Attention: The Safe Systems website is transitioning to UFSTech.com. Starting on April 8, 2025, links to our client portal, news, and blog posts will only be accessible there.

Category: Credit Unions

26 Dec 2024
Banks, Credit Unions, Security, Technology Jamie Davis 0 comment

Navigating M365 Security: Insights from Our 4-Part Immersion Training

The highly anticipated and well-attended M365 Security Immersion Training event explored the nuances of Microsoft 365 (M365) security. Led by seasoned experts and M365-certified security administrator associates, this series offered critical insights into Conditional Access Policies, Azure/Entra ID tenant configurations, and the transformative role of Artificial Intelligence (AI) in community banking. For those bankers eager to strengthen their security strategies and mitigate unauthorized access threats, each webinar session was recorded and is now available to watch. Below is a summary of the valuable lessons, hands-on guidance, and actionable takeaways from each session:

Part 1: Understanding and Avoiding Misconfigurations in Conditional Access Policies

Conditional Access Policies (CAPs) are critical to safeguarding your financial institution’s sensitive data. However, when misconfigured, they pose a substantial risk. The opening session inspected the typical errors within CAP setups and explained in detail how to rectify them. Participants learned about the essential terminology—like Entra ID and Named Locations—and got acquainted with common pitfalls, which include the exclusion of Break Glass Accounts, the improper definition of Named Locations, and overlooking Multi-factor Authentication (MFA) requirements. The training emphasized the importance of ongoing CAP management and shared best practices for future-proofing these security measures against potential threats.

Part 2: Elevate Your M365 Security Game

The second session delved into Microsoft 365’s robust security infrastructure, differentiating it from Office 365 by focusing on security, identity, and compliance. Our experts unraveled M365’s key security features—like Security Defaults, Global Auditing, and the reformation of mailbox protocols—and stressed best practices for managing these components. It highlighted the significance of applications, stopping user unauthorized trials or purchases, managing administrative roles, and ensuring secure email communications. It also provided a handy infographic to explore overlooked M365 security features to help you implement everything needed under your license type. Overall, this hands-on training demonstrated why keeping pace with such security measures is vital to preventing evolving cyber threats.

Part 3: Mastering Azure Tenant Configuration: CAPs and Intune Deployment

Azure, known for its expansive capabilities, demands meticulous configuration to leverage its potential fully. This session provided guidance on managing Azure/Entra ID tenants effectively, implementing CAPs, and deploying Intune. It covered essential aspects such as user-based exceptions for CAPs, Intune objectives, and tips for device and network maintenance. Attendees gained insights into crafting and enforcing policies that address unauthorized device access and ensure compliance with application usage, alongside strategies for regular device and policy maintenance to bolster their security.

Part 4: AI Governance and Accountability in Azure

Exploring the growing role of Artificial Intelligence (AI) in banking, this concluding session emphasized understanding governance and responsibility in deploying AI tools like Microsoft Copilot. It explained Copilot’s features and architecture, the importance of access control, and the implications of global data handling. With comprehensive insights, participants were shown how to balance innovation with security and compliance, maximizing data utility while safeguarding organizational integrity.

Watch All Four Sessions

These sessions provide security best practices and strategic insights into managing M365 environments effectively. Packed with practical demonstrations, expert advice, and interactive segments, the M365 Security Immersion Training is invaluable for financial institutions seeking to strengthen their security posture. Now you can access all recordings and tap into the wealth of knowledge this series offers.

07 Nov 2024
Banks, Credit Unions Jamie Davis 0 comment

Unmanaged Azure Tenants: A Hidden Security Risk

If your institution uses Exchange Online or Microsoft 365 for email, you have a Microsoft Azure tenant. However, many institutions are unaware that this tenant requires management and continuous monitoring to ensure security and efficiency. Certain settings should be locked down by default, others require adjustments, while some require ongoing monitoring. In serving hundreds of community banks and credit unions across the US, we have identified numerous tenants that are either unmanaged or improperly managed. This exposes vulnerabilities that bad actors can exploit, potentially leading to compromised accounts and data exfiltration.

Outlined below are some common issues we have encountered. The numbers referenced are based on the average annual count of activities per 100 institutions.

Compromised User Accounts

Each year, we observe approximately 1,000 successful logins from outside the United States. While some of these logins occur when employees are traveling, many do not. Often these logins indicate a compromised account.

Institutions should block or limit logins from outside the US based on business requirements and employee work patterns, while also monitoring and alerting for these occurrences.

Unknown Users

While exact numbers are unavailable, we often encounter this issue when conducting reviews with customers. We frequently discover accounts that the institution cannot identify and are not associated with current employees. Some of these may be old accounts that were not deactivated upon an employee’s departure. However, there is a risk that some of these accounts were created by bad actors with malicious intent. In some cases, we discovered that the accounts were created with administrator privileges, allowing cybercriminals full access.

Forwarding of Emails to Outside Accounts

Email forwarding or redirection is added to email accounts approximately 700 times a year. Discussions with multiple institutions revealed that, in many cases, these settings were not configured by authorized personnel. Bad actors are using this method to monitor the emails of specific accounts long after they have lost direct access.

Permissions to Access Someone’s Email Account (e.g., “Send as,” “On behalf of”)

Much like the previous example, email account settings are frequently being altered. However, instead of merely redirecting emails, they allow unauthorized individuals to send emails on behalf of someone else. We observe this occurring approximately 2,600 times annually. These changes are often unknown to the institution, indicating that a bad actor potentially gained control of an email account.

Unauthorized Use of Sharing Tools to Share Files with External Users (e.g., OneDrive)

Many institutions say their employees are prohibited from sharing files outside the organization. However, we encounter numerous instances where this is not actually enforced. Safe Systems, for example, observes approximately 2,000 files shared externally through OneDrive each year. This discrepancy highlights a common issue: having expectations without the technical knowledge to enforce them effectively.

Insecure Protocols Enabled

We do not have specific instances of exploits from insecure protocols as we address these during our initial customer setups. However, it is important to note that establishing the correct protocols is critical to ensuring your Azure tenant remains safe and secure.

Attempts to Log in as a User

While some end users may find multifactor authentication (MFA) burdensome, it is essential in today’s cybersecurity landscape. We observe around 50 instances annually where logins from outside the US had the correct passwords but failed the MFA requirement. These are almost certainly bad actors that were not able fully compromise the account simply because of MFA. We have also observed over 6,000 instances of “a large number” of failed login attempts (as defined by Microsoft) annually. Both statistics underscore the vital role MFA plays in restricting unauthorized access.

Configuring your tenant securely and implementing Conditional Access Policies (CAPs) with appropriate compensating controls are crucial steps in mitigating these types of risks. Regular monitoring and alerting on suspicious activities are equally important. This is why we developed M365 Security Basics to enhance visibility, reporting, and alerting for security settings within Entra ID (formerly Azure Active Directory). This tool is designed to help community banks and credit unions, like yours, identify and mitigate common security risks more effectively.

10 Oct 2024
Banks, Credit Unions, Security Eric Delgado 0 comment

Elevate Your M365 Security Game: Tips from Our Certified Pros!

In a recent webinar, our M365-certified security administrators provided an in-depth look at various Microsoft 365 building blocks such as security configurations, features, and policies. The session also covered the significance of secure email protocols, data protection, and the continuous evolution of cloud security technologies.

This blog highlights several key security features and best practices to help you protect your institution’s data and ensure that only authorized users gain access to critical systems.

Understanding Key Terminology

M365 vs. Office 365

Office 365 features familiar tools such as Exchange Online, SharePoint, OneDrive, and Teams. Microsoft 365 (M365) enhances this suite by incorporating additional technologies focused on security, identity, and compliance, offering a more comprehensive package.

Entra ID

Essential for identity management, Entra ID covers users, devices, endpoints, and service principals, forming the backbone of various security configurations.

Security, Identity, and Compliance (SIC)

These conceptual buckets guide the technological frameworks and policies that ensure data security, identity assurance, and regulatory compliance.

M365 Security Features Breakdown

Security Defaults

Security Defaults are designed to provide a pre-configured baseline level of security by enforcing numerous non-customizable policies and settings. Among the policy sets is one requiring multifactor authentication (MFA) device registration for all new Azure accounts with at least one sign-in. However, registration does not equal enforcement. Security Defaults will only enforce MFA conditionally based on Microsoft’s analysis.

Consider implementing per-user MFA policies to ensure comprehensive enforcement, closing gaps that might be exploited if only Security Defaults are relied upon.

Applications

Registered Applications and Enterprise Applications can pose significant risks if not properly managed. By default, Microsoft allows users to register applications, which could potentially introduce security vulnerabilities without an administrator’s knowledge.

Consider disabling this default feature and actively managing which applications receive permissions to ensure there is no unauthorized access.

Global Auditing

Microsoft’s Purview compliance technology includes a crucial feature—global auditing—that logs all actions within the organization. If compromised, these logs are vital for forensic investigations to determine the breach’s extent and enact proper remediation steps.

Consider enabling this setting, which is disabled by default.

Office Store and Trial Accounts

Allowing users to purchase licenses and trials with their work identities, including AI tools like Copilot, may expose sensitive data inadvertently.

Consider disabling the ability for users to make these purchases on their own, as restricting user capabilities ensures organizational oversight and protects against data breaches stemming from unauthorized applications.

Administrative Roles, Partners, and GDAP

Regular reviews of administrative roles and partner access, such as those granted through Granular Delegated Admin Privileges (GDAP) are crucial. Microsoft recommends a maximum of five global administrators and stresses the principle of least privilege even for partners.

Consider conducting these reviews regularly to ensure security and compliance.

Exchange Online and Communication Protocols

Mailbox Protocols

Various mailbox protocols (IMAP, POP3, EAS) carry different risks, such as allowance for or reliance on basic authentication.

Consider disabling unused protocols to minimize these vulnerabilities.

Receive Connectors

Email architectures that utilize Exchange Online with edge services provided by a third party have a vulnerability in the form of a public-facing, organization-specific SMTP relay that delivers mail to Exchange Online. This relay allows for direct connectivity and enables anonymous identities to deliver emails inbound to an organization, thereby allowing attackers to bypass the organization’s edge services entirely.

Consider implementing Receive Connectors to limit delivery authorization on the relay to the trusted edge service provider.

Sharing in SharePoint and OneDrive

Sharing capabilities in SharePoint and OneDrive can expose organizations to external threats if not properly managed. External users leveraging shared links can gain unauthorized access to sensitive information, posing significant security risks.

Consider restricting sharing capabilities to internal users to prevent external threats from exploiting shared links..

Teams External Communication

By default, Teams allows global communication, which can serve as a potential risk vector. Unrestricted external communication can lead to interactions with unknown and potentially malicious entities.

Consider locking down these settings to ensure interactions are limited to known, secure identities.

Advanced Levels of Security

Conditional Access Policies (CAPs)

These advanced security rules specify who can access resources and under what conditions, enhancing the security posture when combined with telemetry from services like Entra ID and Intune. CAPs help ensure that only authorized users under specific conditions can access sensitive resources.

Consider implementing Conditional Access Policies to enhance security by defining access conditions based on user and device attributes.

Hybrid Computer Identity

Synchronizing on-premises Active Directory computers with Entra ID allows CAPs to limit access to trusted devices only, offering a substantial security improvement over generic Windows access.

Consider synchronizing your on-premises Active Directory computers with Entra ID to allow CAPs to restrict access to trusted devices and improve security.

Intune for Mobile Device Management (MDM)

Organizations should use Intune to enroll and manage mobile devices, ensuring compliance with security policies. By integrating Intune’s compliance telemetry with Conditional Access Policies (CAPs), only compliant devices can sign in and access corporate resources, enhancing overall security.

Consider using Intune for device enrollment and compliance, and integrate its telemetry with Conditional Access Policies to secure sign-ins.

Modern MFA and Azure Information Protection

Emerging MFA technologies like push notifications and phishing-resistant methods (FIDO2) are encouraged over legacy MFA practices. Meanwhile, Azure Information Protection manages data encryption and user access, ensuring sensitive information is secure even when it leaves the organization.

Consider adopting modern MFA technologies to protect your users and Azure Information Protection to protect sensitive data.

Conclusion

By understanding and implementing Microsoft security measures, you can significantly enhance the security and efficiency of your institution’s digital environment. In addition, leveraging advanced MFA technologies and synchronizing on-premises Active Directory with Entra ID is a proactive way to fortify access control. It is also important to regularly review and update your security protocols to ensure they remain effective against evolving threats.

Don’t forget to download this handy infographic to explore overlooked M365 security features. This knowledge can help you implement everything needed under your license type to enhance your cybersecurity posture.

08 Oct 2024
Banks, Credit Unions, Security Jamie Davis 0 comment

Secure Our World: Join Us in Celebrating Cybersecurity Awareness Month

Cybersecurity Awareness Month, held annually in October, is a vital international initiative designed to raise awareness about the importance of being safe and secure online. This year’s theme, “Secure Our World,” continues from 2023 and highlights simple yet effective ways for individuals, families, and businesses to protect themselves from cyber threats.

The Cybersecurity and Infrastructure Security Agency (CISA) leads the federal efforts for this campaign. They work closely with the National Cybersecurity Alliance (NCA), known for their @staysafeonline initiative, to develop and disseminate resources that educate the public on key cybersecurity practices.

Cybersecurity Tips

Here are some essential tips provided from this year’s Cybersecurity Awareness Month campaign:

  • Recognize and Report Phishing: Learn to identify phishing attempts by familiarizing yourself with their common indicators, such as suspicious links or unexpected attachments. Resist the urge to click on these and ensure you delete phishing messages promptly.
  • Use Strong Passwords: Enhance your account security by choosing passwords that are long, random, and unique. This trifecta helps protect against unauthorized access.
  • Turn On Multi-Factor Authentication (MFA): Activate MFA on all your accounts, including email, social media, and financial services. This adds an extra layer of security, making it significantly harder for cybercriminals to gain access.
  • Update Software: Keeping your devices updated with the latest security patches is crucial. If automatic updates are not available, regularly check for updates to ensure your software is secure.

Throughout October, stay engaged and increase your cybersecurity awareness by visiting the National Initiative for Cybersecurity Careers and Studies (NICCS) Cybersecurity Awareness Month page for resources and tools. You can also follow updates using the #CybersecurityAwarenessMonth on social media.

Cybersecurity Resources

Safe Systems is also providing resources to help raise cybersecurity awareness, knowledge, and understanding for our community banks and credit unions.

Please explore some of our latest offerings:

  • M365 Immersion Training – Register for this complimentary, four-part series on Microsoft 365 (M365) security. Led by certified engineers, it covers essential topics including Conditional Access Policies (CAPs), Intune management, Azure AI governance, and more. Each session delivers practical insights and actionable knowledge, ensuring robust security practices for institutions using M365 core technologies. Reserve your spot.
  • MFA Quiz – When implemented correctly, MFA can be the single most effective tool to protect against remote attacks. Test your knowledge of how MFA works and why it is so important.
  • Cybersecurity Outlook Survey – We surveyed community banks and credit unions to gain more insight into their cybersecurity challenges, priorities, best practices, and how they manage cybersecurity preparedness. Discover their responses.

For more resources, visit our Resource Center, blog site, or our interactive Compliance Guru platform which provides reliable answers to your IT, cybersecurity, and information security questions. You can also follow us on our social media channels – Facebook and LinkedIn for timely news and helpful articles throughout the year.

When it comes to investing in security, Safe Systems understands that protecting your community bank or credit union can be complex and confusing. That’s why we offer multi-layered security solutions to protect vulnerability points both inside and outside your network and we have certified engineers who specialize in Microsoft cloud security.

Please join us this month in raising awareness and taking advantage of the many available resources to help your institution secure its digital environment and prevent cyber threats.

01 Aug 2024
Banks, Compliance, Credit Unions The Safe Systems Compliance Team 0 comment

Effective Governance and Communication: Enhancing Your FI’s Resiliency

With the rise in cyber threats and the increasing complexity of regulatory requirements, Information Security Officers (ISOs) face unprecedented challenges. This blog focuses on the importance of governance and effective communication as a key strategy for enhancing operational resiliency.

The Gramm-Leach-Bliley Act (GLBA) first brought to the forefront the importance of establishing the role of an ISO for financial institutions (FIs). However, the significance of this role has only magnified as information technology has become essential to every department and business function within an FI. The exposure of customer non-public information (NPI) has exponentially increased with the widespread adoption of online transactions, mobile banking, and third-party relationships.

Managing information security risks effectively requires collaboration. Each stakeholder group, including end-users, IT management, IT Steering Committee, Executive Management, Risk/Audit Committees, and the Board of Directors, plays a crucial role in supporting and executing information security standards. Segregating duties between IT management and the ISO is one of the biggest challenges for many FIs. For those that lack a formal infrastructure, the FFIEC provides “visibility” and “accountability” guidelines showing how an ISO can and should collaborate with IT management.

In addition, ISOs must break down silos and communicate clearly with all the various stakeholders. This effort requires access to relevant, actionable, and up-to-date information that aligns with each group’s distinct reporting needs, engagement level, and technical understanding.

ISOs may also need to broaden the scope and frequency of their communications. For instance, it is a good best practice to meet with the Board more frequently than once a year. Board members will benefit from periodic discussions with the ISO and IT management to accurately and quickly identify potential issues related to risk such as inconsistent server backups, software patches, and systems nearing EOL. A comprehensive understanding of Human Resources standards and their impact on information security is also important to ensure that policies and procedures are consistent across the organization.

To facilitate and ensure these meetings and conversations are effective, ISOs should rely on industry-standard frameworks that can be customized for audience-based agendas and repeatable tasks. Essentially, ISOs should be transparent in communicating changes that could result in increased risk to NPI.

Overall, this can be a challenging effort, especially for smaller banks and credit unions who may not have the expertise or the time to ensure a consistent approach to governance and communication. For this reason, many FIs choose to partner with a reliable Virtual Information Security Officer (VISO) service. These third-party services provide strategic guidance and the necessary oversight to ensure comprehensive information security management.

Safe Systems ISOversight® is a VISO service that includes a suite of applications, real-time reporting, and knowledgeable FFIEC risk-management professionals who assist with policy implementation, third-party relationship management, BCP, cybersecurity risk assessments, incident response and BCP testing, and other required tasks that are customized for each FI. They also provide ongoing coaching and accurate reporting to help with communication tailored to each stakeholder group. These collaborative efforts will go a long way to ensure operational resiliency and reduce reputation risk.

For a deeper understanding of governance and communication within the ISO role and to gain more insights into enhancing operational resiliency, refer to the complete white paper, Operational Resiliency: Elevating the Role of the ISO.

18 Jul 2024
Banks, Compliance, Credit Unions Christine Ray 0 comment

Ask the Experts: Get Reliable Answers to Your Risk Management Questions on ComplianceGuru.com

We are excited to announce the relaunch of ComplianceGuru.com. For over a decade, Safe Systems’ Compliance Guru site has been a trusted resource for community banks and credit unions providing essential insights on regulatory trends and compliance best practices.

We’ve reimagined it to be more interactive, allowing you to ask questions directly to our FFIEC risk and compliance experts, addressing risk management topics and concerns most relevant to your institution. You can also learn what your banking peers are concerned about and leverage the advice from our team to strengthen your security posture.

Since launching the new site, our Gurus have answered questions about Ransomware Self-Assessment Tool (RSAT) 2.0, NIST Cybersecurity Framework (CSF) 2.0, and work area security.

Here is a sample of what they’re saying about these important topics:

RSAT 2.0: A Proactive Approach to Ransomware Threats

Financial institutions are increasingly targeted by sophisticated ransomware attacks. To mitigate these risks, the RSAT (Ransomware Self-Assessment Tool) was developed to support banks and credit unions in their cybersecurity efforts. Originally released in October 2020, this tool was a collaborative initiative by the CSBS (Conference of State Bank Supervisors), the BECTF (Bank Electronic Crimes Task Force), and the U.S. Secret Service.

The updated version, RSAT 2.0, released in October 2023 was designed to address emerging ransomware attack vectors.

Some key questions surrounding RSAT 2.0 that financial institutions have been asking:

  • Are financial institutions required to complete RSAT 2.0?
  • Who should be involved in completing this self-assessment tool?
  • How does RSAT 2.0 differ from its predecessor?

NIST CSF 2.0: Modernizing Cybersecurity Frameworks

The National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) is a foundational guideline for improving the security and resilience of critical infrastructure. It provides a structured approach for assessing your institution’s security posture across five components: Identify, Protect, Detect, Respond, and Recover. NIST CSF 2.0 represents the latest iteration, incorporating lessons learned and adding a sixth component, Governance.

Here are some important questions you and other institutions may be asking about CSF 2.0:

  • How can CSF 2.0 address current cybersecurity challenges?
  • What resources are available to implement CSF 2.0?
  • How can CSF 2.0 be integrated into your institution’s existing risk management framework?

Compliance Guru offers reliable and informed answers to these and other IT, cybersecurity, and information security challenges. It is an invaluable resource offering guidance and tools to help community banks and credit unions like yours enhance cyber resilience.

We invite you to subscribe to this new platform to stay informed and discover best practices that better position your institution to protect customer data and ensure compliance with important federal and state regulatory guidance.

And by the way, we’re offering a limited number of $50 gift cards* to valid U.S. financial institutions that submit risk management questions on ComplianceGuru.com. So, submit your questions today!

Ask the Gurus for a Chance to win!

* Contest Rules

To qualify for the $50 gift card, your financial institution must be a valid U.S. financial institution that submits a question on ComplianceGuru.com. Questions must be relevant to risk management topics, including but not limited to IT, cybersecurity, information security, and third-party.

11 Jul 2024
Banks, Credit Unions, Technology Jamie Davis 0 comment

Enhance Your DR Plan: Key Testing Strategies

Disaster recovery (DR) planning is fundamental to maintaining operational resilience within financial institutions. It ensures that essential functions can be restored rapidly following a disruptive event, minimizing operational interruptions and financial losses.

DR Testing helps organizations understand how well their Disaster Recovery plan would work if an actual disaster were to occur. Here are some essential guidelines for conducting effective disaster recovery testing.

Exercise vs Test

Both exercises and tests are crucial for validating procedures in your Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP) plan, but they serve different purposes:

  • Exercise: A procedure designed to validate one or more aspects of your BCP or DRP. A common exercise is a structured walk-through (“table-top”) where stakeholders go through each step and component outlined in the plan. This guarantees that everyone involved is aware of their responsibilities during an emergency. It can also help uncover inconsistencies, missing information, or errors in the plan.
  • Test: A form of exercise that measures the performance or reliability of your system resilience in a simulated environment. For example, simulating the recovery of your communication lines, servers, and applications is a DR test.

The Cost of Downtime

Financial institutions should be acutely aware of the high costs associated with downtime. According to Emerson Network Power, the average cost of data center downtime across industries increased a staggering 41 percent since 2010. Furthermore, CA Technologies reports that financial institutions face an average annual revenue loss of $224,000 due to downtime. These costs may vary according to institution size, but the key takeaway is that any amount of downtime can lead to lost revenue. This underscores the importance of rigorous and regular disaster recovery testing.

FFIEC Guidelines

The Federal Financial Institutions Examination Council (FFIEC) provides clear guidance on disaster recovery tests and objectives. The council states, “Management uses tests to determine whether system resilience conforms to the BCP and stated recovery objectives.” Here are three critical metrics to consider:

  • Recovery Point Objective (RPO): The most recent backup you can safely retrieve following a disruptive event.
  • Recovery Time Objective (RTO): The minimum time necessary to restore your services after a disruption.
  • Maximum Tolerable Downtime (MTD): The longest duration your institution can afford to be down before its future is at risk.

FFIEC expects institutions not only to define but also to test these recovery objectives. If a recovery objective falls short during testing, it should be reevaluated and adjusted accordingly.

A Comprehensive Checklist

Disaster recovery testing is essential for minimizing downtime during adverse situations. However, these tests are only as effective as the practices behind them. It’s crucial to follow a consistent and thorough testing process that includes:

  • Critical Business Functions: Confirm that systems can support vital business processes in an emergency, including alternative site transfers, increased workloads, manual workarounds, and communication timelines.
  • Technological Integration: Integrate technologies that support essential business activities, such as data replication, recovery, and off-site storage.
  • Backup Data Testing: Regularly test backup data integrity and availability.

