ticking time bombs that could cause your bank trouble · today’s cloud-first, mobile world, that...

W W W . J M A R K . C O M

TICKING TIME BOMBS THAT COULD CAUSE YOUR

BANK TROUBLE

TICKING TIME BOMBS THAT COULDCAUSE YOUR BANK TROUBLE

P A G E 2

844-44-JMARK | JMARK.COM

Your bank stores and processes vast quantities of highly sensitive information. The very nature of your business is to deal with confidential data on a daily basis. If your technology systems are compromised, either by intent or by accident, the consequences could be severe. Reputational damage and monetary losses are just some of the penalties your business may face if your enterprise suffers a data breach.

Traditionally, banks have always been aware of the importance of protecting customer information. By their very nature, banking systems have security embedded into their architecture to protect the bank and its customers from compromise. However, in today’s evolving threat landscape where cyber attacks are growing in number and sophistication, you and your staff need to be hyper-aware. Any lapse in security, no matter how insignificant, could create a doorway for hackers to infiltrate your institution, steal customer information, and destroy your reputation.

In a banking environment, the security of your network is vital. Before cloud services and mobile devices disrupted technological and business models across enterprises, securing your bank was much more straightforward. A firewall protected the internal network from external threats and I.T. managed every device. However, in today’s cloud-first, mobile world, that traditional security model is fast becoming obsolete. Banks need to open their systems to the outside world to facilitate modern banking practices. As more systems move online, and more customers start using mobile devices to do their banking, your risk increases. Below are a few ticking time bombs that could cause your bank trouble.


P A G E 3


1. Unknown or Rogue Devices on the Network

An unknown or rogue device on your network can be a severe cybersecurity risk.

Since rogue devices are unmanaged, they provide users with greater control. In a secure environment such as banking, I.T. typically restricts what a user can do with their device. The user may not be able to install software or access particular websites. If the device or computer is unmanaged, however, the user has absolute control and can perform any function. For example, they could access a site that inadvertently downloads malware that compromises the entire network.

Hackers also leverage rogue or unknown devices to perform attacks on your network. By physically placing a device in your environment, they effectively bypass any perimeter protection measures you have in place to protect your bank. Utilizing these devices, they then infiltrate your network further, compromising your systems and stealing data.

Protecting your bank from unknown or rogue devices requires a layered defensive approach: 1


P A G E 4


1. Deploying technology that manages mobile devices can help you control every device on your network.

2. Segmenting your network can also improve security as it creates boundaries and limits access to your internal systems.

3. Implementing continuous network monitoring is another solution that will assist you in securing your bank.

Modern solutions that monitor networks can identify rogue devices and assist you in mitigating threats proactively.

1


P A G E 5


2. Out-of-Date Patches

Updating your systems to the latest version is vital to securing your bank’s technology infrastructure. Vendors are continually releasing software updates that improve the security and functionality of software. Using automation, hackers scour the internet for vulnerable systems, so it is crucial that you install any security patches as soon as the software vendor releases them.

When it comes to cybersecurity, software vulnerabilities are a prime target. The majority of data breaches and system compromises occur as a result of unpatched software. In 2018, nearly 60% of organizations suffered a data breach in the preceding 24 months due to a known vulnerability that had not been patched.

Although patching your systems increases the burden on your I.T. operations, it is vital that your bank updates software on a continuous, consistent basis. Not only does this enhance the security of your organization’s I.T. infrastructure, but it can also improve efficiency and productivity. Systems running the latest version perform better and give users access to newly added features. 2


P A G E 6


3. Storing Confidential Information in Unencrypted Formats

Encryption is another vital tool that your bank must have in its cybersecurity arsenal. It stops unauthorized individuals from directly accessing data. In many instances, it is also the last line of defense.

Encryption helps mitigate the effects of a system compromise by adding another layer of protection. For example, if your bank suffers a data breach and your data is encrypted, attackers may have access to your system, but your data remains protected.

In addition to mitigating the risk of unauthorized access, encryption can also help you adhere to several compliance regulations. For example, PCI explicitly states that banks must encrypt the transmission of cardholder data across open, public networks. Encrypting data is also relevant to other PCI requirements that deal with the secure storage of cardholder information.

Other regulatory compliance frameworks such as Sarbanes-Oxley also require banking institutions to protect the confidentiality and integrity of their customer data. While they may not explicitly state that encryption is required to adhere to the regulatory standard, it is considered best practice. 3


P A G E 7


4. Lack of Employee Security Training

People are the weakest link in the security chain.

