Due to constant change and the growing number of threats the industry experiences, firewall security must continuously adapt to combat current threats. In response, banks and credit unions should evaluate security processes and firewall rules on a regular (quarterly) basis.
Why Should You Review
Firewalls have been a part of network security systems, monitoring both outgoing and incoming traffic, for more than 25 years. They serve as the first line of defense, helping to prevent unauthorized access and blocking certain communications based on security settings.
However, just having a firewall in place is not enough. Banks and credit unions are dynamic in nature and are constantly adding new services or changing business processes. If they are not checking the firewall configuration and rules regularly, it opens the institution up to attacks and breaches. Regular reviews help ensure a weakness in the security of the network will be found prior to exploitation and allow rules to be updated as necessary to meet technology changes or new threats.
For banks, there is an additional regulatory reason to perform quarterly reviews: the FFIEC Cybersecurity Assessment Tool (CAT). The quarterly Firewall Audit serves as a baseline standard, meaning that if you can’t answer “yes,” you will not meet the baseline requirements for the CAT in Domain 3. The quarterly audit is also part of the FFIEC Information Security Booklet.
Where to Start with Quarterly Firewall Rule Evaluations
To better understand how to assess your firewall rules, a few basic areas must be addressed.
First, you should have a solid understanding of how your firewall works and how it is setup. You should also receive firewall reports on a regular basis, and these should be reviewed carefully.
What to look for in Firewall Rules
Knowing how to review or audit firewall rules can be a challenge. Here are four basic things to start with to help guide the process.
- Evaluate your existing firewall’s change management procedures
This helps ensure that all rule changes that have been made in the past are adequately logged and all procedures have been done correctly. - Compare current firewall rules with previous firewall rules
Comparing rules that were previously in place with those currently in place helps to easily identify any changes; track which changes have been made; and verify whether those changes are necessary. It will also help identify unused or “stale” rules. - Evaluate external IP addresses that are allowed by firewall rules
Make sure the addresses the firewall allows are still safe and that they make sense for your bank or credit union to utilize. If some addresses now seem odd or out of place, it is likely that the rules should be changed. - Ensure there is still a true business need for open ports
Firewall rules often contain open ports to allow for external communication. Evaluating open ports to ensure they are still needed is a basic — but important — step. If they are not, the rule can be deleted to avoid unnecessary communication.
While reviews of firewall rules can be done manually, it is time consuming and can be costly in terms operational resources and personnel. Many institutions decide to seek external assistance to simplify and enhance this task. This review task cannot be completely outsourced to a third-party, as it is still the institution’s final responsibility to validate the firewall configuration. If you decide to seek third-party assistance with this responsibility, be sure to ask for specifics and examples on how they help you meet this regulatory requirement and keep your network secure. A good third-party service provider can save your institution time while ensuring your organization has the most up-to-date and efficient firewall in place to protect against today’s constant threats and ensures all compliance and regulatory requirements are met.
In addition to adequately training employees, financial institutions should have security awareness materials and information available to customers and members that enable them to spot security issues and adequately protect themselves as well.
To execute an attack, the hacker group installs the SamSam ransomware on the endpoints of networks compromised, often via unsecured connections. The hackers first look for unsecured remote desktop (RD) servers, launch attacks that compromise the server, and then use various tools to escalate access inside the organization’s network. Once they have gained access to as many endpoints as possible, the group installs the ransomware and starts the extortion process, and hope the victims do not have offline backups.
One effective strategy to 
To execute a DDoS attack, an attacker sends malicious software to vulnerable devices, often through infected emails, attachments, websites and even social media, creating an entire network of infected machines and devices called botnets. The attacker can then control the botnets remotely and send an influx of traffic to flood the network or target by sending huge amounts of random data or connection requests. The infected devices will show no signs of attack and will continue to function normally, but will have the occasional sluggish response due to the lack of available bandwidth.
Security experts agree that a missing piece in many institutions’ security strategy is identifying unusual activity and having solid reconnaissance protection in place. One of the few ways to do this is to deploy what is known as decoy data and services onto the network. This technology serves as a trap for someone who is looking to gain illegal access to the network. Remediation processes can begin immediately once an attacker accesses the “bait” or “decoy.” Any unusual activity on these areas will trigger an alarm, since no there are no legitimate reasons to access the decoys.
To establish a secure IT network and be better protected in the current environment, financial institutions should employ a strategy that places many uniquely tailored layers throughout their networks, from the end-user to the internet, as well as a network security solution that scans the entire network, including all devices and workstations. It is important to implement a solution that identifies unknown vulnerabilities and reduces the risk of cyber-attacks. By scanning more than just servers, financial institutions have the ability to prioritize and address the vulnerabilities identified. 
Many financial institutions are turning to IT and security service providers to act as an extension of their organization and help augment internal technology and compliance resources. The right third-party solution provider can serve as a true partner and work alongside current staff to manage the technology, compliance and regulatory aspects of the institution. When the technology or compliance staff is out or unavailable, outsourcing select business processes helps fill the personnel gap and provide added stability for the institution and peace of mind to all.
This guidance is always changing, and financial institutions must adapt to regulatory demands. IT auditors and examiners will look for evidence of a thorough risk assessment; make sure that written policies and procedures align with the assessment; and then verify that controls and daily practices are appropriate.
In today’s banking environment, community banks recognize and embrace the use of technology and remain committed to investing in new technologies and services moving forward. In fact, nearly 77% of respondents claim they are spending more on technology today than they have in the past. However, the challenge often lies in trying to keep pace with the rapid rate of change that is influencing their business. Community banks are continuing to explore ways to enhance and augment their IT departments, as many institutions struggle to maintain adequate personnel needed to manage the complex activities required of the IT department. To counter this, 71% of respondents have turned to outsourcing their network management and 63% have outsourced their IT support.