Post-testing Evaluation

During testing, if a recovery objective does not align with actual capabilities, you should always reevaluate that particular objective. It’s also important to consider dependencies within processes. For instance, some processes with shorter RTOs, such as lending processes, may hinge on those with longer RTOs, like the lending server’s restoration time. It is also important to remember that the evaluation of the DR tests is not only to determine whether the plan is appropriate for current needs but anticipated future needs, too.

Managed DR Testing

For many institutions, outsourcing disaster recovery testing to experts like Safe Systems can streamline the process, ensuring compliance with industry standards and focusing internal resources on core business operations.

Disaster recovery testing is more than a regulatory requirement-it is a vital practice to ensure the continuous operation and financial well-being of your institution

By following these guidelines and leveraging expert services, you can ensure that your organization is prepared to respond to any disruptive event.

To equip your team with an outline of these essential testing strategies, download our infographic: Guidelines for Disaster Recovery Testing” infographic today

27 Jun 2024
Banks, Credit Unions, Technology Jamie Davis 0 comment

Leveraging Cloud Technology for Disaster Recovery

Community banks and credit unions must stay prepared to handle unforeseen disruptions. A comprehensive disaster recovery (DR) solution is essential to ensuring financial institutions maintain operational continuity, meet regulatory requirements, and safeguard customer data. Cloud technology has emerged as a key player in modern disaster recovery strategies, providing cost-effective, secure, and scalable solutions.

Benefits of Cloud-based DR

Moving critical servers to the Cloud as virtual machines enables financial institutions to meet disaster recovery (DR) needs more cost-effectively. Traditional DR setups typically require significant investments in physical infrastructure, maintenance, and personnel, but cloud solutions eliminate the need for a dedicated DR data center, reducing both capital and operational expenditures. Additionally, cloud technology offers scalability that on-premises solutions can’t match, providing the flexibility to adapt to an institution’s evolving requirements. Whether your bank or credit union is expanding services or increasing data volumes, cloud-based DR solutions can scale to meet specific needs without requiring significant overhauls.

These cloud-based DR solutions are high-availability systems designed to rapidly recover critical servers, ensuring institutions can minimize downtime and maintain business continuity.

Managed Site Recovery

Safe Systems’ Managed Site Recovery service is a fully managed, secure data replication and failover solution built specifically for community banks and credit unions. Since each institution’s needs differ, we customize the DR solution to align with your specific requirements. Here are some other advantages to our cloud-based DR solution:

1. Meet Compliance and Examiner Requirements:

Managed Site Recovery helps institutions meet Business Continuity Plan (BCP) and Recovery Time Objective (RTO) requirements. Our service includes an annual DR test with an annual DR test with a comprehensive result write-up demonstrating a credible and robust DR strategy to examiners. According to Chris Bailey, Network Security Administrator at Bank of Cleveland, “The examiners were very pleased with how Safe Systems laid out the results and were also impressed with the fact that the test was being done by a third-party entity outside of our organization.”

2. Provide Secure Data Replication and Failover:

Our service offers strong and secure data replication with cloud server vaulting, ensuring geographically varied data center backups. This guarantees the availability of crucial business data and applications during unexpected business interruptions. Like other cloud-DR solutions, Managed Site Recovery provides expedited recovery periods to lessen disruptions and maintain operational continuity. Distinctively, it includes a team of third-party specialists available to consult on DR procedures, ensure ongoing backups and routine testing within proper timelines, and serve as an extension of your staff in the event of a disaster.

3. Save Time and Money:

Managing a DR failover data center can be complex and costly. Managed Site Recovery removes this burden, allowing your institution to focus on its core functions. By leveraging our compliant, cloud-based disaster recovery service, your bank or credit union can also meet DR requirements and ensure rapid recovery of critical servers at a fraction of the cost.

Cloud technology has revolutionized the approach to DR, offering cost-effective, scalable, and secure solutions. Safe Systems’ Managed Site Recovery service is a cloud-based DR solution that addresses the unique needs of financial institutions, helping them stay compliant, secure, and operationally resilient. This service ensures your institution can achieve peace of mind, knowing your critical data and applications are protected against disruptions, and your test results will stand up to examiners’ scrutiny.

Ready to learn more about Managed Site Recovery? Visit Disaster Recovery Service for Financial Institutions

13 Jun 2024
Banks, Compliance, Credit Unions, Technology, Uncategorized Jamie Davis 0 comment

Resilience and Recovery: BCP and DR Essentials

The importance of disaster preparation cannot be overstated for financial institutions. These institutions must be ready for the unexpected, whether it’s a natural disaster, pandemic, or cyber-attack. If your financial institution’s systems went down, how quickly could you restore operations? Ensuring swift and efficient recovery depends on having solid Business Continuity Plans (BCP) and Disaster Recovery (DR) plans.

BCP and DR are both critical components of the overall Business Continuity Management (BCM) process, which also includes resilience, emergency response, crisis management, and third-party integration. The Federal Financial Institutions Examination Council (FFIEC) guidelines emphasize the need for institutions to adopt an enterprise-wide, process-oriented approach to business continuity. This strategy aims to ensure that financial institutions are not just prepared to recover but are also resilient enough to withstand disruptions.

Key Differences Between BCP and DR

You might wonder why both a Business Continuity Plan and a Disaster Recovery Plan are necessary. While they are closely related and designed to work in tandem, they serve different purposes. A BCP outlines the strategies and protocols that enable a financial institution to continue operations during and immediately following a disaster. In contrast, a DR plan focuses on restoring critical data and applications so the institution can operate normally.

BCP:

  • A plan to continue business operations.
  • Consists of a business impact analysis, risk assessment, and an overall business continuity strategy.
  • Includes pandemic planning as part of its overall strategy.

DR:

  • A plan for accessing required technology and infrastructure after a disaster.
  • Involves evaluating backups and ensuring necessary redundant equipment is up-to-date and functional.

Both plans require regular testing and maintenance to ensure they are effective. The BCP test, often a tabletop exercise, ensures employees know their roles during a disaster. The DR test is more hands-on, confirming that backup technologies can restore operations within the Recovery Time Objective (RTO).

7 Tips to Prepare for Disasters or Business Interruptions

Existing BCP and DR plans are crucial, but beyond that, several additional steps can further prepare your institution for various disruptions. Below are 7 best practices. Read the full white paper, BCP and DR Plans: What Every Financial Institution Needs to Know, for more.

  1. Monitor the success of backups and replication services.
  2. Utilize Uninterruptible Power Supplies (UPS) for short-term outages.
  3. Safeguard critical equipment by preemptively shutting it down if an extended outage is anticipated.
  4. Secure the server room and ensure all equipment is protected.
  5. Ensure ATMs are for customers that need access to cash.
  6. Verify key employees have someone to step in if they are unavailable.
  7. Validate and test the BCP and DR plans at least annually to ensure they are up-to-date and effective.

Choosing to Manage BCM In-house or with an IT Partner

Preparing for or recovering from a disaster can be challenging for some community financial institutions that often lack IT resources. When choosing an in-house disaster recovery solution, they face technical and time-consuming processes, which can strain limited IT staff. When outsourcing, institutions can choose a local provider for convenience, but these providers may have little financial services expertise posing its own set of difficulties. When in-house resources or local expertise are limited, another alternative is partnering with a national managed services provider that specializes in the banking industry. This offers several benefits, including streamlined processes, improved disaster preparedness, and dedicated DR support.

However an institution chooses to manage DR and BCP, it is essential to develop, implement, and regularly test disaster recovery and business continuity plans. Though daunting, using automation and outsourcing services can ease the maintenance burden and ensure compliance with evolving regulations.

To learn more about resilience and recovery, read our white paper, BCP and DR Plans: What Every Financial Institution Needs to Know.

If you’re unsure whether your institution is BCM ready, consider a complimentary plan review to ensure your BCP and DR plans are up to date and fully compliant,

08 Mar 2024
The Crucial Role of Cybersecurity Management in 2024
Banks, Compliance, Credit Unions, Uncategorized The Safe Systems Compliance Team 0 comment

The Crucial Role of Cybersecurity Management in 2024

The Crucial Role of Cybersecurity Management in 2024

As we reflect on the challenges of 2023 and the growing reliance on cloud providers in the financial industry, it is clear that cybersecurity management is more important than ever. With the increasing threat of cyberattacks and the need to protect customer information and financial transactions, community financial institutions must prioritize cybersecurity to ensure the safety and trust of their customers.

In our recent webinar, our IT and Information Security experts discussed cybersecurity management with areas of emphasis on the importance of understanding third-party risk management, the new version of the Conference of State Bank Supervisors (CSBS) Ransomware Self-Assessment Tool (RSAT 2.0), and lessons learned from exams and audits in 2023. This post explores some of the key highlights.

NIST Framework and the Arrival of CSF 2.0

The National Institute of Standards and Technology’s Cybersecurity Framework (NIST CSF) is a valuable resource for organizations to manage and reduce cybersecurity risk. This framework continuously integrates lessons learned and best practices while retaining its core functions: Identify, Protect, Detect, Respond, and Recover. The recently updated CSF 2.0 includes the introduction of a sixth function, ‘Govern,’ underscoring the importance of clear role definitions, policies, and risk prioritization procedures within cybersecurity programs. It also provides improved guidance on implementation, ensuring that organizations are equipped to address the latest cybersecurity challenges.

Critical Third-party Relationship Management

Third-party risk management is crucial as financial institutions are increasingly relying on third and fourth parties. Interagency guidance underscores the importance of understanding the impact and interaction levels of these relationships on operations and customers. Financial institutions are encouraged to establish sound methodologies for comprehensive oversight of the activities surrounding third parties. This includes a thorough understanding of third-party business processes and systems as well as an understanding of the risks and benefits before contract execution. As financial institutions move forward with third-party relationships, they must also exert pressure on their service providers to ensure adherence to strong cybersecurity standards to effectively safeguard the interests of the financial institution and ultimately its customers.

Importance of the Ransomware Self-Assessment Tool (RSAT 2.0)

The Ransomware Self-Assessment Tool (RSAT) version 2.0 represents a significant step forward in helping financial institutions fortify their defenses against ransomware attacks. The latest version is developed through the integration of feedback from institutions that have been impacted by ransomware, ensuring that the tool remains relevant and effective as this type of malware continues to evolve. With a focus on cloud-based service providers, RSAT 2.0 emphasizes the importance of understanding the flow of data, particularly in environments outside the U.S., and how it is subject to various privacy regulations like GDPR. Furthermore, RSAT 2.0 places increased emphasis on multifactor authentication (MFA) and employee cyber-awareness, reflecting the industry’s recognition of the critical role these factors play in strengthening cybersecurity postures.

Key Lessons Learned from Exams and Audits

A few of the biggest areas of scrutiny that we’re seeing from recent IT exams and audits include:

  • Asset Management – paying attention to asset lifecycles and end-of-life risks as well as implementing robust authentication methods that govern customers who are logging into electronic banking applications
  • Change Management – establishing baseline standards and auditable procedures for change requests and appropriate reporting for project management and cost overruns
  • Data Recovery – periodically rotating through your critical servers and restoring data so that you can ensure the effectiveness, integrity, and availability of that data
  • Increased Incident Response Testing and Training – conducting testing as frequently as possible over different threat scenarios, documenting those tests, and training the employees who are going to be involved in the actual response

For more lessons learned and emerging trends, watch the full webinar recording.

Community banks and credit unions must prioritize cybersecurity management to protect customer information and maintain operational resilience. Enhanced cybersecurity strategies are imperative, urging institutions to adopt a multidimensional approach that incorporates people, processes, and technologies. Regular assessments, third-party risk management, and adherence to cybersecurity frameworks contribute to a proactive defense against cyber threats.

If you have any questions or want to learn more about our complimentary information security review, please visit safesystems.com/review.

18 Jan 2024
Our Top Blog Posts of 2023
Banks, Compliance, Credit Unions, Security, Technology Safe Systems 0 comment

Top Blogs of 2023

Our Top Blog Posts of 2023

As we begin the new year, it’s a great time to revisit some of the most popular blogs we published in 2023. Our top blogs from last year covered a range of topics, including a cybersecurity outlook, updated third-party risk management guidelines, using conditional access policies (CAPs) and multifactor authentication (MFA) to enhance security within Microsoft Azure Active Directory (AD), and NetConnect 2023. If you didn’t have a chance to read these posts—or simply want to review them—here is a recap of each of them. They offer unique perspectives, best practices, and a wealth of insights that can help your financial institution prepare for greater success in the year ahead.

2023 Cybersecurity Outlook for Community Banks and Credit Unions

Safe Systems’ 2023 Cybersecurity Outlook for Community Banks and Credit Unions revealed valuable peer-to-peer insights that can help financial institutions enhance their security posture. The survey highlights cyber preparedness and budget restraints as top security challenges of more than 50% of the 160 participating financial institutions. It also shared participants’ feedback on other important areas, including prevention and detection security layers; employee security awareness training and testing; and advanced firewall features. For instance, respondents use multiple layers of security, but less than 50% of them combine every security layer listed in the survey. Survey respondents also use a variety of security training—including resource-intensive individual instruction. In addition, most of the survey participants are taking advantage of advanced firewall features, although only 24% of 135 respondents leverage sandboxing technology to detect threats. Read more.

Updated Regulatory Guidelines on Third-Party Risk Management

In June, federal bank regulatory agencies issued updated guidelines to make it easier for financial institutions to manage third-party risks. This new guidance from the Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation (FDIC), and Office of the Comptroller of the Currency (OCC) impacts all banking institutions that use third parties. The majority of statements in the new guidance focus on the planning, due diligence, and contract phases with an emphasis on pre-engagement. Since auditors and examiners will be looking more closely at what happens during the pre-engagement stage, institutions need to place more emphasis on scrutinizing potential third parties. Not all statements in the guidance will apply to all institutions or relationships, so we have developed an interactive checklist designed to walk you through key regulatory requirements of the third-party relationship life cycle. Read more.

Using CAPs and MFA to Enhance Security within Microsoft Azure AD

There was a surge in successful phishing campaigns last year, including sophisticated schemes that were able to bypass MFA. MFA-resistant phishing is a significant threat since this type of attack could impact a vast segment of organizations that rely on Microsoft Azure AD (now known as Microsoft Entra ID) and Microsoft M365 services to support their operations. However, financial institutions can use a variety of measures to prevent cyberattacks, including Conditional Access Policies (CAPs). CAPs, which are foundational to safeguarding identities within Microsoft Entra ID, protect the initial step of the identification chain—the sign-in attempt. To maximize protection, institutions should stack multiple CAPs, such as requiring MFA, denying sign-ins from outside of the USA, and requiring device compliance. When designing CAP logic, they should take a broad approach to the scope of the CAP to impact as many areas as possible. Institutions can take a multi-layered approach to optimizing security by leveraging multiple security tactics, technologies, and resources. Read more.

NetConnect 2023—A Glimpse into the Future of Technology and Compliance

The 2023 NetConnect Customer User Conference brought Safe Systems’ customers, employees, and partners together in Alpharetta, Ga. to discuss banking industry trends, challenges, and innovations. NetConnect 2023 provided valuable insights into banking and technology’s vital role in shaping the industry’s future. With multiple informative sessions, the conference covered the significance of hope in business, changes relating to regulatory compliance, vulnerability management, and Microsoft Azure fundamentals. Read more.

Get the latest industry developments, insights, and trends delivered directly to your inbox. Subscribe now to the Safe Systems blog.

07 Dec 2023
NetConnect 2023 – A Glimpse into the Future of Technology and Compliance
Banks, Compliance, Credit Unions, Security, Technology Christine Ray 0 comment

NetConnect 2023 – A Glimpse into the Future of Technology and Compliance

NetConnect 2023 – A Glimpse into the Future of Technology and Compliance

Safe Systems hosted its 2023 NetConnect Customer User Conference last month in Alpharetta, GA. After taking a hiatus due to the pandemic, Safe Systems customers, employees, and partners were eager to reconvene to discuss the latest trends, challenges, and innovations. This year’s conference provided insights into the evolution of banking and the critical role technology plays in shaping the industry’s future.

Here are some key highlights and insights shared at this year’s conference.

“I have been to several vendor conferences in the last 20 years, and I would say this is one of the best, if not the best, one I have been to. The sessions were informative and on-target. The presenters were all well qualified and engaging.” – Community banking CFO

Celebrating 30 Years of Excellence

NetConnect 2023 marked the 30th anniversary of Safe Systems’ journey in the banking technology landscape. The conference began by reflecting on the early days when our services primarily focused on PC and network policies, network installations, and troubleshooting. Safe Systems highlighted that our evolution and growth were driven by customer feedback and collaboration. Customers have always been the cornerstone of our success.

Randy Ross at NetConnect 2023

Keynote speaker Dr. Randy Ross

The Power of Hope in Business

Keynote speaker, Dr. Randy Ross, shared insights on the importance of hope in the workplace. Hope is not merely wishful thinking or passive optimism; it’s a dynamic motivational system tied to inspirational goal setting. The case for hope in business was backed by impressive statistics, including lower absenteeism, increased productivity, and enhanced morale and creativity. Dr. Ross also provided guidelines on how anyone can apply hope to make life happier, healthier, and more productive.

Regulatory Compliance in a Changing Landscape

Tom Hinkel, VP of Compliance Services, delved into the dynamic world of regulatory compliance. He discussed the latest statistics, including a surge in cyber insurance claims due to zero-day attacks and ransomware. Regulatory changes like third-party risk management (TPRM) guidance and FDIC InTREx updates were highlighted. The session also touched on the cyber incident notification rules approved by the Federal Deposit Insurance Corporation (FDIC), Federal Reserve, and Office of the Comptroller of the Currency (OCC) in 2022 and the Conference of State Bank Supervisors (CSBS) updated R-SAT 2.0 (Ransomware Self-Assessment Tool).

Crowd at NetConnect

Brian Brannon, VP of Security Product Strategy, and James Minstretta, Endpoint Security Engineer, doing a live demo of Azure vulnerability settings.

Security and Vulnerability Management

Brian Brannon, VP of Security Product Strategy, addressed the critical topic of vulnerability management. He explained the proactive strategy of identifying, assessing, and mitigating network weaknesses, aligning it with the expectations of regulators. The session included a live demo to demonstrate the importance of effective vulnerability management.

Azure Security 101

Our Microsoft 365 Certified Technology DevOps Engineer took a deep dive into Azure fundamentals, including Entra ID, M365, and Resource Subscriptions. He explored how to mitigate risks using Conditional Access Policies, enabling multi-factor authentication (MFA), limiting geographic locations, and more. The session included interactive labs of the Entra ID Admin Center, SharePoint Online, and OneDrive to allow attendees to explore logs, manage settings, and review reports firsthand.

Panel Discussion on Regulatory Changes

The conference concluded with a panel of auditors and regulatory compliance specialists, who discussed topics such as the increasing importance of cyber insurance, the impact of AI on exams and audits, and third-party risk management. Attendees had the opportunity to ask questions and engage with experts on these vital topics.

Panel of experts at NetConnect 2023

Safe Systems’ former VP of Compliance Services Tom Hinkel hosting a panel of compliance experts that included Senior Compliance Specialist Paige Hembree (Safe Systems), Financial and Information Security Auditor Matthew Jones (Symphona), Wipfli’s Senior Manager Jim Rumpf, and Director for Supervision Kevin Vaughn (Georgia Department of Banking and Finance)

NetConnect 2023 offered a comprehensive overview of the current state and future prospects of banking technology and regulatory compliance. The industry continues to evolve, and staying informed and adaptable is key to success in this ever-changing landscape. Safe Systems remains committed to supporting financial institutions on their journey, as demonstrated by our 30 years of excellence and our forward-looking approach to technology and compliance.

30 Nov 2023
Important Industry Insights on the Use of Anti-Malware and Advanced Features for Ransomware Protection
Banks, Compliance, Credit Unions, Security, Technology Jamie Davis 0 comment

Important Industry Insights on the Use of Anti-Malware and Advanced Features for Ransomware Protection

Important Industry Insights on the Use of Anti-Malware and Advanced Features for Ransomware Protection

According to the IC3 2022 Internet Crime Report, the FBI received 2,385 complaints identified as ransomware with adjusted losses of more than $34.3 million. Moreover, 870 of these complaints indicated that organizations belonging to a critical infrastructure sector, such as financial services, were victims of a ransomware attack. This makes it imperative for banks and credit unions to employ a variety of measures to protect themselves against the growing threat of ransomware attacks. Yet many financial institutions that are leveraging anti-malware solutions are not using advanced features that can help protect against ransomware threats. According to Safe Systems’ 2023 Cybersecurity Outlook for Community Banks and Credit Unions, advanced features for anti-malware/anti-ransomware solutions such as root cause analysis, advanced machine learning algorithms, and sandbox analysis only received 12% or less of the answers among the survey participants.

With advanced features, financial institutions can more effectively monitor security threats on endpoints and ascertain the source and extent of an attack. Institutions that want to enhance their ability to detect and respond to threats might consider expanding their cybersecurity budget to increase spending on advanced anti-malware and endpoint protection features.

Recovery Strategies

As part of their recovery strategies, more than one-third of 144 survey respondents say they have implemented notification measures, including notifications to customers, regulators, and applicable insurance carriers. This is critical given the recently finalized interagency Computer-Security Incident Notification Rule. It requires banking organizations to notify their primary federal regulator about any significant “computer-security incident” as soon as possible after a cyber incident happens. (A computer-security incident, as defined by the rule, is an occurrence that results in actual harm to the confidentiality, integrity, or availability of an information system or the information that the system processes, stores, or transmits.) Nearly 30% also leverage other important recovery strategies such as monitoring for the early detection of potential incidents and eliminating intruder access points.

Other Key Security Issues

In addition to shedding light on how institutions use advanced features for anti-malware/anti-ransomware solutions, our comprehensive survey highlights several other security issues, including Microsoft 365 services, email infrastructure, advanced firewall features, vulnerability and patch management, and more. Banks and credit unions must effectively address all of these areas to stay ahead of the constantly evolving cybersecurity landscape.

Download a copy of our latest white paper to read the complete survey findings, which can provide a deeper understanding of current cybersecurity concerns and best practices to enhance your institution’s security posture.

16 Nov 2023
What You Need to Know from the 2023 Cybersecurity Outlook for Community Banks and Credit Unions
Banks, Compliance, Credit Unions, Security, Technology Jamie Davis 0 comment

What You Need to Know from the 2023 Cybersecurity Outlook for Community Banks and Credit Unions

What You Need to Know from the 2023 Cybersecurity Outlook for Community Banks and Credit Unions

As cyber threats become more complex, aggressive, and prevalent, implementing cybersecurity mitigation strategies is becoming more critical in the financial services sector. Not surprisingly, cyber preparedness and budget restraints are the top security challenges for more than half of the financial institutions that responded to the Safe Systems survey, 2023 Cybersecurity Outlook for Community Banks and Credit Unions.

Our analysis presents input from approximately 160 participants who responded to 55 questions (including multiple-choice) based on how relevant each query was to their organization.* In addition to focusing on the top security challenges, the survey highlights respondents’ input on several other critical areas, including:

  • Prevention and Detection Security Layers: Modern operating environments require a more robust security strategy that goes beyond implementing a basic firewall or anti-malware solution to protect their information and infrastructure from the growing number of cyber threats. Survey respondents are implementing multiple security layers, including firewall, patch management, anti-malware, email encryption, employee training and testing, vulnerability monitoring, and security log monitoring. However, less than 50% of all respondents use every security layer listed in the survey, which indicates they can do more to protect themselves against cyberattacks.
  • Employee Security Awareness Training and Testing: 95% of all cybersecurity issues can be linked to mistakes made by individuals, with 43% of breaches attributed to insider threats, according to the 2022 Global Risk Report by the World Economic Forum, making employee security awareness training and testing critical for financial institutions. Accordingly, survey respondents are deploying multiple types of security training, including simulated phishing attacks, self-service online training and exercises, interactive classroom training, and more. Of the 144 participants responding to this question, 60% indicate they conduct individual training based on need, which is notable because this method of instruction normally requires more time and resources.
  • Advanced Firewall Features: A majority of the participants responding to this question indicate that they are using one or more advanced firewall (or next-gen firewall) features, such as intrusion prevention or detection systems (IPS/IDS), transport layer security (TLS)/secure socket layers (SSL), and Geo-IT filtering. Whether managed in-house or through an outside provider, these expanded capabilities can help institutions protect their network and institution against a broad array of threats. Sandboxing, for example, provides a safe, isolated environment to execute and observe potentially malicious code from unverified programs, files, suppliers, users, or websites. Out of 135 respondents, only 24% indicate they have sandboxing despite its ability to identify threats.
  • Cybersecurity Preparedness: Examiners recognize the increasing volume and sophistication of cyber threats and have an increased focus on cybersecurity preparedness in assessing the effectiveness of an institution’s overall information security program. Out of 128 respondents, 52% confirm that the focus on information security, including cybersecurity, has increased during their IT audits and exams. IT examiners and auditors are also reviewing whether institutions have completed any of the common cybersecurity assessments (e.g., CAT, ACET, or CRI/NIST), and they are using them to evaluate institutions’ security posture during an exam. According to the same respondents, 43% say they had their cybersecurity assessment reviewed and used as part of their latest IT exam, and 39% indicate that they received recommendations based on it.

