Cybersecurity in the Financial Sector is Improving

The Synack 2020 Trust Report Ranks Financial Services Institutions as #2 in Improving Cybersecurity Over the Past Year.

Congratulations! The financial industry scored 11% higher than all other sectors in The Synack 2020 Trust Report, coming in just behind government agencies.

Does that mean your job, in terms of cybersecurity at your community bank or credit union, is done?

Of course not — no matter how effective your cybersecurity solutions and processes may be right now, you can’t pat yourself on the back.

Maintaining your cybersecurity means continually improving and adapting, staying one step ahead of the ever-evolving methods cybercriminals use to target community banks and credit unions like yours.

Even though the financial sector did well in improving its collective cybersecurity this year, that’s not to say it won’t be affected in the same ways as industries that didn’t.

How Did Other Industries Fail To Improve Their Cybersecurity?

It may surprise you to learn that the IT services and consulting sector’s scores dropped in this year’s Trust Report.

Why? Because of digital transformation.

Digital transformation is the initiative to use technology for better business outcomes. It’s one of the biggest buzz phrases going around the business community right now, and for a good reason.

Incorporating new technologies into business processes can do a lot to boost efficiency, productivity, and convenience in the user-experience. However, it’s a double-edged sword.

The more expansive your IT environment is, the more technologies it incorporates, the more devices your staff uses for work, the more potential security risks there are. Synack found that organizations embracing digital transformation often increased the number of vulnerabilities present in their systems.

How Can You Avoid the Same Mistakes?

This isn’t to say you shouldn’t consider harnessing the advantages of new technologies. You just have to do so carefully.

Suppose you’re looking to modernize your community bank or credit union, for example, by migrating to the cloud or incorporating mobile devices into your work. In this case, you need to make sure you understand the risks and can eliminate them.

Securing The Cloud For Your Financial Services Institution

As convenient and beneficial as the cloud could be for your organization, it can expose you to numerous risks if not managed properly.

At the core of this issue is that using the cloud necessitates cooperation with and trust in a third-party cloud vendor. When it comes to compliance regulations and security standards for sensitive financial information, these relationships can be challenging to navigate.

Do you know your responsibilities when it comes to the security and management of your cloud-based data?

In a recent Financial Institution Letter (FIL-52-2020), The Federal Financial Institutions Examination Council (FFIEC) outlined your responsibilities and the key risks which need to be mitigated when using the cloud.

Your Data Management Responsibilities Based On the Cloud Service Model

• Software as a Service (SaaS): Saas is a software licensing and delivery model. The software is centrally hosted, licensed, and offered on a monthly or annual basis. SaaS is the standard delivery model for most applications. Your institution is likely not expected to manage, maintain, or control the underlying cloud infrastructure or individual application capabilities. However, you are responsible for user-specific application configuration settings, user access, and identity management, and for managing the risk of the relationship with the cloud service provider.
• Platform as a Service (PaaS): PaaS provides a platform for users to develop, run, and manage applications. It eliminates the complexity of building and maintaining the infrastructure for the applications. This model mostly involves the same responsibilities and risks as SaaS. However, there are a few additional responsibilities for you when it comes to managing the service:
  • Appropriate provisioning and configuration of cloud platform resources
  • Implementing and managing controls over the development, deployment, and administration of applications residing on the provider’s cloud platforms.

The bottom line is that the provider is only responsible for the foundational infrastructure and platforms.

• Infrastructure as a Service (IaaS): This model allows you to access an IT infrastructure on an outsourced basis and provides hardware, storage, servers, data center space, and software if needed. It’s used on-demand rather than requiring you to purchase equipment. That means you don’t have to expend the capital to invest in new hardware. Similar to PaaS, you would be responsible for provisioning and maintaining the platform and applications, as well as any necessary controls. The provider manages all aspects, security and otherwise, related to the physical infrastructure they’re providing. However, you may also need to make sure your platform integrates with the provider’s recovery and resilience processes. As with the other models, you’re responsible for managing the relationship’s risk with the cloud service provider.

