Up To Date Cybersecurity and Fraud Risks

Up To Date Cybersecurity and Fraud Risks

• Up To Date Cybersecurity and Fraud Risks

• Current threat environment
• Industry examples and case studies

• FFIEC Cybersecurity Assessments and Governance Requirements

• Strategies to mitigate and manage risks

Hackers have “monetized” their activity

• Hackers have “monetized” their activity

• More hacking
• More sophistication
• More “hands-on” effort
• Smaller organizations targeted

• Social engineering on the rise

• Hackers targeting members and member businesses

Organized Crime

• Organized Crime

• Wholesale theft of personal financial information

• CATO– Corporate Account Takeover

• Use of online credentials for ACH, CC and wire fraud

• Ransomware

• Your data held for ransom

Target

• Target

• Home Depot

• Goodwill

• Jimmy Johns

• Neiman Marcus

• Dairy Queen

• Sally Beauty

• Harbor Freight

Carder or Carding websites

• Carder or Carding websites

• A peek inside a carding operation:

• http://krebsonsecurity.com/2014/06/peek-inside-a-professional-carding-shop/

Catholic church parish

• Catholic church parish

• Hospice

• Finance company

• Main Street newspaper stand

• Electrical contractor

• Utility company

• Industry trade association

• Rural hospital

• Mining company

• On and on and on and on……………..

a payment order received by the [bank] is “effective as the order of the customer, whether or not authorized, if the security procedure is a commercially reasonable method of providing security against unauthorized payment orders, and the bank proves that it accepted the payment order in good faith and in compliance with the security procedure and any written agreement or instruction of the customer restricting acceptance of payment orders issued in the name of the customer.”

• a payment order received by the [bank] is “effective as the order of the customer, whether or not authorized, if the security procedure is a commercially reasonable method of providing security against unauthorized payment orders, and the bank proves that it accepted the payment order in good faith and in compliance with the security procedure and any written agreement or instruction of the customer restricting acceptance of payment orders issued in the name of the customer.”

Choice Escrow vs BancorpSouth

• Choice Escrow vs BancorpSouth

• $440,000 stolen via single wire through CATO

• CE passed on dual control offered by the bank

• Court ruled in favor of bank

• CE attorneys failed to demonstrate bank’s procedures were not commercially reasonable

Multi-layer authentication

• Multi-layer authentication

• Multi-factor authentication

• Out of band authentication

• Positive pay

• ACH block and filter

• IP address filtering

• Dual control

• Activity monitoring

• Manual vs. Automated controls

Malware encrypts everything it can interact with

• Malware encrypts everything it can interact with

• i.e. anything the infected user has access to

• CryptoLocker

• Kovter

• Also displays and adds child pornography images

• May 20, 2014 – Ransomware attacks doubled in last month (7,000 to 15,000)

• http://insurancenewsnet.com/oarticle/2014/05/20/cryptolocker-goes-spear-phishing-infections-soar-warns-knowbe4-a-506966.html

• Working (tested) backups are key

Reliance/dependence on 3rd party service providers is at root of most breaches

• Reliance/dependence on 3rd party service providers is at root of most breaches

Social Engineering relies on the following:

• Social Engineering relies on the following:

• The appearance of “authority”

• People want to avoid inconvenience

• Timing, timing, timing…

“Hi, this is Randy from Fiserv users support. I am working with Dave, and I need your help…”

• “Hi, this is Randy from Fiserv users support. I am working with Dave, and I need your help…”

• Name dropping
• Establish a rapport
• Ask for help
• Inject some techno-babble
• Think telemarketers script

• Home Equity Line of Credit (HELOC) fraud calls

• Ongoing high-profile ACH frauds

Impersonate someone in authority and:

• Impersonate someone in authority and:

• Ask them to visit a web-site
• Ask them to open an attachment or run update

• Examples

• Better Business Bureau complaint
• http://www.millersmiles.co.uk/email/visa-usabetter-business-bureaucall-for-action-visa
• Microsoft Security Patch Download

(Ongoing) user awareness training

• (Ongoing) user awareness training

• SANS “First Five” – Layers “behind the people”

• Secure/Standard Configurations (hardening)
• Critical Patches – Operating Systems
• Critical Patches – Applications
• Application White Listing
• Minimized user access rights
• No browsing/email with admin rights

• Logging, Monitoring, and Alerting capabilities

• “The 3 R’s”: Recognize, React, Respond
• More on this at the end…

Issued on February 12, 2013

• Issued on February 12, 2013

• The cyber threat to critical infrastructure … represents one of the most serious national security challenges…to the national and economic security of the US

• Enhance the security and resilience of the Nation's critical infrastructure
• Maintain a cyber environment that encourages efficiency, innovation, and economic prosperity while promoting safety, security, business confidentiality, privacy, and civil liberties.
• Partnership with the owners and operators of critical infrastructure

Definition of Critical Infrastructure

• Definition of Critical Infrastructure

• Cybersecurity Information Sharing

• Privacy and Civil Liberties Protections

• Consultative Process

• Baseline Framework to Reduce Cyber Risk to Critical Infrastructure

• Voluntary Critical Infrastructure Cybersecurity Program

• Identification of Critical Infrastructure at Greatest Risk

• Adoption of Framework

• Updates to NIST Framework (CSF)