To access the complete survey and gain valuable peer-to-peer insights that can help your institution enhance its cybersecurity decision-making process, read “2023 Cybersecurity Outlook for Community Banks and Credit Unions“.

* The number of respondents varies per question. For multiple-choice questions, the Percent (Respondents) is calculated by dividing each answer count by the total unique respondents, and the Percent (Answers) is calculated by dividing each answer count by the total counts collected.

26 Oct 2023
The New Rules and Best Practices of Password Security
Banks, Credit Unions, Security, Technology Jamie Davis 0 comment

The New Rules and Best Practices of Password Security

The New Rules and Best Practices of Password Security

Passwords have always been a reliable option for digital security. In the early days, you simply provided something that only you knew to authenticate yourself, and voila, your identity would be confirmed. But the world of passwords has changed. Initially, they were easy―you had fewer of them; you often needed physical access to use them; and people were just nicer back then. At least, that’s the way I remember it.

But did people really change… or did the world just get smaller with the growth of the internet—giving bad actors greater access to our digital domains? One thing is clear, password security requires new rules and strategies to keep up with the fast-changing cyber landscape. In addition to following best practices for creating strong passwords, you also need to consider employing multifactor authentication (MFA) or adopting a password management solution.

Embracing MFA

Whenever possible, you should avoid relying solely on passwords. The better option is to implement MFA, which adds another layer of security. While there are MFA-resistant phishing attacks, enabling MFA significantly minimizes the risk of compromise. In recent years, MFA has evolved to become more robust and secure, and there are different levels of quality in MFA. For instance, Microsoft Modern MFA doesn’t merely require you to click “accept” on a device; you have to input a numerical code to confirm the login attempt. (Always use the most advanced and newest version that aligns with your user base’s tolerance.)

Using a Password Manager

There are situations where MFA is not available or does not make sense to use. In these cases, passwords may be your best or only option. This indicates the importance of using some type of password management solution. A password management tool can be an effective way to keep track of the plethora of passwords that most people have. The average person has more than 100 passwords, according to a study by Nord Pass. That’s too many passwords for anyone to remember.

As a low-tech solution, some people write their passwords down in a notebook. If the book is securely locked away, this method may be acceptable, but it’s not ideal. However, I recommend using a software-based password management system that allows the user to create one login to access all their passwords. Only use a digital password manager that offers MFA to access passwords. If you’re not sure which solution to choose, there are numerous resources to guide you like this article from CNET. However, the best option for you will depend on your specific needs and goals.

Best Practices for Creating Strong Passwords

Password best practices have changed over the years. But as a general rule, you should never—ever—recycle a password. An existing password may be easier to remember and more convenient to reuse. But it’s not worth the risk; if your password is stolen, every place you have used it could be compromised.

You should also avoid including personal details in passwords. For example, don’t create a password using your child’s initials and birth year—no matter how cleverly you format it. (I know, you’re thinking: “But I used lower and upper case and separated them with a comma.” Trust me, so did the database that is being run against your accounts.)

It’s also important to ensure that every site, application, etc. has a strong password. Here are a few techniques for crafting strong passwords:

  • Make them long. Aim for at least 14 characters—or even longer—since you can easily copy and paste them into your password management tool. Some sites and applications often have character restrictions for passwords. In these cases, focus more on creating a random password that will be more difficult for someone to guess.
  • In situations where you frequently use a password and copying it from a management program is not an option, consider using passphrases. Instead of choosing a simple password like “BillyJoe1998,” use “BillyJoeGraduatedIn1998.”
  • “i” and “l’s” became “1’s”
  • “a” became “@”
  • “e” became “3,” which looks similar to a backward capital “E”
  • Still, another option is to insert punctuation between words. If you added “!” to the previous password, it would read B111y!J03!Gr@du@+3d!1n!1998.

Using a combination of these approaches is the best way to make passwords more complex and secure. Ultimately, the key to protecting your passwords is to constantly adapt and remain vigilant in the ever-evolving world of digital security.

12 Oct 2023
Updated Regulatory Guidelines on Third-Party Risk Management
Banks, Compliance, Credit Unions The Safe Systems Compliance Team 0 comment

Updated Regulatory Guidelines on Third-Party Risk Management

Updated Regulatory Guidelines on Third-Party Risk Management

Earlier this year, federal bank regulatory agencies released new guidance designed to help banking organizations better manage risks related to third-party relationships. These latest guidelines, issued by the Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation (FDIC), and Office of the Comptroller of the Currency (OCC), have broad implications for virtually all financial institutions that employ third parties.

Fostering Safe and Sound Practices

The updated guidance offers more streamlined language and clarification to help institutions better identify and reduce risks relating to using third parties like vendors, suppliers, partners, contractors, and service providers—including financial technology companies. It covers risk management practices for the stages in the life cycle of third-party relationships: planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination. The underlying impetus of regulatory agencies is to ensure that institutions have an effective third-party risk management process that supports safe and sound banking practices.

While the new guidance was just finalized in June, examiners are already increasing their questions and expectations regarding third-party risk management. Financial institutions should take proactive steps as soon as possible to address any potential issues. For example, they should broaden their consideration of what constitutes a “business arrangement.” The guidelines indicate that a third-party relationship may exist regardless of whether there is a formal contract or an exchange of compensation. Hence, institutions should be as inclusive as possible by factoring all business arrangements—no matter how insignificant—into their third-party risk management practices.

Important Areas to Consider

The current guidance encompasses a plethora of “statements”—more than 160 of them—that cover a variety of requirements, suggestions, and best practices. Almost 70% of the statements relate to how banking organizations should handle the planning, due diligence, and contract phases. Since these areas involve the pre-engagement stage, institutions need to place more emphasis on scrutinizing potential third parties because auditors and examiners will be looking more closely at what happens prior to engagement. The scrutiny should start at the early phase when bank management begins to consider a project, initiative, or even a concept.

Financial institutions also need to understand the strategic basis or purpose of a proposed business arrangement. They should identify and assess the benefits and risks associated with the arrangement and then verify that they align with their strategic objectives. They also must consider other crucial areas, including the institution’s ability to manage and oversee the relationship, the legal and regulatory compliance implications of the relationship, along with the third party’s financial condition, business experience, expertise of key personnel, and operational resilience. Additionally, institutions need to be cognizant of how third parties are managing their own subcontractors, which could ultimately impact the delivery of their services.

However, not all of the 160-plus statements in the new guidance apply to all institutions or all relationships, and some seem unattainable or overly burdensome. Institutions should identify the ones that are the most relevant and feasible and then prioritize their efforts accordingly.

In a joint press release in June, the Federal Reserve Board, FDIC, and OCC said they “plan to engage with community banks immediately and develop additional resources in the near future to assist them in managing relevant third-party risks.” In the meantime, institutions can download interactive checklists we designed to walk them through key regulatory requirements of the third-party relationship life cycle.

To learn more about how the revised guidelines may affect your financial institution, access our webinar on “New Third-Party Risk Managers Guidance.”

06 Oct 2023
2024 Budgeting for Technology and Cybersecurity in Community Banks and Credit Unions
Banks, Compliance, Credit Unions, Security, Technology Jamie Davis 0 comment

2024 Budgeting for Technology and Cybersecurity in Community Banks and Credit Unions

2024 Budgeting for Technology and Cybersecurity in Community Banks and Credit Unions

In the modern banking landscape, technology and cybersecurity are not just optional extras but fundamental necessities. For community financial institutions—which often operate with more limited resources than their larger counterparts—budgeting wisely in these areas is critical. Failure to properly invest could not only compromise efficiency and customer service but also expose institutions to potentially devastating cyber threats.

There are three categories that community banks and credit unions should consider when allocating budgets: cybersecurity, compliance along with its associated regulatory technology (RegTech), and general technology. Here are important considerations for each of these areas:

Cybersecurity

Cyber threats are ever-evolving, and no financial institutions are immune. Measures such as firewalls, encryption, and intrusion detection systems are basic requirements. Financial institutions also need to go further by investing in regular security audits and employee training. In today’s threat landscape, allocating a sufficient budget for cybersecurity measures is non-negotiable.

The best technology and cybersecurity measures are only as good as the people who use them. Community banks and credit unions should set aside funds for regular training programs to ensure staff are up to date with the latest technologies and security protocols. There are some great tools available that provide training and testing and run phishing simulations to see which employees may be your weakest links.

The odds are that at this point, your institution has an account in Microsoft’s cloud solution, Azure. OneDrive, Exchange Online, and many other Microsoft solutions are connected to Azure and may even be part of your Microsoft license. It is important to review the Azure tenant or management console to ensure you are dictating your security settings and not Microsoft. You can accomplish this through various ways including implementing conditional access policies (CAPS), which is the buzzword of 2023. If you are not using CAPs, you should immediately find out how to implement them and identify which ones are critical to your security. Also, Azure is a cloud-based management console, so if it is compromised, the ramifications can be detrimental. Monitoring key reports, accounts, and settings is critical for the long-term security of your institution.

Below are some real-life events and numbers that illustrate just how critical this type of management can be. (We discovered these events last year in our review of a small number of community financial institutions.)

Event: Number of Times:
Successful sign-in from outside the US: 674 times
Sign in from outside the US (valid password but MFA failed): 37 times
Mailbox settings like (access to email, send on behalf of, forwarded) changed: 1,970 times
OneDrive files shared externally: 708 times
Administrative roles assigned to user: 1,607 times
Large number of failed sign-in attempts for a user: 11,116 times

While some of the numbers above represent actual intentional changes, the sheer volume indicates that a large number of these events are not approved/intended actions made by the institution. Obviously, criminals are targeting these accounts. Hence, there is no option but to be proactive in monitoring and managing the security of your account with the appropriate settings, reports, alerts, and management. Also, note the multifactor authentication (MFA) stat. It only happened 37 times, but this signifies that there were 37 times MFA was the difference between protection and compromise. This underscores the urgent need to implement and maintain MFA.

Lastly, evaluate your firewalls. At this point, a next-generation firewall (NGFW) is a must. According to Gartner, NGFW are firewalls that have moved past just port/protocol inspection and have added application-level inspection. Advanced firewalls also have integrated intrusion prevention built into the solution, along with the ability to bring in intelligence from outside the firewall. A prime example of this is the FS-ISAC intelligence feed. Other advanced features may include sandboxing, SSL inspection, and other more advanced features to improve your cybersecurity posture. If you have an older firewall not based on NGFW, you simply may not have all of the features you need to effectively protect your network.

Compliance and RegTech

Regulatory requirements are becoming increasingly complex, and failing to meet them can affect both the institution and the people in charge of managing these risks. Investing in RegTech can automate and streamline compliance processes, making it easier for community banks and credit unions to adhere to pertinent laws.

These investments may take the form of a virtual information security officer (VISO) service, which has become extremely popular lately. The workload and expectations of an ISO have intensified in recent years. Many community financial institutions are looking for a virtual solution to augment the ISO responsibilities and processes. A benefit of VISO services is they provide continuity if and/or when there is a personnel change in this critical position inside the institution.

In June of 2023, regulatory agencies released new guidance for managing third-party risk, formally or often referred to as vendor management. Expect 2024 to be a year when the agencies expect these guidelines to be implemented at financial institutions. If you manage your vendor management/third-party risk management in-house, you could have some work to do to implement these changes. It may be time to consider an application to manage these ever-changing requirements for you. If you already use an application to manage third-party risks, be sure the needed changes have been updated and you are trained on how to use them.

General Technology

A key focus for technology today concerns what to move to the Cloud and when. Moving infrastructure to the Cloud is often a trade-off between operational versus capital expenditures as well as the benefits versus the perceived risks of the Cloud. Moving servers to the Cloud in 2024 will make sense for a lot of institutions. However, it is more likely that many institutions will receive their solutions via a cloud service provider. Most services and applications vendors have found it easier to manage the server themselves and offer the solution through the Cloud rather than have it installed on different hardware across their customer base. Expect this consolidation and movement to cloud-based solutions to continue and budget accordingly. If the vendor is transferring responsibility from you and your employees to themselves by hosting the service, expect the licensing or price to increase. Even if the licensing cost goes up, you may still gain a net benefit as you no longer have to maintain, upgrade, and manage hardware.

Another technology to consider moving to the Cloud is disaster recovery. There are very few solutions that allow for redundancy, recovery time, minimization of management/ownership challenges, etc., which is why cloud-based disaster recovery is an excellent option. A fully managed cloud recovery process can decrease your recovery time objectives by significant amounts and remove a lot of duplicated hardware. If your disaster recovery solution isn’t in the Cloud or if you are not convinced that what you have in place is as robust as you need it to be, consider the Cloud as a viable alternative.

Conclusion

Budgeting for technology and cybersecurity is a complex task that requires a keen understanding of current needs, future trends, and emerging threats. By allocating resources wisely across these critical areas, community banks and credit unions can secure their operations, enhance customer experience, and stay ahead in a competitive marketplace.

14 Sep 2023
How to Manage Vulnerability Effectively with V-Scan's New Features
Banks, Credit Unions, Security Brian Brannon and James Mistretta 0 comment

How to Manage Vulnerability Effectively with V-Scan’s New Features

How to Manage Vulnerability Effectively with V-Scan's New Features

It’s critical for financial institutions to stay ahead of the potential vulnerabilities and risks that can jeopardize their information technology assets. But to adequately manage risks and vulnerabilities, institutions must be able to understand what they are, identify where they are, and remedy the situation.

Risk is a multifaceted concept that encompasses threat and vulnerability. The National Institute of Standards and Technology (NIST) describes risk as the probability that a particular security threat will exploit a system vulnerability. More specifically, it is a “measure of the extent to which an entity is threatened by a potential circumstance or event, and typically a function of the adverse impacts that would arise if the circumstance or event occurs and the likelihood of occurrence.”

These circumstances can involve various sources and impacts. Generally, information system-related security risks arise from the loss of confidentiality, integrity, or availability of information or information systems and reflect the potential negative effects on organizational operations—including mission, functions, image, or reputation—organizational assets, individuals, and other organizations.

Managing Risks and Vulnerabilities

A vulnerability is a weakness in a system, an information system, system security, or even controls. Therefore, to manage their risks, financial institutions must also manage their vulnerabilities. To do this, institutions must know about their vulnerabilities and understand the context in which they exist.

Fortunately, financial institutions can use scanning technology to help with the daunting process of managing risks and vulnerabilities. Our V-Scan product, for example, is a comprehensive solution that analyzes IT assets, identifies vulnerabilities, and provides an extensive overview of the risks within the network environment. What’s more, V-Scan provides risk-prioritized data on all scanned IT assets.

V-Scan is designed to help institutions meet regulatory compliance. It performs weekly vulnerability scanning, which complies with the Cybersecurity Assessment Tool (CAT), developed by the Federal Financial Institutions Examination Council (FFIEC). Along with each weekly scan, the platform provides detailed reporting and a user-friendly dashboard that makes it easier to create an actionable plan to mitigate asset vulnerabilities. In addition, many cybersecurity insurance providers are requiring financial institutions to prove that they are managing known vulnerabilities. With V-Scan, institutions can provide reports that substantiate their weekly scans, assessments, and remediations.

Discovering Exploitable Vulnerabilities

Not only does V-Scan find current vulnerabilities in the environment, but it also uses numerous data points to measure the risk posed by those vulnerabilities. This information gives IT staff and oversight personnel timely details and the necessary context to maintain an effective vulnerability management program. One of the key ways institutions can use V-Scan is to discover assets that are at risk and weaknesses that should be resolved—particularly exploitable vulnerabilities. Being able to identify weaknesses that are known to have been taken advantage of allows institutions to prioritize their workload when securing their network.

For example, if the platform indicates that a Microsoft Windows security patch needs to be installed, V-Scan provides information needed to solve the problem, including which machines, devices, or assets are affected by the vulnerability. The product also allows filtered searches to be conducted based on the assets involved, such as domain controllers or printers. Having this enhanced capability further empowers IT staff to effectively manage vulnerability.

Contact us to learn more about how community banks and credit unions can leverage V-Scan to manage possible vulnerabilities and risks associated with their IT assets.

17 Aug 2023
The Advantages of Attending User Conferences for Banking Professionals
Banks, Compliance, Credit Unions, Security, Technology Christine Ray 0 comment

The Advantages of Attending User Conferences for Banking Professionals

The Advantages of Attending User Conferences for Banking Professionals

User conferences are dynamic events that community banks and credit unions can leverage to connect with industry experts and like-minded peers in an enriching environment. They provide a great opportunity for banking professionals to interact face-to-face with vendors; share ideas and experiences; and address their concerns about technology products, compliance, and other important industry issues. And unlike traditional industry tradeshows that are mainly designed to attract new business, user conferences have a broader purpose that translates into a host of benefits for attendees, including:

  • Training and education — User conferences provide access to valuable information that can help attendees keep up with the growing complexity of the financial services industry and technology. Participants can receive on-the-spot training through software demonstrations that allow them to see products in action. They can also enhance their knowledge through informative workshops, topic-based roundtable discussions, and other educational sessions. This allows them to learn from industry and subject-matter experts that can answer their questions, share insights, and impart best practices. This type of focused, in-person learning can make it easier for attendees to stay up to date with the latest technological advancements and other developments impacting their industry.
  • Networking opportunities — As another benefit, user conferences offer invaluable networking opportunities. Attendees can connect with their vendor’s team, ask specific questions, and learn better ways to use their products and services. They may even discover new tools for addressing some of the current challenges they are encountering. User conferences can also spark helpful interactions between colleagues who are using the same products; they can share strategies and best practices based on their respective experiences.
  • Relationship building — The personal connections that happen at user conferences can help reinforce the relationships that attendees have with their vendors. These events offer banking professionals a unique opportunity to learn more about the companies, products, and people they rely on to support their organization. For instance, participants can discuss the capabilities of software products directly with the people who built them and meet face-to-face with support staff they normally speak to on the phone.
  • Inspiration — While people often learn about their software products virtually, in-person user conferences provide a much more engaging—and inspirational alternative. Connecting with industry peers and vendors’ staff outside the daily office routine can stimulate creativity. The live interactions that unfold at conference events generate energy, excitement, and enthusiasm that can send participants home full of fresh ideas.

Meeting Regulatory Expectations

However, the incentive to take part in user conferences goes beyond the practical benefits; it is expected by regulators. Examiners are increasingly placing more focus on how financial institutions manage their vendors, including capitalizing on the influence of user groups. For example, the Federal Financial Institutions Examination Council (FFIEC) IT Examination Handbook’s Outsourcing Technology Services booklet states: “User groups are another mechanism financial institutions can use to monitor and influence their service provider. User groups can participate and influence service provider testing (i.e., security, disaster recovery, and systems) as well as promote client issues. Independent user groups can monitor and influence a service provider better than its individual clients.”

In addition, the FFIEC requires employees of financial institutions to engage in ongoing education and technical expertise to maintain compliance.

NetConnect™ User Conference

Safe Systems’ National Customer User Conference, NetConnect, creates the ideal setting for banking professionals and vendors to come together with their peers. This year’s NetConnect will take place in Alpharetta, Ga., just a few miles from our Georgia headquarters, on November 7-8, with a pre-conference training day on November 6.

NetConnect will bring together Safe Systems’ employees, customers, and strategic partners to exchange ideas and learn about the latest technology, compliance, and security trends in community banking. Each year, we hear positive feedback about the event from conference attendees.

Instructors were good about not letting folks get behind. A lot of ground covered in a day.
Instructors were top notch.
It says a lot to me that the entire conference content came directly from within Safe
Systems, and they all did a great job too!
A great time. I learned a lot and enjoyed myself while doing it.
The networking and social experience is top notch.
This conference is on my MUST ATTEND list!

So, whether you are a long-time or relatively new customer of Safe Systems, visit our NetConnect website to learn more about this year’s conference and how it can help you get educated, motivated, and up-to-date with the latest industry and technology trends.

29 Jun 2023
After the Disaster - How 3 Banks Survived
Banks, Credit Unions, Technology Tyler Saville 0 comment

After the Disaster: How 3 Banks Survived

After the Disaster - How 3 Banks Survived

Calamities can range from the mundane—such as a server crash—to the catastrophic, like a devastating hurricane tearing through your headquarters. During such crises, a robust disaster recovery (DR) plan for your hardware and IT infrastructure can make the difference between chaos and resilience. Over the past decade, numerous community financial institutions have faced such trials, each demanding a unique response. We share three stories of real-life disasters faced by our customers, each demonstrating how powerful solutions can alleviate distress and ensure a speedy return to business as usual.

Story 1: Twister Trouble

In our first disaster, a tornado left a community bank in ruins, rendering the building unusable for several months. Luckily, the servers were untouched. After consulting with Safe Systems, it was decided that the simplest solution was to move the servers and routers to another location. Once communications and the core were in place, the bank’s operations resumed quickly from the new site. When the primary building was finally renovated, Safe Systems returned the servers and routers over a weekend and the bank was fully functional in its original location once again.

This story illustrates that even though the servers were operable after the disaster, the conditions around them made it important to evaluate all the recovery options. Having a trusted managed services partner who isn’t in the “eye of the storm” can help you objectively evaluate the circumstances to make the best decision—even if it diverges from your original DR plan.

Story 2: Silent Disaster

Not all disasters announce themselves as loudly as a tornado. Some, like this one, can be subtle without all the surrounding clatter. After business hours, Safe Systems received a distress call about a failed core router. We were able to quickly establish a site-to-site VPN tunnel to the institution’s DR router which was hosted by us. The issue was resolved within a few hours and most of the bank employees were unaware of the incident. The bank quickly returned to normal operations, never missing a beat in customer service.

Despite the nature or the timing of an unexpected business interruption, your DR plan must ensure business-critical data and applications are available. Having a fully managed provider with after-hours emergency protocols and a high-availability system for fast recovery of critical servers via the Cloud allowed this bank to recover as quickly and as quietly as the incident occurred.

Story 3: Lightning Strike

A lightning strike caused extensive damage to a bank’s switches and the physical server hosting most of their virtual servers. With the switches destroyed and no local backup of the virtual servers, the bank had to resort to a mobile hotspot. Safe Systems set up a VPN from their DR router to the Cloud where the DR servers were housed. The bank managed to operate Wi-Fi-accessible devices for over a week until a new switch and server were installed.

When physical damage is extensive and can take weeks versus hours to repair, it is critical to have a partner that can establish connectivity to your locations and key vendors through various connection types—mobile hotspots, satellite internet, internet lines at another location—all of which should be critical aspects of your recovery plan.

Our Approach to Disaster Recovery

Safe Systems has a comprehensive approach to disaster recovery that encompasses data, server, and communication needs in times of crisis. Typically, Safe Systems hosts a backup disaster router at our Tier 4 data center, while each server is mirrored as a virtual server in a secure cloud. Annually, these servers are brought up in test failover mode and core communication is rerouted during a DR test. This helps us to provide a detailed report on the results and readiness for disaster. These servers and routers stand by, primed to leap into action at a moment’s notice, facilitated by our dedicated DR team.

Each of these stories underscores the importance of having a robust and flexible DR solution in place. Regardless of the disaster’s type or scale, having a reliable partner like Safe Systems helps ensure business continuity and secure access to critical systems and data.

08 Jun 2023
Maintenance Best Practices to Enhance Azure Security
Banks, Credit Unions, Technology Eric Delgado 0 comment

Maintenance Best Practices to Enhance Azure Security

Maintenance Best Practices to Enhance Azure Security

Financial institutions that use Microsoft Azure with Exchange Online, OneDrive, and SharePoint can apply good maintenance practices to enhance their security in the Cloud. They can employ a variety of Azure Active Director (AD) concepts to summarize their data and ultimately recognize anomalies to make the cloud environment more secure. Two of the main areas that institutions can examine to identify inconsistencies are users and devices.