Security awareness training is vital to enhancing cybersecurity at your bank. Hackers leverage social engineering to deceive users. These criminals target users with phishing attacks where they create fake websites tricking people into entering their login credentials. They also send emails with links to sites that install malicious software, and target users with phone calls or text messages that deceive them into divulging confidential information.

According to the Verizon Data Breach Investigation Report, Phishing is directly responsible for over 70% of data breaches. This statistic shows that the deployment and strengthening of cybersecurity technologies over the years has led to hackers targeting people directly. The only way to reinforce this weak point is to train your staff. 4


P A G E 8


5. Poor Policy Management Practices

Every business needs to implement policies and practices to protect their organization from potential risk.

When it comes to cybersecurity, enterprises often publish policies that outline what users can and cannot do with their devices on the network. This include documents that detail topics such as acceptable use, access control, change management, and remote access. However, policies are only effective if an organization enforces them.

A policy is not only a document your bank creates to adhere to industry practices or comply with some regulatory standard. It is, in fact, a process. The first step is identifying the risk to your bank. Once you have identified the problem, you can then formulate a plan that puts measures in place to mitigate the risk. The policy is a strategy document that reduces risk, and you need to enforce it by continuously monitoring the environment and ensuring people conform to it.

Policies and practices are essential in any enterprise, but they are vital in a banking environment. It is crucial that you not only formulate the relevant cybersecurity policies but that you implement measures to monitor compliance. You should also ensure that you revisit them from time to time to align them with changes in your business and technology environment. They should be living processes that adapt as your bank grows and transforms.5


P A G E 9


6. Not Testing Backups

Disaster recovery (DR) and business continuity are crucial in an enterprise environment. When an unplanned incident causes your technology to fail, you must have systems and processes in place to recover them as fast as possible.

The cornerstone of every disaster recovery plan is backing up your data on a regular basis. Ensuring your bank has an offline, independent copy of your data is vital to recovering your systems should they suffer a catastrophic failure.

The vital component in the data backup process that many organizations often neglect is not testing them on a regular basis. The fact is that storage media is not infallible. Corrupt data on a backup tape or hard drive is not unheard of, and these physical devices can also suffer complete failure. Even cloud backups run the risk of data corruption.

The only way to ensure that your bank can recover from an unplanned catastrophic incident is to test the recoverability of your data backups on a regular basis. Not only does this vital process make sure that you can recover your data, but it can also identify gaps in the information you are backing up. As your bank grows, new systems come online, and new data sources need to be backed up. Testing your backups on a regular basis ensures you can recover your information and that you are backing up all your critical data. 6


P A G E 10


7. Key People Risk

In technology, we often build redundancy into every system to mitigate the risk of a single point of failure. This resilience ensures that should a single component fail, the system remains functional. Building redundancy into your banking systems should not be limited to technology. As people are a vital component in any technology environment, your bank should have measures in place to ensure that your systems do not rely on a single individual to function.

Systems administrators are a vital element in managing and maintaining your banking systems. They ensure that your technology environment runs smoothly by attending to daily operational activities. From a security perspective, administrators have the most power on a network. They hold the credentials that effectively have access to every system that runs your banking operations. Ensuring other people have access to these administrative credentials must form part of your cybersecurity practices.

Administrators are people. They could pass away unexpectedly or leave the organization in less than favorable circumstances, taking their administrative credentials with them. If the organization does not have a mechanism to retrieve these credentials, their systems would be at risk.7


P A G E 11


In the worst-case, if the administrator were the only individual that had access, the enterprise would effectively be locked out of their systems.

Another scenario would be where administrators leave and still have access to your bank’s technology environment. In these circumstances, they pose a significant risk to your institution.

Every organization must ensure they secure access to their administrative credentials. As these are the keys to the kingdom, you must have a process in place that securely stores them in some form of password vault. You should also ensure that more than one individual has access, as well as be sure to revoke an individual’s administrative privileges when they leave your business.

7


P A G E 12


8. No Cyber-Liability Insurance

Every organization operating in today’s digitally-driven economy must have some form of cyber-liability insurance. The fact is that threats against online systems are growing in both frequency and sophistication. Hackers are continuously finding new ways to compromise systems and even organizations with multiple defensive technologies have fallen victim to a data breach.

Risk management is a core requirement in any banking environment. With cyber threats evolving and increasing it is prudent to invest in insurance that will cover your losses should you become the victim of a data breach. Typically, cyber-liability insurance policies include elements such as cover for the loss or damage of electronic data, the loss of income and expenses related to the cyber attack, and even cyber extortion losses for ransomware incidents.

A cyber-liability insurance policy adds another layer of cybersecurity protection for your bank. When all else fails, it is the last line of defense and the risk management measure that ensures your bank will survive a crippling cyber incident.8


P A G E 13


9. Lack of Security Monitoring

Implementing solutions that can identify potential issues before they impact your operations is crucial in technology-driven organizations.