Definition of Critical Infrastructure

• Definition of Critical Infrastructure

• Systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.

https://www.fdic.gov/news/news/financial/2014/fil14021.html

• https://www.fdic.gov/news/news/financial/2014/fil14021.html

https://www.fdic.gov/news/news/financial/2014/fil14021.html

• https://www.fdic.gov/news/news/financial/2014/fil14021.html

Importance of identifying emerging cyber threats and the need for Board/C-suite involvement, including:

• Importance of identifying emerging cyber threats and the need for Board/C-suite involvement, including:

• Setting the tone at the top and building a security culture
• Identifying, measuring, mitigating, and monitoring risks
• Developing risk management processes commensurate with the risks and complexity of the institutions
• Aligning cybersecurity strategy with business strategy and accounting for how risks will be managed now and in the future
• Creating a governance process to ensure ongoing awareness and accountability
• Ensuring timely reports to senior management that include meaningful information addressing the institution's vulnerability to cyber risks

https://www.fdic.gov/news/news/financial/2014/fil14021.html

• https://www.fdic.gov/news/news/financial/2014/fil14021.html

https://www.fdic.gov/news/news/financial/2014/fil14021.html

• https://www.fdic.gov/news/news/financial/2014/fil14021.html

https://www.fdic.gov/news/news/financial/2014/fil14021.html

• https://www.fdic.gov/news/news/financial/2014/fil14021.html

https://www.fdic.gov/news/news/financial/2014/fil14021.html

• https://www.fdic.gov/news/news/financial/2014/fil14021.html

Each FFIEC agency (FDIC, Federal Reserve, OCC, NCUA) will perform periodic information technology examinations at regulated financial institutions.

• Each FFIEC agency (FDIC, Federal Reserve, OCC, NCUA) will perform periodic information technology examinations at regulated financial institutions.

• Examination procedures are based on the FFIEC IT Handbooks (http://ithandbook.ffiec.gov/) and supplemented by periodic agency guidance.

• IT Examinations review the financial institution’s Information Security Program.

Section 501(b) of the Gramm-Leach-Bliley Act of 1999 (GLBA) for the safeguarding of customer information

• Section 501(b) of the Gramm-Leach-Bliley Act of 1999 (GLBA) for the safeguarding of customer information

• Board of Directors will develop an Information Security Program that addresses the requirements of:
• Section 501(b) of the GLBA;
• Federal Financial Institutions Examination Council’s (FFIEC) “Interagency Guidelines Establishing Information Security Standards” (501[b] Guidelines); and
• Agency-specific guidelines (i.e. Appendix B to Part 364 of the FDIC’s Rules and Regulations)

• The Information Security Program (ISP) is comprised of:

• Risk Assessment
• Risk Management
• Audit
• Business Continuity/Disaster Recovery/Incident Response
• Vendor Management
• Board and Committee Oversight

Assess risk periodically to identify reasonably foreseeable internal and external threats to data and information technology assets that could negatively impact confidentiality and integrity of data and/or availability of systems.

• Assess risk periodically to identify reasonably foreseeable internal and external threats to data and information technology assets that could negatively impact confidentiality and integrity of data and/or availability of systems.

• Risk is determined based on the likelihood of a given threat-source’s ability to exercise a particular potential vulnerability, and the resulting impact of that adverse event on the organization.

• The results of the risk assessment are used as a basis for establishing and implementing appropriate administrative, technical, and physical controls to reduce or eliminate the impact of the threat.

ISP-related Audits/Reviews

• ISP-related Audits/Reviews

• ISP Review/IT General Controls Review
• External/Internal Vulnerability and Penetration Assessments
• Social Engineering Assessments

• E-Banking Reviews

• ACH Audit
• Wire Transfer Audit
• Remote/Mobile Deposit Capture Audit

• Audit/Exam Recommendation Tracking and Reporting

Business Continuity/Disaster Recovery Plan

• Business Continuity/Disaster Recovery Plan

• Annual Testing of Critical Systems
• Annual Employee Tabletop/Scenario Testing
• Board Reporting

• Incident Response Plan

• Compromise of customer information
• Annual Testing
• FS-ISAC
• Cybersecurity Examinations?

Vendor Management Policy

• Vendor Management Policy

• Vendor Risk Assessment

• Access to Customer Information
• Criticality to Bank Operations
• Ease of Replacement

• New Vendor Due Diligence and Annual Reviews

• Continuous Monitoring

In the summer of 2014, the Federal Financial Institutions Examination Council (FFIEC) agencies piloted new Cybersecurity Assessment procedures at over 500 community financial institutions to raise awareness of and evaluate their preparedness to mitigate cybersecurity risks.

• In the summer of 2014, the Federal Financial Institutions Examination Council (FFIEC) agencies piloted new Cybersecurity Assessment procedures at over 500 community financial institutions to raise awareness of and evaluate their preparedness to mitigate cybersecurity risks.