Anomalies with Users

The primary Azure AD user properties to analyze are the user type, synchronization status, disabled status, and creation date. Within user type, if there are a significant number of guest users, this can raise an obvious red flag especially if there is no justification for guest users to exist. In this case, for guest users without a specific approved use case, the best option is likely to delete the user.

It can be more difficult to detect abnormalities within the synchronization status of some users, especially those being synchronized to Azure AD from on-premise AD. The key is to build a good baseline to use for comparative analysis. Because users are sourced on-premise, this number should be quite familiar. But if the number does not match expectations, it should be obvious and prompt further scrutiny.

Accounting for cloud users can also be challenging because they typically are not tracked as closely as on-premise users. But if the number of cloud users drastically changes, this may indicate an anomaly. In addition, IT administrators should be cognizant of modifications involving disabled users. If the number of disabled users changes, the situation should be reviewed to determine why.

Creation date is a unique kind of property in that it relates to both security and utility. Identifying an anomaly here should be fairly simple; the number of users should match expectations. For example, if the number of users spikes abnormally for a particular day, it definitely warrants investigation.

Inconsistencies with Devices

Another critical form of identity in Azure AD is devices, including desktops, laptops, phones, and tablets. In terms of device management, we can focus on Azure AD, Intune, and Exchange Online. Having access controls with devices makes it easier to recognize anomalies. With strict access policies, the number of devices connecting should not change significantly without an administrator’s knowledge.

Conversely, spotting anomalies becomes more difficult without stringent access policies. If IT administrators are relying on default settings, those default policies will allow users to enroll devices on their own. Administrators should build a baseline to see where their numbers are and monitor device enrollment accordingly.

Scrutinizing synchronization status can also reveal inconsistencies. IT administrators should remove devices that have not been synchronized in at least 30 days and those that have no sync data, which represents a gray area. Closely monitoring the synchronization status makes device management easier and more secure going forward.

The Maintenance and Security Connection

We have seen several real-life scenarios that illustrate the connection between maintenance and security. Here’s a common type of situation that involves the creation date and sync status: You notice that a new user was created unexpectedly, which is suspicious. You investigate, starting with the synchronization status, and find that the number of cloud users does not match. Next, you review Azure AD details based on the display names and do not see the new user. Then when you examine the users by creation date, there are only existing users.

This leads to an interesting question: Can you have more than one user in Azure AD with the same name? The answer: yes and no. There are a variety of name properties, however, the User Principal Name (UPN) must be unique. If you notice that the UPN of two users is ‘identical’ check again. Look for characters that might appear the same due to typography. It could indicate intentional obfuscation and represent a form of attack on your organization. In this case, if a user is already being created as a component of an attack, it would be safe to assume some form of administrative account has been compromised.

This type of attack could happen to almost any financial institution, and it shows the importance of using ongoing maintenance to discover irregularities. Good maintenance leads to better security in Azure AD, and Safe Systems’ CloudInsight™ family of products can assist in these efforts. They provide reports that make it easier for community banks and credit unions to catch anomalies, so they can improve their security posture. For more insights about this topic, watch our “Good Maintenance Leads to Better Security in Azure” webinar.

02 Jun 2023
The Virtual ISO: Best Practices for Maximum Effectiveness
Banks, Compliance, Credit Unions The Safe Systems Compliance Team 0 comment

The Virtual ISO: Best Practices for Maximum Effectiveness

The Virtual ISO: Best Practices for Maximum Effectiveness

The concept of a virtual information security officer (VISO) has been gaining more traction with regulators and financial institutions. In the past, regulators have said very little about institutions using a virtual ISO. But recently, the Federal Deposit Insurance Corporation (FDIC), Office of the Comptroller of the Currency (OCC), National Credit Union Administration (NCUA), and Federal Reserve System have expressed at least conditional approval of the idea. They indicated that virtual ISOs can be a viable option—as long as their activities are subject to the same oversight requirements as in-house ISOs.

These regulators caution financial institutions to be careful when considering the risks and benefits of using a virtual ISO. They advise institutions to do their due diligence prior to choosing an external ISO partner, just as they would before selecting any other key vendor or critical service provider. These and other best practices can help institutions strategically leverage a third-party solution to maximize the effectiveness of the virtual ISO role for their organization.

Approaches to Implementation

There are three broad approaches to implementing a virtual ISO solution: do-it-yourself (DIY), hybrid, and off-load. These models come with specific benefits and responsibilities that institutions should carefully consider. Here is a summary of each approach:

  • DIY: This model typically provides some apps, tools, checklists, templates, and other pre-packaged components that allow institutions to fill in the blanks. One-on-one consultation with a human would be relatively limited and likely provided for an extra charge.
  • Hybrid: This approach often includes a complete set of tools: apps, templates, pre-configured reports, and sometimes pre-configured policies. Some consultation is also provided, which makes this model better suited to institutions that require a higher level of support.
  • Off-load: With this model, the virtual ISO vendor does most of the heavy lifting, providing extensive consultation, on-demand reporting, and other ISO requirements. However, as is the case with the hybrid model, the financial institution remains responsible for understanding and approving all actions taken by the vendor on behalf of the institution.

Our Virtual ISO Model

At Safe Systems, we offer a hybrid virtual ISO model—ISOversight™—that supports regulatory guidance on the ISO’s role as prescribed by the Federal Financial Institutions Examination Council (FFIEC). Our model is a moderately priced, middle-ground solution that is ideal for community banks and credit unions with limited internal resources. It combines a suite of integrated compliance apps with a dedicated lead consultant, allowing institutions to benefit from the expertise of our entire compliance department. What’s more, ISOversight provides institutions with a more objective, arms-length perspective on information security. The FFIEC Management Handbook states that “To ensure independence, the CISO/ISO should report directly to the board, a board committee, or senior management and not IT operations management.” Having these two critical roles formally separated makes it easier for the network administrator to be in more of a support function for any resident or virtual ISO, which can minimize audit or exam findings related to a possible “conflict of interest” or “concentration (or separation) of duties.”

Although the apps are useful tools that assist institutions with day-to-day tasks, the key to ISOversight’s effectiveness is the consultive and advisory piece provided by the ISOversight lead consultant. Our consultants are all information security subject matter experts, with decades of experience. We know what tasks need to be completed, with what frequency, and by what groups or individuals. We hold regular touchpoint meetings with the ISO, and often the network administrator and other third-party consultants, to ensure institutions stay on track. After each touchpoint, we also provide a comprehensive point-in-time summary report on the current status of their information security processes that the ISO can then present to the steering committee and the Board.

In addition, our consultants will often engage with clients as they prepare for and respond to an audit or exam, but it’s not unusual for us to consult directly with the auditor and examiner during the engagement. We encourage this, as it helps ensure the FI is providing auditors and examiners with exactly what they are requesting (no more and no less), which avoids unnecessary confusion, possible issue escalation, and over (or under) commitment by management. In addition to the advisory piece, the ISOversight apps keep things organized, making it easier for customers to manage their policies and procedures and all the associated documentation, and provide customizable email alerts when tasks come due.

To date, we have found that ISOversight has proven to be a great fit for many institutions and for many different reasons. For example, it is extremely helpful in situations where the IT administrator or ISO has recently left or has transitioned to a new role. Another good application for the virtual ISO role is when the size and complexity of the institution make the day-to-day information security responsibilities too burdensome, or when the institution just wants to free the existing admin or ISO from the uncertainty of the rapidly evolving regulatory landscape.

Whether it’s third-party risk management, business continuity management, cybersecurity, or strategic planning, guidance is clear that ISO’s have very specific responsibilities and should be held accountable for their completion. ISOversight assures all tasks the ISO is responsible for are addressed in a timely manner, that all current regulatory guidelines and best practices are met, and just as importantly that on-demand, stakeholder-specific documentation is available to confirm all related activities. Ultimately, selecting the right virtual model and the right vendor can often translate into “cleaner” audits and exams, resulting in a less stressful, more productive staff, a more compliant and more secure environment, and a better-informed management team.

To learn more about this topic, listen to our webinar on “The Virtual ISO: Best Practices for Maximum Effectiveness.”

11 May 2023
The Importance of Effective Third-party Management
Banks, Compliance, Credit Unions The Safe Systems Compliance Team 0 comment

The Importance of Effective Third-party Management

The Importance of Effective Third-party Management

As financial institutions increasingly rely on outsourced providers, third-party management is becoming a more critical aspect of managing risk. Institutions depend on third-party providers for a variety of essential services, including technology, operations, and marketing. And while these entities offer significant benefits, such as cost savings and improved efficiency, they also pose a substantial risk. We often refer to this as “inherited” risk, as institutions will inherit the residual risk of the third party. If not properly identified, measured, and addressed, inherited risk can expose financial institutions to threats such as regulatory non-compliance, operational downtime, and reputational damage. However, institutions can successfully mitigate many of these risks by ensuring that they thoroughly vet outside providers prior to engagement, properly structure contracts, and employ ongoing monitoring and reporting.

Key Elements

The Federal Financial Institutions Examination Council (FFIEC) has issued guidelines for managing vendor relationships effectively. These standards emphasize the importance of several key elements, including:

  • Due diligence: Financial institutions must evaluate vendors’ financial stability, reputation, and regulatory compliance prior to engagement. This includes assessing vendors’ security controls, data protection policies, and disaster recovery plans.
  • Contract management: Vendor agreements should clearly outline the scope of work, deliverables, and performance metrics. They should also include provisions for termination, dispute resolution, data disposal, and indemnification.
  • Ongoing monitoring: Financial institutions must regularly monitor their third parties to ensure that they continue to meet contractual obligations and regulatory requirements. This includes periodic risk assessments, reviewing vendor reports, and could even include conducting on-site visits.
  • Risk assessment: Institutions should assess the level of risk associated with each vendor relationship based on the services provided, the vendor’s access to sensitive data, and the potential impact of vendor failure. Doing so can help financial institutions allocate resources more effectively to minimize potential risks.
  • Board and management oversight: Third-party management should be an ongoing topic of discussion at the board and management levels. This includes not only approving policies and procedures, but also reviewing risk assessments and monitoring reports, and making decisions about initiatives that require new vendor relationships.

Common Misconception

Risk management requires first identifying the risk’s source before it can be measured and mitigated. To accomplish this, it’s important to separate the risks of the underlying initiative from the risks of the third party that supports the initiative. With the possible exception of reputation risk, most of the risks surrounding the evaluation and implementation of a new initiative are associated with the initiative itself, not the third party. Simply put, if the strategic, operational, and regulatory risks would be present in the initiative regardless of the third party selected, it does not belong to the third party, it belongs to the initiative or project. We’ve found this to be a fairly common misconception, even among auditors and examiners.

Effective Solutions

Once the risk source is confirmed as associated with the third party as opposed to the initiative, institutions must create a protocol for what risks to assess and how to assess them (the inherent risk), what specific controls to implement, and the effectiveness of those controls assuming they will be correctly implemented and operate effectively (the residual risk). This is where an app can significantly help standardize and streamline the process. An automated third-party risk management program will identify and assign specific controls according to the specific risks and risk levels identified.

With the increased focus on third-party risk management, more banks and credit unions are finding that auditors and examiners expect institutions to not just identify appropriate controls, but to actually request, receive, and review them. Particularly key control documents, such as contracts, financials, and audit reports, such as System and Organization Controls (SOC) reports. However, knowing what to look for (and where to look) in these documents can be challenging. Partnering with a third-party service to assist you can provide a second set of eyes and additional expertise to ensure that these documents are supplying the necessary controls.

Other key features to look for in an effective third-party risk management program include the ability to assign one or more vendor managers, email reminders when tasks are due or overdue, automatic Office of Foreign Assets Control (OFAC) checks, the ability to easily identify and track complementary user entity controls (CUECs), the ability to store key vendor documentation and notes. Also, a robust on-demand reporting feature is important to be able to provide stakeholders with timely, accurate updates on the status of your third-party risk management program.

By associating with the right partner, financial institutions can develop a strong third-party risk management program that aligns with guidance, keeps data private and secure, and minimizes the impact of third-party cyber threats. Safe Systems, for example, offers a wide range of vendor management solutions to help institutions ensure regulatory compliance.

20 Apr 2023
Best Practices for a Successful ISO Transition
Banks, Compliance, Credit Unions The Safe Systems Compliance Team 0 comment

Best Practices for a Successful ISO Transition

Best Practices for a Successful ISO Transition

It can be challenging for financial institutions to lose an information security officer (ISO)—particularly for smaller community banks and credit unions. Since ISOs have broad responsibilities relating to data security and other vital areas1, they play a critical role within the organization. Therefore, institutions must have a well-defined plan in place to keep an ISO’s transition or departure from adversely affecting their security posture.

There are many reasons an ISO may leave—retirement, a transfer to another role within or outside of the organization, or perhaps an unanticipated health issue. Whichever the circumstance, the reason for departure can significantly impact the transition process. For instance, if the position was vacated due to a planned retirement or staff reorganization, there can be a smooth transfer of duties between the outgoing and incoming ISOs. However, a sudden job change can result in a more complicated process.

There are two main facets of the ISO’s role that are critical to focus on during a transition: access to data and applications, and the continuity of the processes and responsibilities that the position encompasses.

1) Ensuring that access to data and applications is properly revoked, modified, and/or reallocated during an ISO transition is very similar to what happens when an IT Administrator leaves a financial institution. Although the IT and ISO roles (and their respective data access requirements) are different, the steps outlined in this article can help ensure information is protected when either role departs.

2) Some of the key areas of responsibility that must continue during an ISO transition include:

  • Infosec compliance, including regulatory guidance, written policies, written procedures, and documented practices
  • Oversight and coordination of data security efforts, including protecting the privacy and security of sensitive information belonging to the institution and its customers and members
  • Business continuity management and incident response programs, including exercises and tests
  • Third-party risk management (TPRM)
  • Cybersecurity assessments, gap analysis, action plans, and
  • Lead for steering committee meetings
  • Information security program status updates to the board of directors
  • IT audit and exam preparation, participation, and response

Planning Ahead

There are a number of strategies institutions can proactively implement to make an ISO’s job transition as successful as possible. A primary step to take is succession planning. This should be considered whether or not an ISO departure is anticipated. Regulators expect institutions to have a formal succession plan for all key leadership positions, and few roles are more critical than the ISO, as failing to maintain infosec continuity can leave an institution exposed and potentially more vulnerable to security issues.

Succession planning is often more problematic for smaller community banking institutions where employees typically wear multiple hats. Regulatory guidance requires that the ISO exist as a separate role within the institution. And while it is easy to designate an ISO successor on paper, an institution with limited staff may not have an employee with the appropriate knowledge, experience, and availability ready to step into the role. In addition, because of the potentially smaller talent pool in the geographic areas that community institutions serve, our experience is that smaller institutions often have difficulty finding good candidates.

However, if a solid succession plan is in place that includes both internal and external resources, the incoming ISO should at least have access to adequate experience and subject matter expertise to seamlessly step into the new role with minimal disruption. In a situation where there is seamless continuity, at least one of the following usually applies:

  1. The employee replacing the ISO has been given sufficient prior notice and preparation, including cross-training and job shadowing.
  2. Ideally, the incoming ISO has gained previous experience at a financial institution of similar size and complexity, or at minimum, managed information security in a regulated environment.
  3. The institution has partnered (or can partner) with a third-party provider to augment the role with a virtual ISO (vISO) solution.

Getting Help to Ensure a Seamless Transition

To be clear, transitioning between ISOs can be challenging whether the institution grooms an internal successor, hires a seasoned outsider, or partners with a third party (or a combination of the three). In all cases, there will be some type of learning curve. Either a promoted employee will need time to build proficiency in the position, or a hired replacement (individual or third-party provider) will need time to get familiar with the institution. Inevitably, the probability of security gaps will increase during this transition period, and IT auditors and examiners know this too. For this reason, employing a third-party provider is often an effective way to maintain infosec continuity during a transition, and ensure that all IT and information security tasks and related activities are completed on time and properly reported to the various stakeholders.

The bottom line: ISO transitions are inherently challenging—and seamless continuation is critical as they directly impact a financial institution’s audit and exam success as well as overall security posture. Whether the job change is planned or unexpected, institutions can apply effective succession planning to minimize the disruption. They can also address any deficiencies in their own internal knowledge and expertise by partnering with a third-party provider like Safe Systems. As an example, a bank in South Carolina used Safe Systems’ Virtual ISO service, ISOversight, to support succession planning for its retiring ISO. This resulted in multiple benefits, including an interrupted security posture, improved business continuity management, third-party management, and strategic planning.

1ISO responsibilities may consist of strategic planning, quality assurance, project management, InfoSec risk assessments, infrastructure and architecture security, end-user computing, and regulatory and legal compliance

05 Apr 2023
Evolution of Third-party Management
Banks, Compliance, Credit Unions Tom Hinkel 0 comment

Evolution of Third-party Management

Evolution of Third-party Management

Pending interagency guidance on the management of third-party relationships will significantly alter how financial institutions (FIs) handle risks related to external service providers. The new guidelines will increase the complexity and responsibility of third-party management for banking organizations in the near future. These standards will apply to all financial institutions—including community banks—with third-party relationships.1

The updated guidance—proposed jointly by the Board of Governors of the Federal Reserve System (the Board), Federal Deposit Insurance Corporation (FDIC), and Office of the Comptroller of the Currency (OCC)—will consolidate2 the agencies’ separate rules into a single common guideline built around the OCC Bulletin 2013-29. The proposed guidance states that “the new framework is based on sound risk management principles for banking organizations to consider in developing risk management practices for all stages in the life cycle of third-party relationships.”

Increased Regulatory Expectations

FIs s need to consider the key implications of increased regulatory scrutiny in this area, particularly where they expand on current expectations. For instance, regulators will expect them to do more due diligence on the pre-engagement side, which affects the initial selection and contract negotiation process. Institutions will also be held more accountable for understanding and predefining the termination process for outside service providers. This includes considering who owns data, how the data is returned, and how it is disposed of after the relationship with the provider ends.

From a regulatory perspective, third parties represent the biggest single source of noncontrollable risk to a bank or credit union. To a considerable extent, examiners will draw comparisons to overall enterprise risk management maturity from an institution’s third-party risk management program. In their words; “A banking organization’s failure to have an effective third-party risk management process that is commensurate with the level of risk, the complexity of third-party relationships, and the organizational structure of the banking organization may be an unsafe or unsound practice.” In addition, they will expect to see sufficient oversight at all levels, from the board to senior management, and ultimately the employees directly overseeing the individual relationships.

Vendor vs. Third Party

It is also critical for FIs to be aware of—and adjust for—the difference between the terms “vendor” and “third party.” While banks have historically used these words interchangeably, it is now clear that institutions will have to remove the term “vendor” from their vocabulary and substitute “third-party” in its place. The proposed guidance uses the term “vendor” only 4 times, while the term “third-party” is used 262 times!

The reason for the change is more than just semantic, it represents a significant shift in how a third party is defined. A third party can be any entity with which the institution has a business relationship, and neither a written contract nor monetary exchange is necessary to establish a business arrangement. A business relationship can include more obvious arrangements such as referral agreements and professional services providers like law and audit firms, but also less obvious companies such as maintenance, catering, and custodial service companies. Business arrangements have greatly expanded and become more varied and, in some cases, far more complex. FI’s should be prepared to expand the scope of their third-party risk management (TPRM) program.

Expansion of Third-Party Risk Assessment

Financial institutions will also need to expand third-party risk management beyond the scope of the Gramm-Leach-Bliley Act (GBLA) to comply with the new guidance. They should broaden their focus beyond non-public information (NPI) to include anything that may not be directly related to customer information, but still needs to remain confidential. This can include strategic plans, unaudited financial statements, HR and shareholder records, and committee meeting minutes. Regardless of the type of information, regulators will expect institutions to manage their risk by accurately assessing all third-party exposure to the storage, transmittal, and processing of information.

While institutions cannot directly control third-party risks, they will need to request and review certain documents—especially from critical parties. A few key third-party documents that institutions should examine prior to engagement3 include contracts, audit reports4, and financials. Depending on criticality, FIs may also need to maintain a list of potential alternate providers in case their primary provider fails or cannot complete the terms of their contract. Finally, institution management should be fully aware of any gaps or limitations in third-party contracts, so they can manage any increased residual risk effectively.

Another area likely to draw increased scrutiny is Complementary User-entity Controls (CUECs), included in the SOC report. These are the controls third parties require for you to utilize their products or service. The best practice strongly suggests you document these CUECs and adhere to them.

Financial institutions that may lack the internal time and/or expertise to review third-party contracts, financials, and SOC reports, can consider adding a solution like Safe Systems’ Vendor Management Document Review. The service enhances the control review process and makes it easier for institutions to meet the increased regulatory expectations for managing third parties. Read more about this topic by accessing our “Evolution of Third Party Management” webinar.

1 As of this date the NCUA has not indicated that they will be a signatory on this new guidance.

2 The Board’s 2013 guidance, the FDIC’s 2008 guidance, the OCC’s 2013 guidance and its 2020 FAQs.

3 Certain documents such as SOC reports may only be made available after a contract is in place.

4 Depending on the trust criteria selected, audit reports like the AICPA System and Organization Controls (SOC) 1 and SOC 2 should also include an auditor opinion on the information security and business continuity controls in place at the third party.

06 Mar 2023
MFA - Why You Can’t Set It and Forget It
Banks, Credit Unions, Security, Technology Eric Delgado 0 comment

MFA—Why You Can’t Set It and Forget It

MFA - Why You Can’t Set It and Forget It

Multifactor authentication (MFA) is not a static, set-it-and-forget-it process. Financial institutions must constantly monitor—and make necessary adjustments—to ensure effectiveness so that only authorized users are accessing their network, data, and services.

MFA Methods and Risk

Some of the most common MFA methods, particularly with Microsoft Azure are:

  • FIDO2 security key
  • Microsoft Authenticator app
  • Windows Hello for Business
  • OATH hardware/software tokens
  • Short messaging service (SMS)
  • Voice calls

FIDO2—the latest and greatest MFA—enables easy and secure authentication. It takes passwords out of the equation and instead uses public key cryptography for authentication to enhance security. The Microsoft Authenticator app is also capable of passwordless authentication in Azure, which is making it an increasingly popular option. This modern multi-factor authentication method can act as a FIDO2 key, send push notifications, and support user awareness by providing location and client data within the app.

Windows Hello for Business is another form of advanced authentication that is also capable of passwordless authentication. However, institutions should be careful when implementing this approach to MFA because it can entail unique stipulations.

Two of the riskiest types of authentication are MFA facilitated by either SMS or voice calls. SMS-enabled MFA, which combines the use of a text message and code, is one of the most frequently used methods of authentication. However, since text messages are not encrypted, they are vulnerable to telecom tower relaying interference. Because of this vulnerability and its wide adoption, SMS is a major target of attackers. Voice calling, which uses telecom services to call with the code, is another risky form of MFA because it is possible that someone else could intercept the phone call.

For any TOTP-based method of MFA, there is an inherent risk of users giving away the codes. This can be accomplished via clever phishing techniques or malicious applications on mobile devices.

Combining MFA with Other Defensive Layers

Today’s sophisticated cyberattacks often attempt to exploit weaknesses that are present in the MFA workflow. Unlike traditional attacks that sought to bypass basic authentication protocols, newer schemes tend to follow normal MFA workflows to exploit human behavior. Attackers are also using other creative strategies to effectively circumvent MFA requirements. For example, they may hijack an already MFA-authenticated session to gain unauthorized access.

To evade cyberattacks, institutions must go beyond taking a relaxed, set-it-and-forget-it stance for MFA. They must enhance MFA by adopting newer more modern methods for their users. They must also be cognizant of attacks that can effectively bypass MFA, as we have seen with MFA-resistant phishing scams. To compensate for these newer styles of attacks, institutions should seek to implement multiple layers of security. In Azure, this will mean the adoption of Conditional Access Policies (CAPs). Stacking multiple CAPs targeting various combinations of MFA, apps, clients, locations, compliance status, and device types is the best way to improve an organization’s security posture. For more information about this important topic, watch our webinar on “MFA–Why You Can’t Set It and Forget It.”

23 Feb 2023
Mitigating Sophisticated, MFA-Resistant Phishing Scams
Banks, Credit Unions, Security Jamie Davis 0 comment

Mitigating Sophisticated, MFA-Resistant Phishing Scams

Mitigating Sophisticated, MFA-Resistant Phishing Scams

Phishing attacks are becoming more complex—and successful—making them more problematic for companies to combat. As a prime example, a recent phishing scam has been circumventing multifactor authentication (MFA) to successfully breach multiple companies. The attacks, which seem to be targeting banks and credit unions, are a stark reminder of the constant cyber threats that financial institutions face and the importance of following effective risk mitigation tactics.