Modern platforms can monitor your bank’s technology environment, identify possible problems, and help you remedy them proactively. Not only do these monitoring solutions help you stay ahead of system outages, enable you to fix issues faster, and help you manage your growing infrastructure, but they can also identify potential security threats.

When it comes to securing your bank from a possible cyber attack, you need a layered, defensive cybersecurity strategy that includes proactive monitoring. Solutions that offer network monitoring provide the insight you need to mitigate potential security threats. They provide a baseline for your technology environment and help you detect any anomalies. For example, incidents such as an unusual spike in traffic, or a service running above a preset threshold, may indicate the presence of malware. They can also detect rogue or unknown devices on the network, helping you mitigate the risk these devices introduce into your environment. 9


P A G E 14


An intrusion detection system (IDS) or an intrusion prevention system (IPS) are specialized network security monitoring tools.

• An IDS uses a variety of techniques to detect and alert you to possible security threats.

• An IPS adds another layer of security by identifying threats and defending your network by mitigating attacks automatically.

Implementing these dedicated security monitoring platforms adds another layer to your bank’s cybersecurity. They help you monitor and protect your technology environment proactively.

9


P A G E 15


10

10. Poor/No Spam Protection

Phishing is the leading cause of most data breaches. While cybersecurity awareness training is an effective way to reduce this security risk, some technologies can also defend against this type of attack. As email is the most common threat vector leveraged by cybercriminals to launch phishing campaigns, implementing an antispam solution is another measure you can take to protect your bank.

Antispam platforms filter email before it arrives in your environment. By removing the threat before it reaches your user base, they help limit the potential effects of a phishing campaign. Antispam solutions are also an effective measure against malware. These platforms continuously scan your organization’s email for attachments or links that contain viruses, trojans, or other forms of malicious software that could compromise your network.

The performance of your bank’s network is vital to the efficiency of your operations. Antispam solutions not only assist in mitigating the risk of phishing and malware, but they also improve the productivity of your bank. By filtering unwanted email before it reaches your network, they improve system performance. They also increase the efficiency of your staff, as they will not need to process unsolicited email messages.


P A G E 16


Protect Your Bank with a Defense In Depth Security Mindset

Keeping up with the rapid pace of technology change while also defending your bank against continuously evolving threats is challenging. Remaining proactive and deploying multiple layers of security is vital to ensuring your organization does not become the next victim of a cyber attack or data breach. In the ever-changing world of cybercrime, your business needs a multi-tiered approach to security.

• Managing every device on your network, ensuring you patch your software, and training your employees are some steps you can take to increase your bank’s information security.

• Enforcing security policies, regularly testing your backups, and ensuring you have redundancy in both systems and people are further measures that can help improve your cybersecurity.

• Implementing technologies such as security monitoring platforms and antispam solutions give you the ability to face cyber threats proactively.

• Finally, as no defense is fool-proof, investing in cyber-liability insurance is a prudent measure of last resort.


P A G E 17


JMARK Can Help

JMARK has been named as one of the top I.T. Security Providers in the world by multiple industry publications, and we have thirty years of experience employing the best security tools to keep financial institutions safe from a changing landscape of ever-increasing cyber threats. We can also help with backup, policy management, compliance, and mobile device management—along with a host of other I.T. issues.

If you think your bank may have even one of these ticking time bombs hiding behind the scenes, counting down until the day it causes you enormous trouble, contact us today. Our expert network assessment can help you discover any unnoticed problems, and our experienced security and financial services teams can form an action plan to defuse the trouble before it explodes.


P A G E 18


People First. Technology Second.

For thirty years, JMARK has been providing innovative I.T. solutions to financial institutions of all sizes. With all that experience comes extensive expertise. We understand the challenges that modern banks face and can help you maintain continuity and efficiency, even in the midst of the continual changes occurring in technology needs and expectations. It is our mission to ensure that your technology supports your vision and goals.

Most importantly, at JMARK, we put people before technology. Everything we do, every service we offer, is a reflection of our “People First, Technology Second” philosophy. Because while we love technology, we also understand that I.T. is only useful when it serves to empower people and enhance the work they do; work that, in turn, can facilitate growth, spur innovation, increase opportunity, and open up new paths to success for every bank.

Contact JMARK today and let us show you what our I.T. services can do for your business.

844-44-JMARK – [email protected] – JMARK.com


P A G E 19


Some of Our Primary Partners

ticking time bombs that could cause your bank trouble · today’s cloud-first, mobile world, that...

Documents