• Integrated into regular IT Examination process

• Cyber Risk Management and Oversight
• Cyber Security Controls
• External Dependency Management
• Threat Intelligence and Collaboration
• Cyber Resilience

• Launched a cybercrime website https://www.ffiec.gov/cybersecurity.htm

FFIEC Cybersecurity Threat and Vulnerability Monitoring and Sharing Statement (11/3/14)

• FFIEC Cybersecurity Threat and Vulnerability Monitoring and Sharing Statement (11/3/14)

• All FIs AND their critical technology service providers must have appropriate threat identification, information sharing, and response procedures.

• Recommendation to participate in the Financial Services Information Sharing and Analysis Center (FS-ISAC)

• Improved identification and mitigation of attacks
• Better identification and understanding of specific vulnerabilities and necessary mitigating controls for systems
• Sharing information to help other FIs

FFIEC Cybersecurity Threat and Vulnerability Monitoring and Sharing Statement (11/3/14)

• FFIEC Cybersecurity Threat and Vulnerability Monitoring and Sharing Statement (11/3/14)

• FI Management should:

• Monitor and maintain sufficient awareness of cybersecurity threats and vulnerability information so they may evaluate risk and respond accordingly
• Establish procedures to evaluate and apply the various types and quantity of cyber threat and vulnerability information to meet the needs of their organization
• FS-ISAC: www.fsisac.com
• FBI Infragard: www.infragard.org
• U.S. Computer Emergency Readiness Team at US-CERT: www.us-cert.gov
• U.S. Secret Service Electronic Crimes Task Force: www.secretservice.gov/ectf.shtml

FFIEC Cybersecurity Assessment General Observations

• FFIEC Cybersecurity Assessment General Observations

• Cybersecurity Inherent Risk

• Management must understand the FIs INHERENT RISK when assessing cybersecurity preparedness
• Connection Types: identify and assess the threats to all access points to the internal network
• VPN
• Wireless
• Telnet/FTP
• Vendor LAN/WAN access
• BYOD

FFIEC Cybersecurity Assessment General Observations

• FFIEC Cybersecurity Assessment General Observations

• Cybersecurity Inherent Risk (cont.)

• Products and Services: identify and assess threats to all products and services currently offered and planned
• Online ACH and Wire Transfer origination
• External funds transfers (A2A, P2P, bill pay)

FFIEC Cybersecurity Assessment General Observations

• FFIEC Cybersecurity Assessment General Observations

• Cybersecurity Inherent Risk (cont.)

• Technologies Used: identify and assess threats to all technologies currently used and planned
• Core systems
• ATMs
• Internet and mobile applications
• Cloud computing

FFIEC Cybersecurity Assessment General Observations

• FFIEC Cybersecurity Assessment General Observations

• Cybersecurity Preparedness

• Current cybersecurity practices and overall preparedness should include:
• Cybersecurity Controls: Preventive, detective, or corrective procedures for mitigating identified cybersecurity threats
• Patching, encryption, limited user access
• Intrusion detection/prevention systems, firewall alerts
• Formal audit program with scope and schedule based on an asset’s inherent risk, prompt and documented remediation of findings, regular activity report reviews

FFIEC Cybersecurity Assessment General Observations

• FFIEC Cybersecurity Assessment General Observations

• Cybersecurity Preparedness (cont.)

• Cyber Incident Management and Resilience: Incident detection, response, mitigation, escalation, reporting, and resilience
• Formal Incident Response Programs, including regulatory and customer notification guidelines and procedures
• Senior management and board incident reporting

FFIEC Cybersecurity Assessment Implications?

• FFIEC Cybersecurity Assessment Implications?

• Increased Board and C-Suite Involvement

• Participation in information-sharing group(s)

• Cybersecurity scenario testing with employees and management

• Increased oversight of third-party service providers

• Documentation on how FI is addressing the FFIEC Cybersecurity Assessment findings

Our information security strategy should have the following objectives:

• Our information security strategy should have the following objectives:

• Users who are more aware and savvy

• Networks that are resistant to malware

• Be Prepared… Monitoring, Incident Response, and forensic Capabilities

Strong policies

• Strong policies

• Defined user access roles Minimum Access

• Hardened internal systems and end points

• Encryption strategy – data centered

• Vulnerability management process

Centralized audit logging, analysis, and automated alerting capabilities (SIEM)

• Centralized audit logging, analysis, and automated alerting capabilities (SIEM)

• Firewalls
• Security appliances
• Routing infrastructure
• Network authentication
• Servers
• Applications ***
• Archiving vs. Reviewing

Policies to set foundation

• Policies to set foundation

• Train your users

• Thoroughly assess your risks

• Three R’s: Recognize, React, Respond

• Thoroughly validate your controls

• High expectations of your vendors
• Penetration testing
• Application testing
• Vulnerability scanning
• Social engineering testing

Jim Kreiser, CISA, CRMA, CFSA

• Jim Kreiser, CISA, CRMA, CFSA

• Principal

• Business Risk and Information Security Services

• [e-mail]

• 410-453-0900