely more limited than larger firms with more spending capital. When they accomplish both, they can take the appropriate measures to protect themselves.
The threat from cybercriminals is real, and credit unions must be on the constant lookout for potential breaches. These institutions are very vulnerable to cyber attacks because of their smaller size, and don't always have the IT infrastructure and resources to thwart cyber attacks like their larger counterparts, according to a new 2016 Beazley Breach Response Insights report.
"You're being tested every day, whether you realize it or not," said David Luchtel, Vice President of IT Infrastructure and Operations at WSECU, according to Credit Union Times.
Credit unions face major challenges when protecting financial data in today’s threat landscape. In addition to protecting consumer data and financial records, IT security teams must also deal with compliance mandates for FFIEC and a patchwork of federal, state, and other industry regulations. With so many regulations and areas to consider, the task of securing a network from breaches and vulnerabilities while meeting compliance requirements can seem overwhelming. That task has become even more onerous with the National Credit Union Administration (NCUA) buckling down even further on FFIEC compliance to ensure that credit unions are as secure as possible, given how many data breaches are still happening in the financial services industry today.
News broke in late April 2016 that Qatar National Bank (QNB), the second largest financial institution in Africa and the Middle East, had suffered a massive data breach. Details of this compromise have been hard to come by, and what hackers and other groups might be doing with the data leaked from QNB remain a matter of speculation for now. QNB has since released two statements that provide a few details about the intrusion.
Banks, credit unions, and other financial institutions face major challenges when protecting financial data in today’s threat landscape and must also deal with compliance mandates for GLBA, FFIEC, SOX, PCI, and a patchwork of federal, state, and other industry regulations. For example, In March of this year, the National Futures Association enacted its Cybersecurity Interpretive Notice to help structure and strengthen members’ information security programs. These guidelines suggest that each member firm establish a written governance framework, assess and prioritize IT risks, defend specifically against identified threats and vulnerabilities, create incident response plans, and provide continuous employee training. These guidelines build on the SEC’s Cybersecurity Examination Initiative conducted by the Office of Compliance Inspections and Examinations (OCIE), which focus on six key areas in its audits:
- Cybersecurity Governance and Risk Assessments
- Access Rights and Controls
- Data Loss Prevention (DLP)
- Vendor Management
- Cybersecurity Incident Response
- Cybersecurity Awareness & Training
Banks, credit unions, and other financial institutions face major challenges when protecting financial data in today’s threat landscape. In addition to protecting consumer data and financial records, IT security teams also deal with auditing mandates for GLBA, FFIEC, SOX, PCI, and a patchwork of federal, state, and other industry regulations. In 2014, the Federal Financial Institutions Examination Council announced a new effort focusing on cyber security, including an audit of an organization’s ability to manage cyber security and mitigate cyber risk. The task of monitoring thousands of network and system events can seem overwhelming. EiQ’s SOCVue® hybrid SaaS security services help overcome these challenges by providing the right people, process, and technology in order to deliver increased security visibility and guidance to effectively reduce cyber risks and meet compliance requirements.
In the world of cyber security, sometimes there’s good news and sometimes there’s bad news. The Telegraph recently reported that a fortuitous spelling mistake in an online bank transfer stopped a nearly $1 billion (that’s billion, with a B) heist last month involving the Bangladesh central bank and the Federal Reserve Bank of New York. That’s the good news. The bad news is that the thieves, who are still unknown, managed to get away with more than $80 million, which comprises one of the largest known bank heists in history (authorities report that some of that money has since been recovered).
With big hacks making headlines seemingly every week, users and businesses alike understand the need to protect their financial data from digital compromises. Here are three online tools that can help safeguard sensitive financial information.
There are two categories of web traffic, and only one is safe for financial data. The first and most common type is information traveling over HTTP (HyperText Transfer Protocol), which is the backbone of the web. Data sent via HTTP is not encrypted—it can be read by anyone who intercepts it, such as the staff at a user's ISP. The other type of web traffic is information moving over HTTPS, which stands for HTTP Secure. Unlike information transmitted via HTTP, this data is encrypted, which makes it safer to send financial details. When users sign into their bank accounts, for example, browsers default to HTTPS and display a padlock to indicate an encrypted connection.
Experian, one of the big three credit reporting agencies in the US, revealed earlier this month that it had been the victim of a data breach. Experian’s consumer units were left untouched, but the business unit that mobile service carrier T-Mobile used to store customer data was breached. The data breach affected T-Mobile customers who sent applications in to T-Mobile from September 1, 2013 to September 16, 2015. About 15 million customers in the US had their data exposed due to this breach.