Securing The Cloud For Your Community Bank Or Credit Union

To mitigate the risks posed to you by using cloud services and sharing data with a third-party, the FFIEC recommends the following cybersecurity best practices:

• IT Alignment & Governance: Make sure your cloud services use aligns with your overall IT strategies and processes. The way you govern and manage data internally should be applied to any cloud-based data.
• Oversight Of Cloud Provider Security: As mentioned above, it’s your responsibility to manage the relationship’s inherent risk with the cloud provider. That means dictating processes for oversight and monitoring their security regularly.
• Documented Responsibilities: Yours and the provider’s responsibilities need to be clearly laid out, documented, and contractually agreed upon. This can and should include anything from the management of system access rights to vulnerability scanning to notification of or approval requirements for a subcontractor’s use.
• Data Inventory: You should have a clear picture of exactly which data reside in the cloud, who has access rights to it, and how it is protected. This will provide a clearer understanding of how your organization is integrated into the cloud and help with any future transitions between cloud providers.
• Security Configuration: You need to make sure cloud resources are configured appropriately to prevent unauthorized access to your cloud data. Whether you are managing this on your end, the cloud provider is on their end, or you’re using tools from industry organizations, you need to make sure it’s configured securely.
• Identity And Access Management: You need to make sure access management is being securely maintained, which includes limiting account privileges, implementing multi-factor authentication, frequently updating and reviewing account access, monitoring activity, and requiring privileged users to have separate usernames and passwords for each segment of the cloud service provider’s and financial institution’s networks.
• Security Awareness Training: It’s essential to make sure your staff is fully aware of their cybersecurity role as the user. How they use the cloud service in question can significantly impact your institution’s degree of risk.
• Change Management: Any change management and software development life cycle practices you have in place need to be adapted to suit the cloud environment.
• Recovery And Resilience: As storing data in the cloud both provides a contingency for recovery, as well as a range of new opportunities for data loss and compromise, you must make sure your data continuity processes are carried over to the cloud environment. Not all cloud providers offer the same capabilities for recovery and resilience, and so it’s your responsibility to make sure they meet your needs.
• Incident Response: Since you have shared responsibility with the cloud provider, your internal and local incident response strategies need to include considerations for the cloud. Your contract needs to dictate responsibilities for incident reporting, communication, and forensics.
• Regular Auditing: Given the risks of utilizing cloud services, you need to audit how your data is secured and managed regularly. This can include reviewing and testing your security configurations and settings, access management controls, and security monitoring programs.
• Cloud-Specific Controls: Whether it’s a virtual infrastructure or containers, any cloud-specific services need to be managed with the same degree of security and care as conventional IT environments. Make sure your cloud provider is managing your data, integrated into whichever service, in line with your security requirements.
• Data Destruction: Don’t forget to dictate clear processes for how data is to be destroyed in order to prevent any unauthorized disclosure of that information.

This big of a project, involving this many considerations, can be difficult for a lone internal IT manager, or even a small IT team to handle — that’s why you should enlist expert assistance.

The right IT company can help you evaluate your next IT project’s potential risks, ensuring that you get all the benefits without security vulnerabilities. This way, you can digitally transform your financial services institution without taking on additional risk.

Looking For Michigan Based Cybersecurity Expertise To Help You Stay Secure During Digital Transformation?

1. Book a meeting with our team of financial technology experts at your convenience
2. Find out exactly what services will allow you to achieve compliance and superior member service
3. Enjoy knowing you’re prepared for a state or federal exam with secure, seamless operations

Randall Brinks

RedRock offers a full range of compliance-focused IT services including help desk, server and network management, perimeter and endpoint security, and associated hardware and software. What makes us unique is how we bake security into everything we do. We are regulated by the FDIC, NCUA, and DIFS. We undergo regular exams and audits by 3rd party assessors. This oversight offers our customers the peace of mind that multiple entities look at our products, policies, procedures, financials, etc.