The recent email scam is a sophisticated scheme; it exploits weaknesses in MFA and essentially bypasses them to launch an attack. The attackers deploy deceptive emails to obtain employees’ Microsoft 365 (M365) usernames, passwords, and MFA codes, and then they use this information to try to wire money outside the institution. Not only are these assaults breaching the initial targets, but they are also using the victims to infiltrate other companies.

The phishing scheme can be particularly detrimental to institutions that are not employing Azure Active Directory (Azure AD) Conditional Access Policies to bolster their security in Azure. Since Azure AD manages login credentials for users allowing them to access multiple M365 services and internal accounts from anywhere online, it is critical to apply access controls that provide another layer of protection beyond MFA.

Addressing Phishing Threats

There are various steps banks and credit unions can take to address MFA-resistant phishing attacks. Since humans are the weakest link in cybersecurity, institutions should ensure their employees are immediately informed about this particular phishing attack. They should also train employees regularly to recognize phishing emails so they can avoid being deceived. The key: Make sure employees know not to input their username and password in any link they receive by email.

Although this specific threat has the potential to exploit weaknesses in MFA, financial institutions should still implement this authentication method as it remains one of the most effective at blocking account compromises. As previously mentioned, it is also important to increase protection against attacks by adding Azure Conditional Access Policies to the Azure environment. Another preemptive step is to employ a monitoring and reporting solution for the Azure tenant. Often once a system is breached, attackers go into the tenant and create new rules to cover their tracks. Visibility into security settings through proactive reporting and alerts can make it easier for institutions to detect any suspicious activity or changes with logins and email rules, helping them stay on top of potential threats.

How Safe Systems Can Help

It can be challenging for many institutions to effectively manage their access and security settings in Azure AD and M365. However, Safe Systems offers CloudInsight™ M365 Security Basics to make the task easier. The CloudInsight™ collection of products offers a variety of reports and alerts that are specially designed to help institutions enhance their awareness of the Cloud. M365 Security Basics provides visibility into security settings for Azure AD and M365 tenants to help institutions detect targeted phishing or SPAM attacks. It can also expose other common risks like compromised user accounts, unknown users and forwarders; unapproved email access; and the unknown use of sharing tools. With M365 Security Basics, community banks, and credit unions can receive the expert insights they need to minimize, limit, or stop sophisticated phishing attacks.

07 Feb 2023
Highlights from our Annual Look Back at Regulatory Updates
Banks, Compliance, Credit Unions Safe Systems 0 comment

Highlights from our Annual Look Back at Regulatory Updates

Highlights from our Annual Look Back at Regulatory Updates

As 2023 continues to unfold, there are some important regulatory compliance tips, tricks, and trends that financial institutions should review from last year and consider in the future.

Looking Back

Two key issues to revisit from 2022 are the new Computer-Incident Notification Rule and updates to the 2018 Cybersecurity Resource Guide for Financial Institutions. The incident notification rule—approved in 2021 by the Federal Deposit Insurance Corporation (FDIC), Federal Reserve System, and Office of the Comptroller of the Currency (OCC), went into full effect in April 2022. Under the rule, banking organizations must promptly notify their primary federal regulator of certain computer security incidents that rise to the level of a notification incident within 36 hours. Anything that could materially disrupt or degrade your critical operations could be classified as a notification incident. Most institutions should have already adjusted the policies and procedures of their incident response plan to comply with the new notification requirements. If they haven’t, they should do so immediately because this will undoubtedly be an issue in the next examination cycle.

The rule also obligates third parties to report certain events that occur, so financial institutions should cover this issue with new vendors and those renewing contracts. Institutions should ensure that all contracts specify under what conditions third parties must inform them of any incident. Contracts should also identify at least one contact person to notify within the institution if an event occurs.

Late last year, the Federal Financial Institutions Examination Council (FFIEC) updated its Cybersecurity Resource Guide, which is designed to help financial institutions meet their security control objectives and prepare to respond to cyber incidents. The revised guide features updated references and a list of ransomware-specific resources, which is well warranted given the increasing frequency and complexity of ransomware incidents. The guide now includes eight different cybersecurity assessment tools that institutions may use, along with the “gold-standard” Cybersecurity Assessment Tool (CAT) to combat the evolving threat of ransomware.

Looking Ahead

This year, ransomware will continue to be one of the key areas of focus for financial institutions—as well as auditors and examiners. Institutions should also start thinking of using the term “third-party risk management” instead of “vendor management” to match an impending shift in interagency guidance. The new terminology is more than just semantic, it represents a shift in how the agencies define anyone with whom you interact; including those with or without a contract, and with or without the exchange of compensation. Regulators will be releasing new guidance relating to the issue of third-party relationships and risk management. The stronger emphasis on third-party risk management is significant because it implies a broader and deeper scope of responsibility for institutions in terms of their engagement and oversight processes.

In addition, the guidance will likely propose a six-part, third-party risk management process. The process, for instance, will cover key areas like early planning, selection due diligence, and contract negotiation. It would be wise for institutions to begin contemplating these new expectations and how they will navigate the different aspects of third-party risk management in the future.

Anticipated Trends

There are also some potential trends that financial institutions should be aware of going forward. Based on their actual recommendations or observations, auditors and examiners expect institutions to:

  • Identify tolerances for processing and data recovery times for ransomware events—separately from the standard recovery times (RTOs) established in the business impact analysis.
  • Have a list of forensic experts available to call if they require assistance with cyber events. (Your cyber insurance provider may require you to utilize their associates, so it’s best to check.)
  • Formalize vendor information and ensure their management team is periodically updated about third-party risk management practices.
  • Have project management policies that address steps to request and approve new applications, including licensing, contracts, business justification, integration, and risk assessments.
  • Make provisions for succession planning for IT, which is a key component in the risk management program. (If necessary, smaller institutions might consider outsourcing the IT role to ensure an appropriate succession plan is in place.)

Read more about this topic by accessing our webinar on “Regulatory Tips, Tricks, and Trends—Looking Back and Ahead.” Or contact us for more information about how our compliance services are specially designed to help community banks and credit unions meet their regulatory requirements.

27 Jan 2023
What to Look for in a New Firewall Vendor
Banks, Credit Unions, Security Will McWilliams 0 comment

What to Look for in a New Firewall Vendor

What to Look for in a New Firewall Vendor

If your bank or credit union needs a firewall vendor, it’s important to know what to look for to meet your security and regulatory requirements. Maybe you are proactively searching for a new firewall provider or suddenly discovered that you need to replace your current one. Whatever the case, you should search for a firewall vendor that specializes in the financial industry. This will ensure your financial institution has access to expertise and insights that are more specific to banking regulations.

In addition, you should look for a vendor that can serve as a “one-stop-shop” that covers all the security angles. The company should provide an all-inclusive solution that encompasses firewall monitoring, and management as well as intrusion detection and prevention. It’s also important to find a firewall vendor that offers concise and digestible reporting, along with meaningful insights created specifically for the banking community.

It is also equally important to search for a firewall vendor that can meet your institution’s implementation time frame. Ideally, you should plan five to six months out for a firewall implementation to compensate for hardware lead times; however, this may not always be possible. For example, your institution may have encountered an unexpected problem with renewal and need to quickly pivot to another firewall vendor. In this case, you will need to look for a vendor that is capable of deploying a firewall within a tight timeline.

As a precautionary measure, financial institutions must stay on top of contract management. Institutions should have a good relationship with their vendors and review contracts well before they are scheduled to renew. They should closely examine the contract terms and ask questions to ensure they are aware of any upcoming revisions or new developments. This can help them avoid getting caught off guard by any last-minute contractual issues that may disrupt their operation.

So how can banks and credit unions find a prospective firewall vendor? They can consult peers in the banking industry and inquire if their current service providers also offer firewalls. Ultimately, financial institutions should make sure their selected vendor has the appropriate security layers and reporting needed to check all the boxes from an examiner’s perspective. Safe Systems’ Managed Perimeter Defense (MPD), for example, employs multiple layers of advanced tools to help financial institutions protect their IT security environment. MPD’s next-generation firewall capabilities provide deeper analysis and improved detection of modern threats, which makes it easier for institutions to enhance their security posture.

12 Jan 2023
Top Blogs of 2022
Banks, Compliance, Credit Unions, Security, Technology Jamie Davis 0 comment

Top Blogs of 2022

Top Blogs of 2022

Last year, we covered a wide range of blog topics, including ransomware prevention and recovery; business continuity management and disaster recovery; and managing Microsoft Azure and Microsoft 365 settings. In case you missed them, here’s a synopsis of our top blogs of 2022. Reviewing these important issues can help your bank or credit union be better prepared for the challenges—and opportunities—that lie ahead in 2023:

1. Best Practices for Ransomware Prevention and Recovery

Ransomware attacks strike a new target every 14 seconds, disrupting operations, stealing information, and exploiting businesses, according to the Cybersecurity and Infrastructure Security Agency (CISA). However, financial institutions that consistently employ best practices can prevent or bounce back from a ransomware assault. As an optimal strategy for prevention, institutions should identify and address known security gaps that can allow a ransomware infection. Since human error is the primary reason for most security breaches, banks and credit unions should focus on providing ransomware awareness training to help employees identify, respond to, and minimize attacks. They can also limit cybersecurity risk by using intelligent network design and segmentation to restrict ransomware intrusions to only a portion of the network and by having overlapping security solutions to provide layered protection. If a ransomware incident does occur, financial institutions should have pre-defined procedures for response and recovery. Many smaller institutions may lack the expertise internally to implement ongoing best practices for ransomware prevention and recovery, but they can work with an external cybersecurity expert to augment their resources. Read more.

2. Your Guide to Business Continuity Management and Disaster Recovery Planning

It can be challenging for financial institutions to implement successful strategies for business continuity management (BCM) and disaster recovery (DR). But our compilation of key strategies and best practices can facilitate the process. BCM encompasses all aspects of incorporating resilience, incident response, crisis management, vendor management, disaster recovery, and business process continuity, and it is an essential requirement for avoiding and recovering from potential threats. DR—the process of restoring IT infrastructure, data, and third-party systems—should address a variety of events that could negatively impact operations, including natural disasters, cyberattacks, technology failures, and even the unavailability of personnel. For successful disaster recovery, institutions should focus on four important “Rs”: recovery time objective (RTO), recovery point objective (RPO), replication, and recurring testing. In addition, leveraging a comprehensive cloud DR service can enhance redundancy, reliability, uptime, speed, and value. Using a cloud DR solution from an external service provider can give institutions the confidence of knowing their DR plan is being thoroughly tested and will work if a real disaster happens. Read more.

3. Managing Security, Identity, and Compliance within the Microsoft Azure and M365 Ecosystem

Microsoft Azure Active Directory (Azure AD) and Microsoft 365 have a distinct ecosystem. Understanding their services and settings is critical for IT administrators to manage security, identity, and compliance within their environment. Institutions can significantly bolster security by implementing some of the basic security settings under the free license level for Azure AD. Adjusting the security default setting, for example, can have a major impact. IT administrators can enable security defaults to enforce non-configurable conditional access policies as well as require multifactor authentication (MFA) registration for all users. IT admins should also review the identity architecture for their institution to ensure all users, devices, and apps connecting to Azure have an identity. Depending on their license level, institutions may be able to modify additional settings, such as allowing global auditing, blocking open collaboration, and restricting outbound email forwarding. Microsoft is constantly revising the features of Azure AD and M365, making it vital for financial institutions to stay on top of their ever-changing ecosystem. Read more to learn how to manage the complexities of customizing your Azure AD and M365 security settings.

Read about other important topics on cybersecurity, compliance, and technology. Subscribe now to the Safe Systems blog to have the latest updates on banking trends and regulatory guidance conveniently delivered to your inbox.

07 Dec 2022
Your Guide to Business Continuity Management and Disaster Recovery Planning
Banks, Compliance, Credit Unions Safe Systems 0 comment

Your Guide to Business Continuity Management and Disaster Recovery Planning

Your Guide to Business Continuity Management and Disaster Recovery Planning

Your Guide to Business Continuity Management and Disaster Recovery Planning

Overview

 

Businesses today encounter an ever-increasing volume of operational threats, so it’s critical for banks and credit unions to have adequate business continuity and disaster recovery (DR) procedures in place. Business continuity management (BCM) entails all aspects of incorporating resilience, incident response, crisis management, vendor management, disaster recovery, and business process continuity—and it can enable an institution to keep operating if a disruption such as a cyberattack, natural disaster, or man-made event occurs.

We understand that BCM and DR planning can be challenging, so this guide provides some key strategies and best practices to help financial institutions execute them successfully.

BCP vs. DR: Key Differences

 

It is first important to understand the key differences between a business continuity plan (BCP) and a disaster recovery plan as these two terms are often mistakenly used interchangeably. The Federal Financial Institutions Examination Council (FFIEC) updated its Business Continuity Management IT Examination Handbook a few years ago to expand its focus from “business continuity planning” to “business continuity management.” The BCM process is one in which a financial institution must proactively plan for resiliency to disruptive events and recover from those events. The traditional business continuity plan is now a subset of the overall BCM process and will be referred to as business continuity management plan (BCMP) going forward. The BCMP outlines what needs to happen to ensure that key products and services continue to be delivered in case of a disaster. On the other hand, the DR plan outlines the specific steps to be taken to recover the interdependencies the institution must restore to return to normal operations after a disaster. The BCMP focuses on the continuation of critical functions, while the DR plan focuses on the restoration and recovery of the specific individual technology and third-party components necessary for those functions.

BCMP: A plan to continue the business operations necessary to ensure key products and services are delivered

DR: A plan for accessing required technology, infrastructure, and third-party components after a disaster

In the previous guidance, business continuity and disaster recovery were closely tied together, but the new guidance defines them as two separate concepts and states that “The business strategy, not technology solutions, should drive resilience.” It places a heavy focus on resilience and states that financial institutions cannot rely on technology alone to ensure resilience. Although technology can help provide resilience and offer significant advantages to your recovery capabilities, indeed in many cases technology could be what failed in the first place. Financial institutions must be able to offer products and services to their customers or members regardless of technology or third-party failure, and often that could mean using manual processes and procedures to accomplish this.

Finally, the latest BCMP guidance provided an important distinction between a “test” and an “exercise.” Simply put, a test focuses on demonstrating the resilience and recovery capabilities of your systems, and an exercise addresses the people, processes, and procedures. For example, where a test may focus on backup and recovery options of systems, data restoration, device replication and rebuild or replacement, an exercise would verify that your staff (and ideally third parties) are aware of and could execute those options effectively. Both exercises and tests are now a requirement, and together they provide a high degree of confidence that your recovery procedures will allow you to meet your pre-determined process for recovery time objectives (RTOs).

Business Continuity Management Planning

 

Business continuity management is an essential system for preventing and recovering from potential threats. As a part of the business continuity process, a compliant and successful BCMP should include risk management (business impact analysis and risk/threat assessment); continuity strategies (interdependency resilience, continuity, and recovery); training and testing (exercises); maintenance and improvement; and board reporting.

What CEOs Should Know about BCMP

 

To adhere to regulatory guidance, it is imperative for institutions to not only comprehend the entire business continuity management program but also employ a broad process-oriented approach that considers technology, business operations, testing, and communication strategies that are necessary for the entire organization—not just the information technology department.

Management should develop BCMPs with sufficient detail appropriate to the institution’s size and complexity. According to FFIEC guidance, “The BCMP should address key business needs and incorporate inputs from all business units.” The institution’s business continuity management program should align with its strategic goals and objectives. In addition, management should consider the entity’s role within and impact on the overall financial services sector when developing the program.

Key Steps to Developing a Compliant BCMP

 

BCM 10 Steps

To develop a successful, compliant BCMP, it is important to understand and follow the recent, more detailed view of the BCM lifecycle in the FFIEC Business Continuity Management IT Examination Handbook. This approach is a bit more complicated than the process has been in the past and may require more time for plan preparation and annual maintenance. Here is a checklist consisting of the required elements of the new approach that may not be incorporated into your current program:

  1. Have you conducted a formal business process-based Business Impact Analysis (BIA) that identifies all critical interdependencies?
  2. Does the BIA produce sufficient information to establish the following?
    • Recovery point objectives (RPO)
    • Recovery time objectives (RTOs) for each business process (prioritized)
    • Maximum tolerable (or allowable) downtime (MTD/MAD)
  3. Does your risk/threat assessment measure both the impact and the probability (likelihood) of potential disruptive threats, including worst-case (low probability, high impact) scenarios?
  4. Do you use testing as employee training exercises to verify that personnel is knowledgeable of recovery priorities and procedures?
  5. Do you track and resolve all issues identified during testing exercises and use lessons learned to enhance your program? (Must be documented.)
  6. Does your board report include a written presentation providing the BIA, risk assessment, and exercise and test results, including any identified issues?

Tactics for Staying Ahead of Regulators

 

Although there are several tips, tricks, and tactics to enhance compliance, one of the main tactics financial institutions can apply to stay ahead of regulators is to focus on resilience. Resilience includes the ability to anticipate, prepare for, prevent, and adapt to changing conditions, and to respond to, withstand, and recover rapidly from deliberate attacks, accidents, or naturally occurring threats or incidents. Management should incorporate the concept of resilience into all areas, including their business continuity management process, vendor management program, third-party supply chain management, and information security program. The objective is to implement processes to minimize the possibility of disruption and reduce the impact of such an event if it happens.

Inconsistencies between procedures and practices will often result in exam findings. Mentioning outdated references or older terminology in policies is one of the most common offenses that institutions commit. For instance, referencing business continuity plan or planning (BCP) versus business continuity management plan or planning (BCMP). This would be a minor mistake because the term BCP is not necessarily obsolete, but it’s not consistent with the most recent guidance and could raise a “red flag” that leads examiners to wonder if the institution has properly updated its policies, resulting in further scrutiny. A tactic that financial institutions can use to minimize outdated references and other inconsistencies between procedures and practices is to implement automation. Technology can make it easier for institutions by providing regular updates to accommodate changing regulations and trends as well as make it more feasible for them to identify inconsistencies between their policies and procedures.

Disaster Recovery Planning

 

Disaster recovery—the process of restoring IT infrastructure, data, and third-party systems—should address a broad range of adverse events such as natural disasters, infrastructure failures, technology failures, unavailability of staff, or even cyberattacks. As part of the disaster recovery strategy, management should identify key business processes and activities to be maintained while IT systems and applications are unavailable and prioritize the order in which these systems are restored, which should be reflected in the business impact analysis. The FFIEC’s Business Continuity Management IT Examination Handbook states:

“Management should develop a coordinated strategy for the recovery of data centers, networks, servers, storage, service monitoring, user support, and related software… Disaster recovery should address guidelines for returning operations to a normalized state with minimum disruption.”

What CEOs Should Know about DR

 

Here are some important DR considerations for CEOs to consider to ensure their institution is taking an effective approach to disaster recovery:

  • Expect the Unexpected: A disaster can strike anytime and in a myriad of ways. Most people think of a disaster as being a situation created by an unexpected weather event, power outage, equipment failure, or cyberattack, but network downtime due to human error is also a common cause of disruption. The need for disaster recovery is a matter of when—not if. Therefore, CEOs should expect some type of disaster to affect their institution.
  • Be Proactive: Not having a sufficient disaster recovery plan in place can have major negative consequences: a loss of data, business functions, clients, and reputation—not to mention time and money. So, bank CEOs must ensure their management team is being preemptive about implementing effective disaster recovery strategies. These strategies should be reflected in the BIA, which can reveal gaps in critical processes that would hinder the institution’s disaster recovery and, in turn, business continuity.
  • Consider Outsourcing: More than one-third of small and medium-sized businesses do not have a plan in place for responding to data breaches and cyberattacks, according to the Ponemon Institute’s 2019 Global State of Cybersecurity in Small and Medium-Sized Businesses report. However, bank management can leverage external resources to expand their institution’s disaster recovery capabilities. Outside vendors can provide new technologies that reduce risk and enhance data backup, storage, and recovery. They offer a variety of cloud-based solutions that can make the DR process more streamlined, efficient, and cost-effective.

The 4Rs of DR Planning

 

For effective disaster recovery, there are four important “R’s” that institutions should focus on:

  1. Recovery time objective (RTO) – The longest acceptable length of time that a computer, system, network, or application can be down after a disaster happens. Shorter RTOs require more resources and ongoing expenses. When setting RTOs, prioritizations must be made based on the significance of the business function and budgetary constraints.
  2. Recovery point objective (RPO) – The amount of time between a disaster occurring and a financial institution’s most recent backup. If too long, and too much data is allowed to be lost, it could result in substantial damage. Essentially, the RPO will be determined by the institution’s technology solution and risk tolerance.
  3. Replication – An exact copy of an institution’s data to be available and remotely accessible when an adverse event happens. The best practice is to have one backup onsite and another offsite in a different geographic region—somewhere that is not likely to be affected by the same disaster.
  4. Recurring testing – A variety of tests and exercises to verify the ability to quickly resume core business applications during a disaster situation. Thorough testing of a financial institution’s core applications should be done annually — while they are functioning normally — to generate the most meaningful feedback.

Why a Cloud DR Service Is Important

 

Institutions must have viable DR measures in place, and a comprehensive, cloud-based service is a cost-effective way to accomplish this. With DR in the cloud, institutions are always able to access their data—no matter what type of disaster happens. In addition, a cloud DR service offers a team of third-party experts who are available to advise on DR processes, ensure ongoing backups and regular testing are done in the correct timeframes, and serve as an extension of the staff when a disaster strikes.

A comprehensive cloud DR service offers substantial redundancy, reliability, uptime, speed, and value. In addition, a cloud DR solution from an outside service provider can give institutions peace of mind from knowing their DR plan is being adequately tested and will work during a real disaster.

Our Solutions

 

Safe Systems offers a wide range of comprehensive services to help community banks and credit unions support their BCM and DR planning and other efforts. Whether it’s compliance services, such as BCP Blueprint, Vendor Management, or Information Security Program, or technology services, such as Managed Site Recovery, Managed Cloud Services, or CloudInsight, institutions can customize solutions to meet their specific needs and budget.

30 Nov 2022
Microsoft Azure Maintenance Basics
Banks, Credit Unions, Technology Eric Delgado 0 comment

Microsoft Azure Maintenance Basics

Microsoft Azure Maintenance Basics

Financial institutions need to stay on top of Microsoft Azure maintenance to efficiently use Microsoft cloud services and have effective controls across identity and access. Azure maintenance is also a matter of regulatory compliance.

Microsoft Azure maintenance encompasses Azure Active Directory, M365 (formerly called Office 365), Microsoft Exchange Online, and other associated Azure cloud services. Many institutions may not realize they are leveraging cloud solutions because it’s not always obvious where different technology services originate. Regardless of how an institution obtains Microsoft Exchange or M365, it creates a Microsoft tenant with Azure AD. Institutions are ultimately responsible for these tenants and this includes properly securing and maintaining them.

The Federal Financial Institutions Examination Council (FFIEC) expects institutions to engage in effective risk management for the “safe and sound” use of cloud computing services. The council indicated as much in its statement on “Security in a Cloud Computing Environment,” saying: “System vulnerabilities can arise due to the failure to properly configure security tools within cloud computing systems. Financial institutions can use their own tools, leverage those provided by cloud service providers, or use tools from industry organizations to securely configure systems, provision access, and log and monitor the financial institution’s systems and information assets residing in the cloud computing environment.”

In addition, financial institutions are obligated to oversee third-party service providers and make sure that they use proper security controls. “Management should be responsible for ensuring that such third parties use suitable information security controls when providing services to the institution,” the FFIEC IT Handbook’s Information Security booklet stated. “Management should verify that third-party service providers implement and maintain controls sufficient to appropriately mitigate risks.”

Azure Active Directory

Azure Active Directory (Azure AD, AAD) is the primary identity platform across all Azure services. There are some standard maintenance objectives that financial institutions should meet with Azure AD.

Some of the key types of identities to review within Azure AD are users, devices, and enterprise applications. User maintenance is an area many people are familiar with, and it involves ensuring the list of users matches expectations. IT administrators should be on the lookout for new accounts; they should look for users who should not be there and delete or disable them if appropriate. For example, users may need to be purged from the list after they complete off-boarding procedures.

With device maintenance, it is important to be aware of all the devices that the organization has placed into Azure AD. IT administrators should ensure that, at least for Windows OS devices, they follow the established naming convention. They should delete “stale” or inactive devices and ensure that all devices—whether desktop or mobile—adhere to established compliance policies.

The maintenance for enterprise applications—objects with some form of connectivity with your Azure tenant—involves making sure various service apps meet expectations for functionality. Administrators should review the apps’ properties to ensure the best controls are being applied. For instance, this could include addressing apps that have an expired certificate.

Other important maintenance areas within Azure AD include reviewing privilege role assignments to ensure their validity, scrutinizing delegated administration partners to confirm their level of access, and “right-sizing” the number and types of licenses to avoid being over or under-provisioned.

M365 and Exchange Administration

SharePoint Online, Exchange Online, and OneDrive are core components of M365 and as such, they require strategic maintenance. Here are some important areas IT admins should address to maintain these services:

  • Usage reporting— Monitor usage reports to ensure they match the institution’s expectations. Anomalies in consumption and storage could indicate a possible security or compliance concern.
  • Cleaning up files— Delete old, unused files from OneDrive or SharePoint. Administrators can solicit help from users by notifying those who are approaching their limits.
  • File retention policy— Automatically delete files based on a set schedule or duration, such as anything older than seven years.
  • Exchange Online mailbox usage— Notice mailbox statistics before users reach their limit to avoid service disruptions—and complaints.
  • Distribution list review— Make sure distribution lists contain the appropriate members for the most effective targeting.
  • Exchange Online mobile devices— Keep track of the details about users’ mobile devices to gain additional insights for achieving maintenance objectives and compliance.

For more information, listen to our “Azure Maintenance —The Basics Every IT Administrator Should Know” webinar.

09 Nov 2022
Best Practices for Ransomware Prevention and Recovery
Banks, Credit Unions, Security Kai Xu 0 comment

Best Practices for Ransomware Prevention and Recovery

Best Practices for Ransomware Prevention and Recovery

In the world of cybersecurity, an ounce of prevention is worth a pound of cure—especially when it comes to ransomware. Ransomware attacks hit a new target every 14 seconds, disrupting operations, stealing information, and exploiting businesses, according to the Cybersecurity and Infrastructure Security Agency (CISA). As a result of ransomware attacks, US Banks paid out nearly $1.2 billion in 2021, which is up by 188% from 2020 according to the Financial Trend Analysis report [PDF] on ransomware from the US Treasury’s Financial Crimes Enforcement Network (FinCEN). But banks and credit unions that consistently implement best practices can effectively prevent and recover from ransomware attacks.

Prevention Strategies

The ideal strategy is to keep ransomware assaults from happening in the first place, but prevention can be tedious and challenging. As a general practice, institutions should identify and address known security gaps that can enable a ransomware infection. (If there is a loophole, hackers will eventually find it.) Since human mistakes are the root cause of most security breaches, providing ransomware training for employees is a crucial step that institutions can take to reduce their cybersecurity risk. Ransomware awareness training can help staff identify, respond to, and circumvent attacks as well as test their knowledge in a safe environment. Institutions can also limit their security risk by adhering to the principle of “least access” to grant employees the minimum levels of access or permission needed for their job.

As another best practice, institutions can also take a stricter stance on the technical aspects of cybersecurity. They can employ intelligent network design and network segmentation to limit risk by restricting ransomware intrusions to a portion of the network instead of the whole system. Institutions should also have overlapping security solutions to provide layered protection for their systems and networks. Then if a single security element fails, another layer will be in place to compensate.

Response and Recovery Tactics

Even with multiple protective measures in place, there is only so much financial institutions can do to avert a ransomware attack. When a breach happens, the institution must respond immediately to mitigate the impact. This includes implementing pre-established processes for incident response, vendor management, business continuity, and other key areas. Bank management, for example, should have an incident response program to minimize damage to the institution and its customers, according to the Federal Financial Institutions Examination Council (FFIEC) IT Handbook’s Information Security booklet.

Having pre-defined procedures to declare and respond to an incident can be essential to effectively containing and recovering from a ransomware infection. While incident containment strategies can vary between different entities, they typically include the isolation of compromised systems or enhanced monitoring of intruder activities; search for additional compromised systems; collection and preservation of evidence; and communication with affected parties and often the primary regulator, information-sharing organizations, or law enforcement, according to the FFIEC.

In addition, restoration and follow-up strategies for incidents should address the:

  • elimination of the intruder’s means of access
  • restoration of systems, programs, and data to a “known good state” (using available offline or offsite backups)
  • the initiation of customer notification and assistance activities consistent with laws, regulations, and interagency guidance
  • monitoring to detect similar or further incidents

Another step in the recovery process might involve notifying an insurance carrier—if the institution has ransomware coverage. However, cyber insurance might not prove to be the ultimate remedy: A policy exclusion could keep the carrier from paying the claim. Or the settlement amount may not fully compensate for the institution’s intellectual property losses, revenue reduction, tarnished reputation, and other damages.

Augmenting Internal Resources

With the growing complexity of ransomware, it can be challenging for institutions to react to and recover from a cyberattack. However, those with limited internal resources can get help from a third-party cybersecurity expert to manage the process. Safe Systems, for instance, offers multi-layered security services that make it easier for community banks and credit unions to enhance their cybersecurity posture, so they can be better equipped to prevent, respond to, and recover from a ransomware attack. For more information about this critical topic, read our white paper on “The Changing Traits, Tactics, and Trends of Ransomware.”

27 Oct 2022
Social Engineering Scams - It Could Happen to You
Banks, Credit Unions, Security Jamie Davis 0 comment

Social Engineering Scams – It Could Happen to You!

Social Engineering Scams - It Could Happen to You

Many of us have heard the story about the fake printer repair person who shows up at the office to fix an issue with the intent to gain access to a secure area and collect confidential information. In reality, these things don’t really happen, right? At least not to small businesses or individuals…maybe this happened once to a large corporation and received a lot of press? This level of social engineering doesn’t really happen to someone like me, or does it?

Here’s What Happened to Me

My personal story involves a person visiting my house, a letter in the mail “from the government”, and a friend request on a popular social media platform from someone I knew 20 years ago. Each incident seemed innocent enough at the time, and on its own, did not raise any red flags. But as the events unfolded, I recognized a few mistakes that were made and realized that this was a coordinated effort and a scam!

It started with my doorbell ringing and my six-year-old yelling “Dad, someone’s at the door.” I answered the door to a well-dressed, very professional, middle-aged female with a smile and a government-issued badge around her neck. She promptly showed me the badge and explained she was there to ensure I had received a survey from the Department of Health and Human Services (DHHS). She explained it was important that I fill out the survey to provide the data needed for them to make decisions to properly serve their constituents.

I conduct many surveys at Safe Systems, so I empathized with her need for information and the effort it requires to get people to fill out surveys. I informed her that I had not received the survey she was inquiring about. She then handed me a sample copy of the survey and said that my actual form would have a randomly generated code to help them track when each family had filled out the survey. Even though the survey was anonymous, they used the code to track completion. When I stated again that I had not received the survey, she politely asked me to keep an eye out for it. She said she would check back next week to confirm I had received it. She complimented me on my house and walked away. Although I found the personal stop at my house odd, I didn’t notice any red flags at first. I simply thought this was similar to how they knock on doors for the census every 10 years.

Two days later, when checking the mail, I found a letter addressed to my wife and me. When I opened it, it included a survey that looked like the sample the lady had shown me a few days earlier, but this survey also had the randomly generated code that she told me about. I was still a little suspicious but planned on doing some research online to see if everything checked out.

A few days later, I received a friend invite on Facebook from someone I had not spoken to in 20 years. I’m not a big social media person but I do have a few accounts to keep up with different family affairs. Once I accepted the invite, this person started asking me about life and family. He didn’t ask anything personal, just general questions about how everyone is doing, jobs, etc. He seemed chattier than I remember him from 20 years ago, but we all change over time. I was cordial with my responses but not overly responsive. Over a few days, I got several short messages from him, then I get hit with this question, “have you filled out the DHHS survey?” He said he had seen my name on a list of people who had not completed it, and since he knew me, he thought he would reach out. RED FLAG!

The last I knew he didn’t work for the DHHS so how would he see my name on a DHHS survey list? And how could he be sure I was the same guy he knew 20 years ago living in a different town? Everyone who knows me, knows I go by my nickname. Very few people know my official birth certificate name, which is what was used on the DHHS survey. So, the odds of my name jumping off the page at him is unlikely. RED FLAG! I was curious about where this was going so, I continued the conversation, but guardedly. I admitted I had the survey but had not had a chance to fill it out yet.

Not wanting to let on that I was suspicious of him and the survey, I lied and said I would get around to it at some point. His response was the clincher for me that this was a scam. He said, “Great, just don’t want you to miss out on all the money I got from doing it.” Suddenly, there is money involved with filling out this survey which had not been mentioned anywhere. BIG RED FLAG! Also, it is very unlikely that someone filling out the survey would see a list of others who had received it, especially if it was supposed to be anonymous. RED FLAG!

I decided at this point, I wanted to know how far they would take this scam. I started chatting with him about some trip we went on years ago and how great it would be to do it again (but the truth was we never went on any trip). I never heard from him again, and his Facebook account was deleted and removed 2 days later.

It is important to discuss his Facebook page, as it not only had pictures of him and his family but also indicated that we had a single “mutual friend.” This was meant to convince me of his authenticity but should have also raised a RED FLAG considering how much overlap there was in the people we knew. Apparently, someone had stolen the pictures from his Facebook page and created a new account. I later recalled I was already friends with him on Facebook and compared his actual page to what I had seen on the fake account. They were identical if you just looked at the profile picture and the last post or two. There was almost no history on the fake account, but I had not paid attention to this RED FLAG at the time.

Social Engineering Can Happen to Anyone

In the grand scheme of things, I’m your average American stereotype. I live in a small neighborhood in suburbia with a minimal presence on the internet. Why would anyone have any interest in me? Yet, with no reason to target me, someone came to my house, mailed me a letter, set up a fake profile of someone I knew 20 years ago, and created an elaborate scheme to get me to fill out a survey that asked for personal information.

The moral of the story is if it can happen to me, it can happen to you, your family, and your business! Don’t assume these things only happen to others or large corporations. Social engineering schemes are very real, and they can work if you don’t have your guard up!

As we reach the end of Cybersecurity Awareness Month 2022, I thought this would be an appropriate story to share. As you can see from my story, social engineering can be very elaborate and can use means that are outside of the internet to deceive you into providing access to confidential or personal information and/or your computer systems. So, awareness is key. In the spirit of this month, I hope my story serves as a reminder to talk to your employees and customers about recognizing red flags and staying safe online.

25 Oct 2022
Tips from Cybersecurity Awareness Month 2022
Banks, Compliance, Credit Unions, Security, Technology Jamie Davis 0 comment

Tips from Cybersecurity Awareness Month 2022

Tips from Cybersecurity Awareness Month 2022

Cybersecurity Awareness Month 2022 is reminding individuals and organizations that there are a variety of ways to protect their data—and practicing the basics of cybersecurity can make a huge difference. This year’s campaign centers around an overarching theme that promotes self-empowerment: See Yourself in Cyber. The initiative’s co-leaders, the National Cybersecurity Alliance (NCA) and the Cybersecurity and Infrastructure Security Agency (CISA), are encouraging people to focus on four key behaviors:

  • Enabling multi-factor authentication (MFA) — Often called two-step verification, MFA is an effective security measure because it requires anyone logging into an account to verify their identity in multiple ways. Typically, it asks the individual to enter their username and password and then prove who they are through some other means, such as providing their fingerprint or responding to a text message.
  • Using strong passwords and a password manager — All passwords should be created so that they are long (consisting of at least 12 characters), complex (including a combination of upper case letters, lower case letters, numbers, and special characters), and unique. This approach should be implemented with all accounts. Because we do more online today, it is possible to have hundreds of passwords to manage. And, if your passwords are long, unique, and complex as they should be, it can be impossible to remember and track them all. Using a secure and encrypted password manager is not only safer than using a physical notebook or a notes app to store your passwords, but it can also provide benefits such as alerting you of potential compromises and auto-generating new hyper-strong passwords that are stored along with the others.

A quality password manager should encrypt all passwords, require multi-factor authentication on your password vault, and not store the keys needed to decrypt the main password that unlocks your vault.

  • Updating software — Updates resolve general software issues and provide new security patches where criminals might get in and cause problems. You should update software often, obtain the patch from a known trusted source, and make the updates automatic if available.
  • Recognizing and reporting phishing — With the right training, you and your employees can learn to identify phishing, a scheme where criminals use fake emails, social media posts, or direct messages to trick unwitting victims to click on a bad link or download a malicious attachment. The signs can be subtle, but once suspect a phishing scam, you should report it immediately, and the sender’s address should be blocked.

Cybersecurity Resources

Cybersecurity Awareness Month is dedicated to providing resources to help individuals and organizations stay safe online. Businesses that need additional resources to address their specific needs can partner with an external cybersecurity expert. For example, Safe Systems offers a wide variety of compliance, technology, and security solutions to help community banks and credit unions safeguard their data.

Some of our cybersecurity products and services include:

  • Cybersecurity RADAR™: A web-based application combined with a team of compliance experts to help you assess your cybersecurity risk and maturity, using the standards set by the FFIEC’s Cybersecurity Assessment Tool (CAT) or the NCUA’s Automated Cybersecurity Examination Tool (ACET).
  • Information Security Program: A solution that allows you to build a customized, interactive, and FFIEC-compliant Information Security Program, complete with notifications, reporting, collaboration, approval processes, and regulatory updates.
  • NetInsight®: A cyber risk reporting solution that runs independently of your existing network and security tools to provide “insight” into information technology and information security KPIs and controls.
  • Layered Security: Build a basic layered approach including a perimeter firewall with content filtering, email threat filters, an endpoint malware solution, and a robust patch management process, or add more sophisticated layers depending on your security needs.

In addition, we continue to provide access to trusted information related to technology trends, regulatory updates, and security best practices on our Resource Center. Our latest white paper focuses on the leading security risk to businesses today, ransomware. Download a copy of “The Changing Traits, Tactics, and Trends of Ransomware” to discover how to better position your institution to prevent and recover from a ransomware attack.

20 Oct 2022
Special Guest Speakers Share their Expertise on Key Banking Systems and Compliance Trends
Banks, Compliance, Credit Unions, Security, Technology Jamie Davis 0 comment

Special Guest Speakers Share their Expertise on Key Banking Systems and Compliance Trends

Special Guest Speakers Share their Expertise on Key Banking Systems and Compliance Trends

Our first Customer Success Summer Series offered live webinars with special guest speakers who shared their industry knowledge to help our customers and other financial institutions enhance internal processes and key areas of their banking operations.

The Evolution of Phone Systems

Today businesses are facing the acceleration of remote working—Voice over internet protocol (VoIP), Virtual Private Networks (VPN), virtual meetings, and dynamic routing of phone systems based on the user’s location—all have become must-have requirements. Legacy telephone services are becoming more obsolete as some telecoms decommission analog technologies in favor of fiber pots and other alternatives. The old telephone system is evolving into a more modern option: unified communications as a service (UCaaS), which merges communication channels into a single cloud-based system. UCaaS offers all the necessary infrastructure, applications, and resources businesses need in an easily scalable solution. Unified communications tools can include chat, VoIP, text messaging, and online video conferencing.

UCaaS gives institutions the benefit of advanced functionality which allows employees to work remotely more efficiently, including things like the ability to check other users’ availability, reach people whether they are in the office or out in the field, and access the platform from anywhere. Another evolving facet in telecommunications is call center as a service (CCaaS), which also streamlines omnichannel communication and allows remote employees to work together as a call center team.

Given its flexibility and efficiency, it is easy to see why UCaaS is moving to the forefront of communications. There is a wide range of unified communications features, equipment, and prices and it is important for your institution to clearly define its unique needs to find a solution that will satisfy its requirements. It is also important to continue to evaluate your equipment and services every few years as technology and pricing continue to change.

Watch the recording of this webinar to gain a better understanding of UCaaS and other options so you can make the right choice for your institution.

2 Guys and a Microphone

Matt and Tom have both spent most of their careers focused on risk and regulatory compliance for financial institutions. We recorded their recent conversation which spans many topics including increased scrutiny on vendor management, continued focus on ransomware, and more.

Recent audit and exam trends continue to have a strong focus on third parties and proper vendor management. Examiners are considering the preponderance of fintechs, how much the average financial institution is outsourcing, and the inherent risk that originates from third-party vendors. Interestingly, their increased scrutiny may extend to any significant sub-service vendors that institutions may have. In addition, we are seeing questions arise about vendor management in the context of insurance. Cyber liability insurance applications are requesting more details about the management of vendors and other third parties.

There have also been some interesting audit and exam findings. For instance, one institution was encouraged to complete a post-pandemic/walk-through test or “dry run” of their pandemic procedures. This is curious considering all institutions have been in a “live exercise” for the past few years with the pandemic. Regardless, there is a good chance that the pandemic verbiage in your disaster recovery plan needs to be updated based on what has or has not been done in response to the current pandemic. And it is important to consider that an annual pandemic test will be a part of examiner expectations going forward along with the traditional business continuity, natural disaster, and cyber incident tests.

On the regulatory front, the new Computer-Incident Notification Rule went into effect on April 1, 2022, which is designed to give regulators early awareness of emerging threats to banking organizations and the broader financial system, including potentially systemic cyber events. The rule has two components:

  • The first part requires a banking organization to promptly notify its primary federal regulator of any “computer-security incident” that rises to the level of a “notification incident.”
  • The second part requires a bank service provider to notify each affected banking organization customer as soon as possible when the bank service provider determines that it has experienced a “computer-security incident” that has caused, or is reasonably likely to cause, a material service disruption or degradation for four or more hours.

In March, we hosted an in-depth webinar on understanding the requirements, recognizing gray areas, and preparing for unknowns. To help intuitions meet these requirements, we also created a detailed flowchart to understand when an event is severe enough to activate your Incident Response Team (IRT) and when regulators and customers should be notified.

Another regulatory trend to keep your eyes on is the increasing focus on ransomware industry-wide is prompting some state banking organizations to require institutions to use the Ransomware Self-Assessment Tool (R-SAT). The 16-question R-SAT is designed to help institutions evaluate their general cybersecurity preparedness and reduce ransomware risks. The R-SAT supplements the Cybersecurity Assessment Tool developed by the Federal Financial Institutions Examination Council (FFIEC). It will be interesting to see if more states begin requiring this additional diagnostic tool.

Watch the recording to hear more insights about INTrex, SOC Reports, and SSAE 21.

08 Sep 2022
What to Budget for in 2023
Banks, Compliance, Credit Unions, Security, Technology Jamie Davis 0 comment

What to Budget for in 2023

What to Budget for in 2023

Marty McFly (the lead character in “Back to the Future”) could not have predicted the world we live in today. Though the movie’s portrayal of flying cars, floating hoverboards, and shoes that lace themselves may have been a little far-fetched, we now have IoT, the Internet of Things. This powerful networking capability connects everything in our lives to a single electronic device that can be held in the palm of our hands. I can open my garage door, adjust the temperature of my house, set my alarm system, and even check the status of the clothes in my dryer—all from my mobile phone. Predictions are always a synthesis of art, science—and uncertainty. None of us truly knows what tomorrow will bring. We just know it will look a little different than it did today. With that in mind, it’s almost budgeting season, so here are my predictions for the top areas your bank or credit union should consider budgeting for in 2023:

1. Compliance Services

Compliance continues to be a strong focus for many community financial institutions. It’s important to be able to evaluate all your policies and programs to see where you may need assistance before your next exam. If you aren’t sure if your policies and programs are keeping up with regulations, you may want to hire a third party to provide an objective perspective. Companies like Safe Systems will often conduct a review as a courtesy or for a nominal fee.

You should also consider investing in these two popular compliance services that have gained traction in recent years:

  • Virtual ISO: There are several service models available, so make sure you find the one that matches your institution’s needs. (Check out our recent webinar that walks you through the pros and cons of three virtual ISO models.) For instance, Safe Systems’ ISOversight service includes a dedicated compliance specialist, along with a suite of online compliance applications to help you develop and manage your vendors, business continuity plan, Cybersecurity Assessment Tool, and information security program.
  • Vendor Management: Your assessment of a vendor should define what controls are needed to effectively mitigate risks posed by each vendor. Some critical or high-risk vendors may require reviewing documents like contracts, financials, or SOC 2 audit reports. Evaluating these documents can feel daunting because it can be time-consuming and understanding each type of document can require a different skill set. Many institutions are offloading the document review process to third-party companies to help them identify the key information in each document and better manage risk.

2. Supply Chain Issues

The supply chain issues that started during the middle of the pandemic have continued through 2022. Servers, switches, firewalls, and other hardware devices are still in limited supply. For 2023, continue to plan and order hardware well in advance of your needs. If you wait until you need it, you may encounter delays. Six months is the current lead time for certain devices. Also, when replacing a workstation in 2023, evaluate whether a laptop or desktop computer would be the best replacement. While laptops introduce some new risks due to their mobility, they also allow flexibility for users. If a laptop will enable an employee to work remotely during a disaster or pandemic, it may be more beneficial to switch to this laptop to optimize your hardware investment.

3. Cloud Security

Cloud security should continue to be top of mind. Although the Cloud offers plenty of advantages, it comes with numerous control settings, management tools, and security options that must be effectively configured and maintained to ensure the highest level of protection. This should be a key area of concern for not only institutions with infrastructure in the Cloud, but also those with M365 licenses—which include Exchange Online, SharePoint, OneDrive—or those using Microsoft Azure Active Directory as an authentication platform through a third-party provider. Too often institutions only think about hosting servers in the Cloud when it comes to cloud security. While moving infrastructure to the Cloud is a current trend, almost all institutions store some information there. Safe Systems has worked with several institutions with assets ranging from $100 million to multi-billion dollars and found that almost all of them had gaps in their cloud security when it comes to their cloud tenants. Some institutions had their email or user accounts compromised while others had the wrong M365 security settings in place, which left the door open to future compromises. Safe Systems’ CloudInsight suite of products includes M365 Security and Utility Basics solutions to detect common risks and help institutions better manage the increasing array of M365 security settings and controls. These reasonably priced options deliver a substantial amount of value, so contact us for a quote to determine if our CloudInsight solution will fit into your budget next year.

4. Cybersecurity

Cybersecurity must stay top of mind for both your institution and its employees. If you do not have a solution to train and test your staff on information security best practices, consider investing in one next year. These are typically not expensive solutions, and they provide exceptional value—as well as critical protection. It is estimated that cyberattacks are 300 times more likely to be targeted against financial services firms than other companies. If that isn’t enough to keep you up at night, then consider that Cybersecurity Ventures expects global cybercrime costs to reach $10.5 trillion annually by 2025—and will be more profitable than the global trade of all major illegal drugs combined. Remember, where the money is, the crooks will follow. Every year you must evaluate your current security layers and decide if they are still effective and if you have enough of them in place.

“If it were measured as a country, then cybercrime—which is thought to have inflicted damages totaling $6 trillion USD globally in 2021—would be the world’s third-largest economy after the U.S. and China.”

Preparing for next year requires you to first evaluate where you are this year. You could decide to simply “rinse and repeat” what you did this year, but that would be a missed opportunity to really understand what is working, what isn’t, and what can be improved. Also, consider your institution’s short- and long-term plans. Sometimes what makes sense today doesn’t make sense when compared to your future plans for growth, increased redundancy, and more. While you can’t predict the future, you can at least ensure your 2023 budget reflects your best guess for where your institution is headed.

01 Sep 2022
Addressing the Growing Ransomware Problem
Banks, Credit Unions, Security Kai Xu 0 comment

Addressing the Growing Ransomware Problem

Addressing the Growing Ransomware Problem

Ransomware has become the leading cyber threat to businesses today—and it is growing at an alarming rate. Threat actors, who often work in groups, continue to evolve and create different ransomware strains. They rebrand themselves and resurface under new identities, making it difficult to curtail their criminal activities. Ransomware has continued its upward trend with an almost 13% rise—an increase as big as the last five years combined, according to the 2022 Verizon “2022 Data Breach Investigations Report.” And the FBI’s Internet Crime Complaint Center Annual Report stated recorded 3,729 ransomware complaints in 2021 with adjusted losses of more than $49.2 million.

The pervasive nature of the ransomware problem affects all types of companies, sectors, and industries worldwide. Approximately 37 percent of global organizations were targeted by a ransomware attack in 2021, based on the IDC’s “2021 Ransomware Study.” And in February 2022, the Cybersecurity and Infrastructure Security Agency (CISA) reported that fourteen of the 16 US critical infrastructure sectors had ransomware incidents.

The Impact

Ransomware is malicious software or malware that locks victims out of their computing devices or blocks access to files until they pay a ransom. More sophisticated versions can encrypt files and folders on attached drives and even networked computers, raising the stakes even higher. (In all cases, the FBI does not support paying a ransom in response to a ransomware attack.)

Typically, ransomware gets installed on a workstation using a social engineering technique such as phishing. It tricks people into clicking on a link or opening an attachment and disclosing their login information or even financial data. Regardless of the threat vector used, a ransomware infection can wreak havoc on victims, causing extensive business interruptions, legal expenses, and reputational damage. According to IBM’s Cost of a Data Breach 2022 report, the average cost of a ransomware breach, not including the ransom payment, declined slightly, from USD 4.62 million to USD 4.54 million. However, the frequency of ransomware breaches has increased — from 7.8% of breaches in the 2021 report to 11% in the 2022 study. In certain industries, an attack may be considered a data breach and involve even more negative consequences. For instance, financial institutions and other critical infrastructure agencies may be required to pay fines for an attack due to their failure to protect clients’ data.

Cybercriminals are shifting away from ransomware attacks that merely demand a payment to unlock the victim’s data or device. They are focusing on more multidimensional extortion methods to extract a larger reward. IBM Security’s 2022 “X-Force Threat Intelligence Index” report indicates that virtually all ransomware assaults today are “double extortion” attacks that demand a ransom to unlock data and prevent its theft. Some attackers opt to exfiltrate sensitive data, so they can present additional ransom demands in the future. They may also sell personal data—credit card numbers, email addresses, online credentials, or bank account information—to make the fraud even more lucrative.

Best Practices

Security is a complicated issue, which makes staying on top of threats and vulnerabilities challenging. Financial institutions must complete a myriad of time-consuming and complex tasks to maintain a strong security posture. Addressing ransomware can be particularly difficult for community banking institutions with limited internal technical expertise and resources. And there is only so much an institution can do to stay vigilant against ransomware threats.

However, institutions can reduce their risk by implementing some key security strategies such as:

  • Having a well-trained staff because most ransomware intrusions are caused by human error.
  • Having overlapping security products and or services to cover the protection of systems and networks.
  • Having well-designed network infrastructure with security in mind.
  • Having a proper incident response plan that can be adhered to in the event of a breach.

Using a Managed Service Provider

Financial institutions that put mitigating systems, processes, and practices in place will be better positioned to prevent, detect, and recover from a ransomware breach. However, many smaller institutions may lack the resources and knowledge in-house to close security gaps and circumvent attacks. They can remedy the situation by employing the products and services of a managed service provider to strengthen their security posture.

Safe Systems provides a wide range of layered security solutions to help institutions address the risk of ransomware. Our security offerings include behavior-based vulnerability monitoring, advanced endpoint protection, vulnerable systems patching, next-generation firewalls, email software security, and staff training. These products and services deliver essential overlapping protection, and they are specially designed to meet the needs of community banks and credit unions.

Also, stay tuned for our upcoming white paper that will provide more data on the current state of ransomware and how banking institutions can better minimize the risks of an attack.

05 Aug 2022
The Importance of Succession Planning
Banks, Compliance, Credit Unions The Safe Systems Compliance Team 0 comment

The Importance of Succession Planning to IT and Information Security Resiliency

The Importance of Succession Planning

Change can be challenging—especially when it involves the transition of IT management and other key personnel. That’s why it’s imperative for banks and credit unions to be proactive about succession planning.

While regulators expect institutions to have a formal succession plan for key leadership roles, having a strategy for filling critical positions is a matter of practicality. If an IT administrator or information security officer (ISO) is not in place, or not available to complete the tasks, reports, and other responsibilities of these roles, then it could lead to cyberattacks and other security issues. This, in turn, can have dire consequences on a financial institution’s operations, risk-profile compliance, and reputation.

Succession Planning Strategies

Institutions can ensure IT and information security resiliency by having an effective plan for managing the absence of key security-related personnel. Depending on their size, type, and goals, they can adopt any of these approaches to succession planning:

  • Proactively assess internal talent and then orient the most suitable individual to serve as an alternate or backup for various IT admin or ISO responsibilities. The ISO alternate, for instance, should train with the existing ISO, attend ISO oversight meetings, and present appropriate information to executive management and the board. If the ISO leaves, the backup individual should be equipped to assume the role temporarily or even for the long term if necessary. Training a staff member to perform IT or information security duties is not only pragmatic, but it complies with regulatory guidance.
  • Implement an internal committee or team approach to managing IT and information security during a temporary or permanent personnel change. The committee can facilitate the IT and information security program in several ways. It can maintain processes until an outside replacement is installed or support an internal successor who is transitioning into the position. The committee can also provide coaching to keep the replacement from becoming overwhelmed by the complexity and assortment of tasks required.
  • Partner with a trusted third party to obtain the additional expertise needed to meet IT and information security benchmarks. This approach provides an accountability partnership role and a regular framework that clearly defines key responsibilities and streamlines processes. This strategy can ensure institutions have suitable resources to ease the transition of key personnel to enhance IT and information security resiliency.

Leveraging a Virtual ISO

A virtual ISO can be an ideal solution for institutions seeking to enhance IT and information security resiliency. This third-party service can not only support succession planning, but it can also serve as an extension of the internal ISO providing an external layer of oversight and an objective point of view — which allows institutions to approach risk more strategically and proactively.

ISOversight from Safe Systems, for instance, is a complete solution that makes it easier for community banks and credit unions to master information security and compliance online. This virtual ISO solution—which is especially for financial institutions—offers valuable access to applications and resources, cyber risk reporting, and compliance experts. With ISOversight, banks and credit unions can be confident that all their ISO-related requirements are completed on time, documented properly, and reported to the appropriate parties. Learn more about how to enhance your institution’s security posture during tough times. Read our white paper on “Building IT and Information Security Resiliency in Chaotic Times.”

27 Jul 2022
Learn How to Eliminate Compliance Pain Points with COMPaaS
Banks, Compliance, Credit Unions Christine Ray 0 comment

Learn How to Eliminate Compliance Pain Points with COMPaaS

Learn How to Eliminate Compliance Pain Points with COMPaaS

Keeping compliance processes and information security up to date is crucial, especially with the ever-increasing risks and regulatory requirements that are facing financial institutions. Our compliance-as-a-service solution, COMPaaS, solves this problem. It offers community banks and credit unions an easy way to customize information technology and compliance services to match their institution’s needs.

What is COMPaaS?

COMPaaS is a collection of connected compliance applications combined with critical monitoring and reporting tools that institutions can customize to address their specific pain points. Regardless of type or size, any financial institution can use COMPaaS to build a unique package of services that are based on their specific compliance resources, expertise, and budget.

The full suite of services meets regulatory requirements in a range of areas from vendor and network management to cloud security, information technology, and business continuity management:

  • BCP Blueprint: An application that automates the building and maintenance of a business continuity plan.
  • CloudInsight M365 Security Basics: A reporting tool that provides visibility into security settings for Azure Active Directory and M365 tenants.
  • Cybersecurity RADAR: A user-friendly application to assess cybersecurity risk and maturity.
  • Information Security Program: A proven regulatory framework with applications that allow you to build a customized, interactive, and compliant infosec program.
  • Lookout: An event log monitoring solution that efficiently combs through daily logs and sends notifications for activities that need review.
  • NetInsight: A reporting tool that runs independently of existing network tools to provide third-party “insight” into IT controls.
  • Vendor Management: An application that tracks vendor risks, automates contract renewal reminders, and generates reports.
  • V-Scan: A security solution that scans a network, identifies vulnerabilities, and generates a comprehensive report.

How Does It Work?

The COMPaaS applications and services were built with our expert’s core knowledge and industry best practices to help your institution build a strong compliance foundation. Whether you choose one of the automated applications or a service that provides a dedicated compliance resource, COMPaaS can help you better manage your policies and procedures, implement effective controls, and fill in reporting gaps to meet examiner expectations. It is the ideal solution because it lets you select the exact products and services you need now and add more later as your requirements change. For example, if you are a smaller bank, you might begin with a vendor management application and then build from there to cover your cybersecurity risk and information security concerns.

Key Benefits

COMPaaS allows financial institutions to leverage the benefits of automation to streamline time-consuming processes related to regulatory requirements. It converts labor-intensive processes that often exist on paper into apps to create living documents that are more efficient and less likely to become outdated.

COMPaaS also uses technology to enforce verifiable controls and provide consumable reports so that institutions can implement the appropriate actions to maintain information security. This can make it easier to prove to a third party that critical issues are being addressed. In addition, all COMPaaS was designed with the regulatory needs of community banking institutions in mind. For example, the technology and security products cover the standards set by the Federal Financial Institutions Examination Council’s Cybersecurity Assessment Tool (CAT) or the National Credit Union Administration’s Automated Cybersecurity Examination Tool (ACET).

The COMPaaS Advantage

With COMPaaS, institutions have an effective way to target and eliminate their specific compliance and information technology weaknesses. They can save time by automating compliance tasks and save money by selecting only the options where they need help. Institutions also can expand COMPaaS’ services to support internal IT staff who may not be well-versed in a particular area or wearing multiple hats and juggling too many tasks. Or they can use COMPaaS to fill a void when an IT staff member takes a vacation, goes on leave, gets promoted, or retires. Whatever the situation, institutions can maintain continuity by having access to the same tools, reporting features, and experts through COMPaaS. And our solutions will grow with the institution, so it can implement various services at separate times based on its budget and needs.

14 Jul 2022
How to Always Be Prepared for a Cyberattack
Banks, Credit Unions, Security Safe Systems 0 comment

How to Always Be Prepared for a Cyberattack

How to Always Be Prepared for a Cyberattack

Cybersecurity attacks have been ramping up nationwide, and the FBI expects the trend to continue. Americans reported 847,376 complaints in 2021, a 7-percent increase from 2020, according to the FBI’s Internet Crime Complaint Center’s 2021 Internet Crime Report. Many of the complaints filed in 2021 involved ransomware, phishing, data breach, and business email compromise. Financial services is one of the critical infrastructure sectors that are most frequently targeted by ransomware attacks.

However, here are five best practices that if effectively implemented, managed, and monitored can ensure that your financial institution is always prepared for a cyberattack:

1. Authentication

Passwords have become more complicated to create, remember, and maintain. Twenty years ago, passwords consisted of a simple string of characters. Now they are more complex, requiring a combination of numbers, symbols, and upper- and lower-case letters. Increasingly, user management tools allow institutions to take advantage of robust authentication options like multifactor authentication (MFA). MFA adds extra elements and more security to the sign-on process, which is why users should employ it whenever possible to log in to any network or system at your institution. This is especially important for higher-risk situations that involve network administrator accounts, virtual private network access, and critical management applications.

MFA is one of the most important cybersecurity practices to reduce the risk of intrusions. Users who enable MFA are up to 99 percent less likely to have an account compromised, according to a joint advisory issued by the FBI and Cybersecurity and Infrastructure Security Agency. “Every organization should enforce MFA for all employees and customers, and every user should sign up for MFA when available,” the advisory states.

2. Patch Management

Patching can be a constant and tedious process as it requires keeping up with updates from numerous sources and applications. This can entail patching a plethora of Microsoft products, along with banking and lending applications, PDF readers, virtualization applications, database applications, ATM software, and more. Not patching a security hole in any of these could lead to a massive security breach with catastrophic implications for institutions. It’s imperative to maintain a list of all approved applications and monitoring software on the network as well as have an update policy and a clearly defined process for each application. Major breaches have happened because a single patch was missing on a single device. Patch management cannot be ignored or treated as an afterthought.

3. Email Security and End User Best Practices

Understanding email, specifically phishing techniques, is one of the most critical aspects of being prepared for a cyberattack. While financial institutions are frequently targeted by phishing attacks, following these best practices can help to prevent business email compromise:

  • Augment your email solution with effective scanning software. This can help identify SPAM and phishing emails before they reach employees.
  • Train employees to recognize phony phishing emails, so they can “think before they click.” These bogus emails can be difficult to spot unless you know what you are looking for; e.g., poor grammar and spelling, links that don’t match the domain, unsolicited attachments, etc.
  • Test employees to see how well they respond to a realistic phishing attempt. Invest in a program that lets you send fake phishing messages and track which employees fail the test, so you can offer additional training to those who need it.

4. Backups

Backups play a crucial role in file recovery, disaster recovery, and ransomware attacks. To successfully bounce back from a cyberattack, institutions need to have all backup scenarios sufficiently covered, including file-level backups, disaster recovery backups, Veeam backups (for virtual servers), and SQL/database backups. While most institutions use a combination of different backup solutions, the key objective is to back up files offline or in the cloud, so they are not connected to your network. Then if a ransomware attack strikes the network, your offline and cloud backups will not be affected.

5. Vendor Risk Management

Vendor management can have a dramatic impact on the overall success of your information security plan. If you outsource to a vendor with inadequate security protocols, their weakness essentially becomes your weakness. The first step in vendor risk management is to perform a risk assessment to evaluate your level of inherent risk. This must always be done first so that you can then identify and implement the proper controls. If the controls selected do not completely offset the risks identified, then alternate or compensating controls would need to be identified to achieve a level of residual risk that is within your risk appetite.

There’s no silver bullet when it comes to resisting a cyberattack but focusing on the five areas above can significantly increase your institution’s cyber resiliency. Safe Systems offers a range of technology, compliance, and security solutions that are exclusively designed for community banks and credit unions. Contact us to learn how we can help you implement these five and other best practices.

23 Jun 2022
Tips for the Latest Microsoft Windows 10 Feature Update
Banks, Credit Unions, Technology Tim Smith 0 comment

Tips for the Latest Microsoft Windows 10 Feature Update

Tips for the Latest Microsoft Windows 10 Feature Update

Microsoft recently released the latest feature update for Windows 10, and financial institutions should upgrade the operating system as soon as possible. Installing the new update—Windows 10, version 21H2—sooner than later will give institutions access to important benefits, with a key advantage being enhanced security. The update will enable them to keep receiving security patches against malware and other vulnerabilities, so they can continue operating with the same level of safety and convenience. In addition, upgrading now will enable institutions to extract more longevity and functionality from the system, which will save them money in the long run. Implementing the current update will also keep them ahead of the curve and better prepared to meet the Windows 10 end-of-life date: Oct. 14, 2025.

Safe Systems Makes the Process Easy

Safe Systems can complete the upgrade for their network management, NetComply® One, customers using a proprietary solution designed by in-house technology experts. This advanced, automated method lessens the time and effort involved with installing version 21H2. We typically make one download per location instead of going from machine to machine—which can each take several hours to update. We can also employ file sourcing to reduce the amount of bandwidth consumed during the update. These streamlined tactics significantly minimize downtime, which can have a major impact on daily operations, personnel productivity, and other network utilization issues. If a machine has a problem with our automated process, customers will receive an email from Safe Systems notifying them that several failed attempts have occurred. At that point, they can decide whether to upgrade the machine themselves or submit a ticket requesting us to remediate the issue.

In addition, customers can run reports to gain insights, enhance decision-making, and optimize the upgrade process. For instance, they can:

  • identify which version of Windows 10 is currently running on their machines;
  • review results from the previous upgrade;
  • determine time of the next attempted upgrade;
  • detect which machines are excluded from upgrades; and
  • confirm that machines scheduled for the update are turned on and online.

By leveraging our network management solution and custom technology for feature upgrades, guesswork and human intervention are removed from the update process. This not only leaves financial institutions with more time to focus on other important issues, but it results in a more successful upgrade project. So, our customers get the best of two worlds: an efficient, computerized upgrade and support from technology experts.

A Specialized Network Management Solution

Completing Windows 10 21H2 updates for our customers means they will have one less thing to worry about. This supports our ultimate objective—to give financial institutions of all sizes a cost-effective way to leverage the best technology, compliance, and security solutions to serve the financial needs of their community. Our network monitoring and management platform, NetComply One, is designed exclusively for community banks and credit unions and provides them with a unique blend of services: automated ticketing, patch management, qualified alerting, custom reports, and quarterly advisement—all from an industry leader with more than 25 years of banking and IT experience.

So why run the security risk of not installing the new Windows update now when we’re making the process easy? Contact us today for questions about the upgrade or more information about NetComply One.

16 Jun 2022
Choosing a Virtual ISO (VISO)
Banks, Compliance, Credit Unions The Safe Systems Compliance Team 0 comment

Choosing a Virtual ISO (VISO)

The ISO’s role is becoming increasingly more complex and challenging due to growing cyber security threats, the ever-changing technology environment, and expanding regulatory expectations. It can be difficult for banks and credit unions to stay on top of information security issues. That’s why today even the smallest institutions often engage a trusted third party for help. A virtual information security officer (VISO) service can help institutions effectively manage information security so that nothing gets missed or falls through the cracks.

Common Types of VISO

The most common types of virtual ISO solutions available to institutions are the “do-it-yourself” (DIY), “hybrid,” and “offload” models. The DIY option is designed for institutions that have a solid grasp of the ISO’s job functions and just need some basic tools and limited consultation to enhance their efforts. This model is the least expensive but also requires more of a time commitment from your internal resources. The hybrid model may typically include an assortment of apps, templates, pre-configured reports, and other tools, along with a broader and deeper level of consultation. Resource requirements from the institution side are greatly reduced compared to DIY, but typically greater than offload. Accordingly, costs for a hybrid approach are somewhere between the two other models. The hybrid model also tends to be the most flexible and is designed to evolve with the changing needs of the institution. Finally, the offload approach attempts to provide a “turn-key” solution wherein the virtual ISO partner effectively assumes most or all the responsibilities of your internal ISO. This approach requires the least involvement from your institution (which could introduce other challenges…see the “Examiner Support” section below), but it is usually also the most expensive. As this model is the most inclusive, the knowledge and experience of the third-party provider are your most important consideration. The offload approach typically includes unlimited consultation, on-demand reporting, participation in committee meetings, etc.

Key Factors to Consider

When choosing a virtual ISO, there are some important aspects to consider to ensure your institution selects the best option. Keep in mind that each virtual ISO model comes with a certain level of flexibility and engagement for a specific price. The key is to carefully balance the service and costs against your specific internal resource gaps to determine the best solution for your situation. Ideally, whatever solution you choose should have the flexibility to dial up or down the level of service, depending on how your situation may change in the future.

Whatever virtual ISO solution you opt for, it should provide documentation and reporting in a form that the various stakeholders can understand. Each one of the many ISO responsibilities has one or more reports or documents that support the requirement to hold the ISO accountable for its responsibilities. The board of directors, the steering committee, the IT auditors, and examiners, all have different perspectives and comprehension levels and may require different degrees of detail for the same information. For instance, boards and examiners might require higher-level data, whereas steering committees and IT auditors might require more detailed documentation for their purposes. You should have access to on-demand reporting with relevant, actionable, up-to-date information that matches the level of engagement for the various stakeholder groups.

The regulatory guidance on ISO responsibilities includes terms such as “engaging with” and “working with” management in the individual lines of business to understand the risks of various initiatives. They also expect the ISO to “implement” the information security strategy as defined by the board, and to periodically “inform” the board and senior management on the status of the program. In the case of a virtual ISO, your hybrid or offload third-party partner needs to have an excellent understanding of enterprise-wide strategic objectives, and a good working relationship with management in all lines of business and within the different departments within your organization.

Remember, as with all outsourced activities, even though you can delegate some (or even most) of the heavy lifting to a virtual ISO, you cannot outsource responsibility. Your institution still must maintain a strong oversight effort to ensure that all ISO duties are completed, documented, and reported appropriately. Higher levels of third-party reliance require correspondingly higher levels of oversight. According to the Federal Financial Institutions Examination Council’s Outsourcing Technology Services booklet you are obligated to oversee all activities, whether you perform them, or a third-party performs them on your behalf.

Examiner Support

The examiner feedback we have seen to date strongly supports the idea of financial institutions implementing a virtual ISO solution “…as long as it’s done correctly.” That means focusing on all the responsibilities and accountabilities of the role and making sure sufficient documentation and appropriate oversight and reporting are built-in. Doing it correctly also means making sure the in-house ISO is not so detached from the processes and procedures that they cannot authoritatively explain them to a stakeholder, which can be the primary downside of the “offload” model. The decision-making process is the most important concern for regulators. Your solution should allow you to offload enough to make the ISO’s job easier and more organized, but not so much that they become disconnected and lose operational awareness of their current threat and control environment.

In conclusion, choosing the right type of virtual ISO service allows institutions to provide the appropriate level of insight and oversight for their in-house ISO. This can help them to be better equipped to manage information security activities, meet evolving industry standards, and adjust to tightening regulatory requirements, all in an increasing cyber threat environment.

At Safe Systems, we offer a virtual ISO service based on the above-described hybrid model. ISOversight™, is a VISO service that is flexible to accommodate the changing needs of community banks and credit unions. The ISOversight service includes a full suite of applications to manage everything from vendors to business continuity, along with all associated information security policies and risk assessments. This is a cost-effective, comprehensive, and flexible solution that makes information security management much more efficient. For more insight about the most common virtual ISO models and how to determine which one may be right for you, view our webinar on “Is a Virtual ISO Right for You?”

09 Jun 2022
Planning for Safety, Soundness, and Resiliency
Banks, Compliance, Credit Unions The Safe Systems Compliance Team 0 comment

Planning for Safety, Soundness, and Resiliency

Planning for Safety, Soundness, and Resiliency

With the rise in cybercrimes and increased regulatory scrutiny, having a board-approved IT Strategic Plan is often not enough to ensure cyber resiliency. It’s essential for financial institutions to develop a robust IT management and information security infrastructure. The following excerpts from our recent white paper on “Building IT and Information Security Resiliency in Chaotic Times,” show how institutions can strengthen and support these key management roles to make better technology and security decisions, improve visibility, and reduce vulnerability. In addition, institutions can use strategic partners and risk management solutions to bolster resources they already have in place and enhance their overall cyber resilience.

1. Separating ISO Duties

Examiners have a strong interest in the IT administrator and ISO roles, which are interconnected and integral to an institution’s safety and soundness. However, many community banks and credit units still struggle with meeting the FFIEC requirements for segregating these positions. The importance of separating ISO duties relates to creating additional oversight to verify activities and maintain accountability to management and the board. Separating these functions also helps to build a clear audit trail to ensure risk is being accurately assessed and reported to senior management. While the ISO functions in an oversight capacity of the IT administrator, the ISO also relies heavily on the administrator to share data that can be used to recommend steps to improve the institution’s security posture. Therefore, the IT admin-ISO relationship must also be cooperative to ensure their daily activities support the organization’s policies and procedures.

2. Being Proactive about Succession Planning

Regulators expect financial institutions to have a formal succession plan for the ISO, IT administrator, and other key leadership roles, as indicated by the uptick in exam findings related to this issue. Depending on their size, type, and goals, institutions may employ different approaches for succession planning. They can identify and train someone to serve as an alternate or “backup” for various IT or ISO responsibilities, incorporate an internal committee or team approach for managing IT and information security, or use the support of a trusted third party to maintain IT and information security standards.

3. Partnering with a Trusted Third Party

An outside expert can provide an objective perspective that can help institutions think beyond the day-to-day issues and consider risk more proactively and strategically. Bringing in a technology partner on the front end—when things are going well—can also position institutions to be stronger and more successful in the future. For instance, a virtual information security officer (VISO) can expand an internal ISO’s capabilities and increase the likelihood that all ISO-related tasks are completed in a timely and efficient manner. A VISO can also provide an external layer of oversight to enable the required separation of duties.

ISOversight®, our virtual ISO service, makes it easier for financial institutions to master information security and manage compliance online. ISOversight is a comprehensive solution with a full suite of applications and resources, cyber risk reporting, and dedicated compliance specialists. It’s uniquely designed to help banking institutions enhance their strategies to improve IT management, information security, and compliance. With ISOversight, community banks and credit unions can ensure that no information security issues fall through the cracks—especially during challenging times.

For more information about how to enhance your institution’s security posture, read the full white paper on “Building IT and Information Security Resiliency in Chaotic Times.”

26 May 2022
Community Banks Use CloudInsight M365 Security Basics to Increase Security
Banks, Compliance, Credit Unions Christine Ray 0 comment

Community Banks Use CloudInsight™ M365 Security Basics to Increase Security

Community Banks Use CloudInsight M365 Security Basics to Increase Security

To meet the challenges of escalating cyber threats and constantly evolving technology, organizations must have appropriate security measures in place to protect their network, data, and other assets. Financial institutions that use Microsoft Azure Directory and M365 can capitalize on CloudInsight™ M365 Security Basics to ensure they have the right security, identity, and compliance settings to keep their information safe in the Cloud. The product fills a critical need because Microsoft is always enabling and disabling features in Azure AD and M365, which can make it difficult for institutions to maintain the best security settings.

M365 Security Basics increases the visibility of potential security risks through three main services:

  • Reporting — The delivery of user-friendly Microsoft data
  • Alerting — Notifications of common indicators of compromise
  • Quarterly Reviews — Expert analysis and consultations

Here are two case study summaries to show how different institutions are using CloudInsight M365 Security Basics to gain better visibility into their cloud security and Microsoft settings:

Affinity Bank

Atlanta-based Affinity Bank wanted to get a better handle on potential security threats—particularly those relating to email. It implemented CloudInsight M365 Security Basics to prevent compromised user accounts, unknown users and forwarders, unapproved email access, and other risks. “Being able to receive alerts when attempted logins from outside of the country come through is a big reason why we were interested in the product,” said Senior Vice President and Chief Operations Robert Vickers. Just having the ability to put in preventative features blocking employees from sending or setting up a forward to an external email address was another plus for Affinity Bank. With almost $800 million in assets, three locations across Georgia, and a long-term relationship with Safe Systems, Affinity Bank anticipates significant improvement in its cloud security and overall security posture thanks to M365 Security Basics’ monitoring, alerting, and other tools. Aside from the tools that M365 Security Basics provides for Affinity Bank, the real advantage given to the bank is the relationship with Safe Systems. “The team at Safe Systems has been able to provide us with great expertise on exactly where we need to go, what we need to do, and best practices to get us there,” said Vickers. “Almost immediately after we signed on for CloudInsight, they gave us recommendations we could implement straight away.” Read more.

Franklin Bank & Trust Company

Since its inception in 1958, Franklin Bank & Trust Company has prioritized adapting to constant changes in technology to maintain its security. M365 Security Basics proved to be the ideal solution for the Franklin, Kentucky-based community bank, which has $700 million in assets and five branches across the state. Since implementing CloudInsight M365 Security Basics, the bank achieved improved efficiencies in its cloud security and settings. After the initial meeting with the new service, reports came back with deficiencies that the bank didn’t even know it had and that could expose them to potential data breaches and threats. They were able to tighten up privacy settings, including the bank’s Microsoft OneDrive, and impose conditional access policies to ensure data was protected. “Adding CloudInsight M365 Security Basics to our roster has really shone a light on our whole Microsoft cloud footprint. It has shown us which areas we need to shore up and, in turn, has made our bank more efficient and secure,” said IT Project Manager Aaron Miller. Read more.

Learn More

CloudInsight M365 Security Basics is a flexible, cost-effective solution that institutions can incorporate based on their specific priorities and requirements. While Affinity Bank used M365 Security Basics to primarily address email management, Franklin Bank & Trust Company wanted to gain better overall visibility into Microsoft security settings. In both cases, M365 Security Basics fit the bill. Depending on their license, financial institutions can use M365 Security Basics to customize a wide array of security settings in Azure AD, M365, and Exchange Online. This includes OneDrive and SharePoint Sharing; Teams and External Collaboration; and the Protection, Security, Compliance, and M365 Admin centers. Institutions can further enhance cloud security by adjusting the settings associated with Azure AD Premium P1, Intune, and Azure Information Protection. They can also apply conditional access policies, password protection, and a myriad of other security features.

For more information about how your institution can optimize Microsoft security settings to improve cloud security, download our white paper on “Azure and M365 Security Basics.”

22 Apr 2022
More Microsoft Azure and 365 Security Basics
Banks, Credit Unions, Technology Marshall Jones 0 comment

More Microsoft Azure and 365 Security Basics

More Microsoft Azure and 365 Security Basics

Banks and credit unions today face an ever-increasing number of cloud security hazards. Here’s the good news: Financial institutions that use Microsoft Active Directory (Azure AD) and Microsoft 365 can lower their risk by modifying their security settings for these services. Not only can this help the financial institution minimize threats, but it can allow them to customize the features of Azure AD and Microsoft 365 (previously called Office 365) to their specific preferences and requirements.

Organizations are responsible for managing Azure AD and its security settings because when they purchased M365 licenses, they established a Microsoft tenant with Azure AD. From a compliance perspective, adjusting Azure AD’s settings is crucial since Microsoft automatically enables certain features that may violate or conflict with compliance policies for organizations in regulated industries.

Optimizing /M365 and Exchange Online Settings

Depending on your institution’s licenses, there is a wide range of security and compliance settings you can customize in Azure AD, M365, and Exchange Online such as:

  • OneDrive and SharePoint Sharing: Review the default level of sharing to control the flow of data based on what is appropriate for your institution.
  • Teams and External Collaboration: Review the platform’s default security and compliance settings, and if they are not sufficient, you can block all external domains to keep users from communicating externally.
  • Exchange Online: Control access, how emails are transmitted, the types of messages users can send to recipients in external domains, and the devices or apps that can connect.
  • Protection Center: Use the Basic Mobility and Security feature to manage and secure the mobile devices that are connected to your Microsoft 365 organization.
  • Security Center: Optimize email management by employing anti-spam policies for inbound emails, blocking automatic forwarding of outbound emails, using phishing simulations, quarantining potentially harmful messages, and blocking messages from fake senders.
  • Compliance Center: Implement a retention policy to manage the data by proactively choosing how to retain or delete content.
  • M365 Admin Center: Use modern authentication‎ in ‎Exchange Online‎ to enhance your institution’s security with features like conditional access and multifactor authentication. (Microsoft‎ strongly recommends turning off basic authentication for your organization.)

More Ways to Boost Security

You can further enhance cloud security by modifying the settings related to Azure AD Premium P1, Intune, and Azure Information Protection (AIP) licenses. With Azure AD Premium P1, for instance, you can include your institution’s logo, color scheme, and other branding elements on your Azure AD sign-in pages. You can also employ the hybrid Azure AD joined devices, conditional access policies, and password protection features. Microsoft Intune integration lets you configure policies to control how your institution’s devices and applications are used, including smartphones, tablets, and laptops. And AIP allows you to use deep content analysis to minimize data loss and enhance the labeling capabilities of Microsoft 365 to protect documents and emails.

M365 Security Basics Can Help

There are countless security settings that can be adjusted in Azure AD and /M365, and Microsoft is always introducing new features. This can make it difficult for institutions to ensure they have the most appropriate security, identity, and compliance settings—but our CloudInsight™ M365 Security Basics solution can make the process easier. M365 Security Basics is a collection of services designed to give community banks and credit unions a cost-effective way to manage their M365 settings. It offers reporting, the delivery of Microsoft data in a user-friendly format; alerting, notifications of the most common indicators of compromise; and quarterly reviews, expert analysis of M365 Security Basics reports, and explanations of the risk visible on the report and ways those risks may be mitigated.

To learn more about how to customize your institution’s Azure AD and M365 settings to bolster cloud security, access our “Microsoft Azure and M365 Security Basics” white paper.

30 Mar 2022
Get Prepared for the New Computer-Security Incident Notification Rule
Banks, Compliance, Credit Unions The Safe Systems Compliance Team 0 comment

Get Prepared for the New Computer-Security Incident Notification Rule

Get Prepared for the New Computer-Security Incident Notification Rule

As of April 1st, financial institutions are expected to comply with new cyber incident notification requirements for banking organizations and their third-party service providers. The Computer-Incident Notification Rule, as it’s officially called, is designed to give regulators early awareness of emerging threats to banking organizations and the broader financial system, including potentially systemic cyber events. The final rule—approved last November by the Federal Deposit Insurance Corporation (FDIC), Federal Reserve, and Office of the Comptroller of the Currency (OCC)—takes effect on April 1, 2022, with full compliance extended to May 1, 2022. (To date, the NCUA has not adopted the new rule, although it’s possible they may at some point. Credit Unions should check with their regulator for notification expectation specifics.)

Understanding the Regulations

To meet the upcoming deadline, financial institutions need to be well versed in the intricacies of the new rule. The rule has two components:

  1. The first part requires a banking organization to promptly notify its primary federal regulator of any “computer-security incident” that rises to the level of a “notification incident.”
  2. The second part requires a bank service provider to notify each affected banking organization customer as soon as possible when the bank service provider determines that it has experienced a “computer-security incident” that has caused, or is reasonably likely to cause, a material service disruption or degradation for four or more hours.

Focusing on the financial institution expectations under the final rule, a couple of definitions must be understood.

  • A “computer-security incident” could include almost anything: a hardware or software failure, an innocent mistake by an employee, or a malicious act by a cybercriminal. However, the incident must result in actual or potential harm to the confidentiality, integrity, or availability of an information system or the information the system processes, stores, or transmits.
  • A “notification incident” is defined as a significant computer-security incident that has materially disrupted or degraded a banking organization in at least one of these areas:
  • its ability to carry out banking operations, activities, or processes, or deliver banking products and services to a material portion of its customer base in the ordinary course of business
  • its business line(s), including associated operations, services, functions, and support that, upon failure would result in a material loss of revenue, profit, or franchise value
  • its operations, including associated services, functions, and support, as applicable, the failure or discontinuance of which would pose a threat to the financial stability of the United States.

In the event an incident rises to the level of a “notification incident,” the banking organization’s primary federal regulator must receive this notification as soon as possible, and no later than 36 hours after the banking organization determines that a notification incident has happened.

Recognizing the Gray Areas

The words “material” and “materially” are key terms; so much so that they are used 97 times in the 79-page guidance about the ruling. But beyond an “enterprise-wide” impact, the regulation does not precisely define these concepts, so financial institutions will need to specify what this term means to their organization as a whole. And since a determination of materiality is a prerequisite to starting the 36-hour “clock” for notification, they should do so ahead of time. The undefined nature of “material” to each organization creates a gray area open for interpretation that not only allows institutions some flexibility in this area but also opens the door for differences in opinion between an institution and its regulator.

In another gray area, the rule does not impose any specific recordkeeping requirements, which is a reduced burden. However, we strongly recommend keeping at least basic documentation in case the examiners ever question why your institution did or did not decide to escalate an event from a computer-security incident to a notification incident, and why it started the “clock” when it did.

Preparing for the Unknowns

At this stage, there are some unknowns about the implications of the new cyber incident notification requirements. One of the unknowns discussed in our recent webinar was related to an official contact person and method for each primary federal regulator. This has since been addressed and we recommend incorporating the following verbiage into the regulator notification section of your Incident Response Plan:

FDIC institutions:

  • Notification can be made to the case manager (primary contact for all supervisory-related matters), to any member of an FDIC examination team if the event occurs during an examination, or if the primary contact is unavailable, the FDIC may be notified by email at: incident@fdic.gov.

OCC Institutions:

  • Notification may be done by emailing or calling the OCC supervisory office. Communication may also be made via the BankNet website, or by contacting the BankNet Help Desk via email (BankNet@occ.treas.gov) or phone (800) 641-5925.

Federal Reserve Institutions:

  • Notification may be made by communicating with any of the Federal Reserve supervisory contacts or the central point of contact at the Board either by email to incident@frb.gov or by telephone to (866) 364-0096.

Another unknown as of the date of this post: Will the State banking regulators also require notification if a federal regulator is notified? The unofficial initial indication we have received is ‘Yes,’ but it would be good practice for institutions to check with their state regulator. Chances are regulators will request this, but whether or not it will be a requirement is still unknown.

Steps to Take Now

There are additional steps financial institutions can take now to be better prepared to address the requirements of the computer-Security Incident Notification Rule.

  • Our primary recommendation is for institutions to expand the notification section of their incident response plan to include the criteria for determination of a notification incident, and to add the regulator contact information above.
  • Institutions should also define “materially” for their organization and predetermine the meaning of “materially disrupted or degraded,” or what constitutes a “material portion” of their customer base.
  • Third-party contracts should contain verbiage obligating them to notify your institution under certain circumstances as required by the new rule. We also strongly advise designating an official contact person within your institution — whether it’s the CEO, CIO, or ISO — who should receive incident notifications from your third parties. It’s also prudent to specify a backup contact person—and make sure vendors know who the primary and alternate contacts are to ensure a smooth notification process.

For more information about this important topic, access our webinar on “New Cyber Incident Notification rules: How to Get Prepared”, or this recent blog post from Compliance Guru.

09 Mar 2022
Microsoft Azure and 365 Security Basics Continued
Banks, Credit Unions, Technology Eric Delgado 0 comment

Microsoft Azure and 365 Security Basics Continued

Microsoft Azure and 365 Security Basics Continued

When your institution acquired Microsoft 365 (also known as M365 and formerly called Office 365), it automatically created a Microsoft tenant with Azure AD. Since that tenant belongs to your organization, you are responsible for managing Azure AD and its security settings. Microsoft Azure services enable various default features that could be incompatible with the security, identity, and compliance requirements of your institution. it’s essential to customize the settings in Azure AD, M365, and Exchange Online (or Azure AD Premium P1, Intune, and Azure Information Protection) to fit your organization’s needs.

Customizing Azure AD Defaults

  • Security Defaults — Turn on security defaults to make it easier for your institution to thwart cyberattacks by using preconfigured security settings. (If your tenant was created on or after October 22, 2019, security defaults may already be enabled in your tenant.)
  • Password Policy — Configure the password policy applied to every user account that is created and managed directly in Azure AD. (Institutions with on-premises AD password policies governing password expirations should expect to manually synchronize their Azure AD password policy and their on-premises AD password policy.)
  • Azure AD Device Registration — Prevent users from joining devices on their own and require multi-factor authentication (MFA) to register or join devices with Azure AD.
  • Enterprise and Registered Apps — Keep non-administrator users from arbitrarily adding enterprise or registered applications, which can significantly increase risk. Afterwards, make sure to review every enterprise and registered application.
  • External Collaboration — Restrict regular users from inviting guests for collaboration and keep guest users from signing into your apps and services with their own work, school, or social identities.
  • Hybrid Identity with Password Hash Synchronization — Employ a hybrid identity architecture to synchronize users from on-premises Active Directory to Azure AD to minimize the number of identities users have across various platforms.
  • Azure AD Administration Portal — Limit regular users’ ability to read data in the Azure AD Administration Portal.
  • Administrator Review — Grant administrators only the specific permission they need to do their job and limit the number of static Global Administrator role assignments to fewer than five people.
  • Partners – When working with Microsoft-certified solution providers (partners) to purchase and manage solutions for your institution, they could be granted Global/Helpdesk admin roles giving them delegated administrative capabilities to your Azure instance. Make sure to review all partners and their delegated rights regularly.

Altering M365 and Exchange Online Settings

In M365, you can customize a variety of settings. In OneDrive, SharePoint Online, and Teams, look at configuring external collaboration capabilities of users. For Exchange Online, there are many settings to review but one to start with is the current forwarding capabilities and settings for users both globally and per-user. Modifying or reviewing these settings is highly advisable since they are inherently designed to facilitate interaction and external collaboration. In addition, you can use the Protection Center to secure mobile devices that are connected to your Microsoft 365 organization; the Security Center to refine email management; the Compliance Center to implement an effective data retention policy; and the M365 Admin Center to enhance security with modern authentication, which encompasses MFA. (According to Microsoft, 99.9 percent of account compromises can be blocked with MFA.)

And with the proper license, you can further enhance cloud security by optimizing the settings for Azure AD Premium P1, Intune, and Azure Information Protection.

M365 Security Basics Solution

Once your institution has sufficient settings in place to support your policies, it is essential to monitor for exceptions with reporting and alerting features such as those provided with Safe Systems CloudInsight™ M365 Security Basics solution. Financial institutions that partner with Safe Systems can gain critical visibility into their security settings helping them successfully navigate the complexities of optimizing M365’s features..

For more information about how your institution can optimize Azure AD and O365/M365 settings to improve cloud security, download our white paper on “Azure and M365 Security Basics.”

Important Disclaimer

The security settings that are discussed in this paper can have a dramatic impact on end-users and/or service functionality and should only be employed if deemed appropriate and after careful consideration. There are a variety of security options available, but organizations should strive to implement these technology services strategically and, ideally, through planned phases of objectives over potentially several months or even years. The recommendations, statements, and other concepts contained within this paper are provided primarily for the consideration of IT Administrators of financial institutions.

01 Mar 2022
Managing Security, Identity, and Compliance within the Microsoft Azure and M365 Ecosystem
Banks, Credit Unions, Technology Eric Delgado 0 comment

Managing Security, Identity, and Compliance within the Microsoft Azure and M365 Ecosystem

Managing Security, Identity, and Compliance within the Microsoft Azure and M365 Ecosystem

It can be challenging for financial institutions to manage security, identity, and compliance within Microsoft Azure Active Directory (Azure AD) and Microsoft 365 (also known as M365 and formerly branded as O365). Understanding the services and settings of the Azure AD and M365 ecosystem can make the process easier for IT administrators.

Some of the basic security settings that apply to most organizations fall under the free license level for Azure AD. These are also some of the low-hanging fruit that institutions can easily implement to make a dramatic difference in their security.

Security Defaults

One of the settings that can have the biggest impact is security defaults, which can be enabled to enforce a set of non-configurable conditional access policies. The policy set in Azure includes the ability to require multifactor authentication (MFA) and MFA registration for all users. It also offers the capability to block legacy authentication, which should be a high-priority goal for any organization.

Hackers can exploit basic authentication to effectively bypass MFA, which is a fundamental security service we recommend that every institution implement. If your institution has gone through the effort of enforcing MFA for users—but you’re not blocking basic authentication explicitly—there’s a major security gap. That gap should be addressed immediately, especially given Microsoft’s plans to decommission basic authentication protocols in Exchange Online in October 2022.

Identity Considerations

It’s also crucial to review the identity architecture for your financial institution. Any user, device, or app connecting to Azure should have an identity, whether it’s a guest user, mobile device, Mac OS device, or a Windows computer, so it can be assigned data access rights or even take on administrative capabilities. Every identity outside of Active Directory—which is the primary identity for users in many institutions—is another attack vector in a different system. An effective way to manage different identities is to consolidate them by sourcing them at the AD level and then synchronizing users and their password hashes to Azure AD. You should also review the level of access for all administrators as well as partners as they represent a huge risk downstream. Reviewing the level of access for partners goes beyond security; it’s also a matter of regulatory compliance.

Additional Considerations

Depending on your institution’s license level, there are additional Azure and M365 settings you can adjust in the areas of protection, compliance, and administration. For example, global auditing is an essential setting that should be enabled to augment security and facilitate troubleshooting after attacks. You should also block settings allowing for open collaboration and outbound email forwarding to avoid data loss and minimize cyberattacks.

If your institution is at the M365 level, it also needs the mobile device management (MDM) platform that offers sufficient protection. Exchange Online has built-in MDM capabilities but these capabilities do not extend to all M365/O365 apps.

Conditional access policies govern sign-ins and attempts. They can enable the enforcement of MFA and are the highest control layer for determining who has access to the data within Azure’s security ecosystem.

Since data lives outside of Exchange Online in the M365 world, if your institution has specific compliance requirements for retention, your retention policies will generally need to extend to all data.

M365 Security Basics

Adjusting all the security settings of Azure AD and M365 can be a daunting task, especially since Microsoft is constantly updating the features of its technology services. Our CloudInsight™ M365 Security Basics solution provides insights into security settings for Azure AD and M365 tenants. It helps IT administrators navigate the complexities of customizing their institution’s security settings through three services: reporting, alerting, and quarterly reviews.

The reporting service provides ongoing Microsoft data and packages it into a readable format that shows security settings at a glance, allowing institutions to easily see irregularities, such as when users sign in from Outside of the USA. Alerting sends a notification when an activity indicates that a potential compromise has occurred. With the quarterly reviews, trained experts analyze the settings, reports, and alerts and review them with administrators so they can speak with confidence to their board, steering committees, and auditors about their institution’s technology services and cloud security.

If you need help understanding how M365 Security Basics can support your financial institution’s risk mitigation or strategic planning efforts, contact us. You can learn more about this topic with our “How to Manage Security Identity and Compliance within the Microsoft Azure and M365 Ecosystem” webinar.

Important Disclaimer

The security settings that are discussed in this paper can have a dramatic impact on end-users and/or service functionality and should only be employed if deemed appropriate and after careful consideration. There are a variety of security options available, but organizations should strive to implement these technology services strategically and, ideally, through planned phases of objectives over potentially several months or even years. The recommendations, statements, and other concepts contained within this paper are provided primarily for the consideration of IT Administrators of financial institutions.

17 Feb 2022
Microsoft Azure and 365 Security Basics Featured Blog Image_Featured Image
Banks, Compliance, Credit Unions Eric Delgado 0 comment

Microsoft Azure and 365 Security Basics

Microsoft Azure and 365 Security Basics Featured Blog Image_Featured Image

Financial Institutions that employ Microsoft 365 (also known as M365 and formerly branded as Office 365) are in the Cloud, and therefore, face a growing number of cyber threats. Consider this: The FBI’s Internet Crime Complaint Center (IC3) has seen a 400-percent increase in cybersecurity complaints since the pandemic started.

The surge in cybercrimes means financial institutions that use M365 need to focus on protecting their assets in the Cloud. Our CloudInsight™ M365 Security Basics makes it easy and affordable for institutions to start the process. M365 Security Basics provides visibility into security settings for Microsoft Azure Active Directory (Azure AD) and M365. Banks and credit unions can leverage this multi-faceted solution to get ahead of cyber threats and enhance cloud security.

Importance of Customizing Your Azure AD and M365 Settings

Your financial institution likely has a Microsoft tenant with Azure AD, whether you realize it or not. This is partly because every exchange online and M365 implementation requires the creation of a Microsoft tenant and Azure AD, even if the services are managed through a third party. There are also many other scenarios requiring the creation a Microsoft tenant, making it rare for most institutions not to have one.

It is important to understand whether you have a Microsoft tenant with Azure AD because the tenant belongs to your institution—not the licensing reseller—it is your obligation to know how to manage the security settings in these systems, including Azure AD, M365, and Exchange Online. This can be challenging because Microsoft’s default settings might conflict with your institution’s security and compliance requirements. Therefore, you must customize these settings to create more sophisticated and appropriate security, identity, and compliance policies for your institution. This should entail building policies around what users are allowed to do, what your institution’s risk assessment defines, what your institution’s compliance policies dictate, and what users will tolerate.

Once your institution has sufficient policies in place, it is essential to monitor for exceptions with reporting and alerting. And with the proper license, you can further enhance cloud security by optimizing the settings for Azure AD Premium P1, Intune, and Azure Information Protection.

How M365 Security Basics Can Help

Microsoft is constantly adjusting its platforms and automatically enabling new features to adapt to an ever-evolving security environment, making it difficult for banks and credit unions to keep up. Partnering with a value-added technology expert like Safe Systems can help you better manage your M365 tenant. Our M365 Security Basics service identifies cloud security blind spots and common risks such as compromised user accounts, enabled insecure protocols, and targeted phishing or SPAM attacks.

M365 Security Basics key services:

  • Reporting – Collects Microsoft data that may not be readily available to institutions and assembles it in a user-friendly format
  • Alerting – Delivers notifications for the most common indicators of compromise in Microsoft M365 tenants
  • Quarterly reviews – Provide a vital, objective look at M365 Security Basics reports to help institutions determine the optimal security settings for their requirements

The Importance of MFA

An invaluable security control financial institutions should also consider implementing is multi-factor authentication (MFA). MFA applies a combination of factors to validate people’s identity before giving them access to sensitive data, account information, and other assets. MFA offers effective, low-cost protection against cyberattacks and other threats; and not implementing this security feature in Azure AD is risky. According to Microsoft, 99.9 percent of account compromises can be blocked with MFA, but the overall MFA adoption rate we have seen in the financial industry is only around 46 percent.

The bottom line: Microsoft is constantly enabling and disabling features in Azure AD and M365—, therefore, financial institutions must be able to manage the complexities of optimizing their security, identity, and compliance settings. To learn more about how your institution can customize Azure AD and M365 settings to enhance cloud security, read our “Azure and M365 Security Basics” white paper.

© 2025 UFS and Safe Systems are now the same company. Safe Systems is a registered trademark in the US. All rights reserved. Privacy Policy