Category: Technology

Running the day to day IT network administration for a community bank is a full-time job. One of the biggest challenges is the need for constant management of multiple solutions with a limited number of people on the IT team.

The typical IT department at a small community institution has a big job with limited staff. Not only is the department expected to oversee all the administrative work of setting up and maintaining the bank’s IT network, but they are also expected to work with the security officers to ensure that every technology component that constitutes the network is compliant with regulatory guidance. The department is also responsible for monitoring an array of administrative concerns like antivirus status, patch compliance, and email security to name just a few.

Furthermore, when auditors or examiners come knocking, the IT department must be able to produce a paper trail proving that daily practices match written policies and procedures. Then comes the matter of internal oversight. The processes that make use of those technology components must also align with the institution’s high-level policies, and this is where an IT steering committee, senior management, and the board of directors come into play. In order to support strategic IT decision-making, IT managers must be able to neatly package and explain network health and technology compliance in reports aimed at this group who hold the ultimate responsibility for protecting customer data.

As these financial institutions plan for a future that is increasingly taking more banking services online and mobile, a modern community bank’s lifeblood is its technology!

To help augment internal IT resources many institutions are turning to IT and security service providers to act as an extension of their organization — seeking a true partner to work together to streamline technology needs. The right solution provider can help bridge the gap between a financial institution’s everyday network administrative functions and the big picture goals of IT compliance and infrastructure planning.

An IT and security service provider can help automate and control many of the IT network administrative functions that are so time-consuming for in-house staff. Automating patch management and reporting saves your bank IT resources a tremendous amount of time. Providing bankers the ability to actively monitor network information for diagnostic or security issues not only saves time and improves efficiencies, but also helps the bank extend its hours of support beyond the traditional 9 to 5 hours. Additionally, outsourcing these business processes can help fill the gap when the IT staff is out sick or on vacation, providing added peace of mind.

IT service providers who focus on the community bank market can also offer account managers who act as facilitators and trusted advisors to help guide technology committees and provide tools to address financial regulatory governance. These account managers have a wealth of banking IT expertise and commonly attend technology steering committee meetings, assist with IT strategic planning, facilitate the responses to pre-exam IT questionnaires, and conduct periodic self-assessments of the bank’s IT infrastructure. With this structured guidance, financial institutions can gain deeper technology insights, complete more comprehensive control self-assessments, and enhance strategic IT planning.

The right IT service provider should offer your bank full support for the demands of banking technology and IT regulatory compliance by delivering your institution a solution that encompasses the three spheres of IT policy, procedure, and documentation. At Safe Systems we understand the ever-growing complexity of community banks’ IT operations and enhanced regulatory requirements. By making the decision to partner with Safe Systems and introduce our NetComply service, your organization will benefit from time saving automation and an in-depth view of your IT network environment. We want to provide you with assurance that your institution’s IT network is functioning efficiently, optimally, securely, and, most importantly, is compliant with FFIEC regulations.

Dispelling 5 IT Outsourcing Myths within Financial Institutions

Learn why five of the most commonly believed “facts” about IT outsourcing within community financial institutions are actually myths.

Microsoft appears to be positioning Windows 10 to address the usability concerns many had with Windows 8. In theory, Windows 8 itself could be interpreted as an overreaction to the proliferation of touchscreen devices of the past few years. In an attempt to make Windows 8 an iOS competitor, Microsoft appears to have swung wide by removing the familiar Start menu and focusing more on touch-responsive UI and navigation.

Now, with the reintroduction of the Start button and a sharper focus on usability and navigation with a mouse, perhaps Microsoft can address the issues that made Windows 8 such a jolting transition. The revised Start button will function as a cross between the Start button of Windows 7 and the Start screen of Windows 8. Further, Microsoft appears to be making efforts to ensure that the user experience will be flexible enough to serve the needs of both desktop/laptop and tablet/smartphone users.

Another evolving feature that somewhat bridges the gap between usability and security in Windows 10 is the software update mechanism. Traditionally, Microsoft has provided an intermittent update cycle, through which they professed to not add new features outside of major version updates. In reality, what we have seen over the years was a major version release (Windows XP, 7, 8), and subsequent smaller updates in the form of “R2” releases or Service Packs. Windows 10 looks to introduce a more frequent update schedule that will make use of update “tracks.” This will allow administrators and users to select between a slow update speed and a fast update speed. Users on the fast track will receive updates earlier, and those on the slow track will get updates more slowly. This will bring Microsoft in closer alignment with the faster update schedule of Google Chrome, while still allowing a robust testing base. It should be noted that this paradigm only applies to feature updates. Security updates will still be deployed on a monthly basis, and the existing Microsoft Update system appears to be more or less intact in current preview versions.

Dispelling 5 IT Outsourcing Myths within Financial Institutions

Learn why five of the most commonly believed “facts” about IT outsourcing within community financial institutions are actually myths.

1. Does your hardware and software vendor understand the technical requirements of your core banking platform?

   Having the knowledge and ability to work with your core banking provider is imperative for all IT vendors that work with your financial institution. Vendors must know the inner workings of the core banking application. They should also be familiar with the various products that the core provider uses. It is also helpful for vendors to have a repository of core product specs to refer to before ordering equipment.

2. Will the vendor understand your business?

   Hardware vendors and service providers must truly understand the ins and outs of operating a community bank. For example, they must understand the priority of a customer-facing teller line and the best technology needed to deliver such service. Another thing to consider is: will they listen to your banking business needs and make a recommendation based on solving those needs, not just placing a piece of hardware?

3. Will your vendor understand regulatory compliance requirements?

   The ever-changing world of financial regulatory compliance governs every aspect of your IT network; and that includes what hardware and software you choose to deploy. In today’s banking environment, vendors must be able to make recommendations on how to manage hardware and software to meet regulatory expectations, including making sure your hardware stays under warranty and your software stays under support (i.e., when there is a critical service being run on a server, you can’t have the server warranty expire); certifying that you can always access your critical services as a part of a business continuity plan; and warranting that software is kept up to date with security updates.

   
   Read: Extending the Life of Your Hardware Maintaining hardware warranties

4. Will your vendor have a plan or are they just filling orders?

   Building an IT network without a plan is like building a house without a blueprint. In order for hardware and software implementations to be successful, bankers and vendors must agree on a plan. A smart way for bankers to move forward is developing a strategic IT plan to manage your current business and provide a foundation to support new technology and services.

5. Does your vendor have the ability to recognize and discuss trends within the banking industry?


   Technology is ever changing and it is nearly impossible for anyone to keep up with all the advancements happening day to day. Look for a partner with numerous bank clients facing similar challenges every day and one that has the experience of finding the best solutions for these challenges. Bankers need to employ new but stable technology with a focus on performance, security and recoverability.

Dispelling 5 IT Outsourcing Myths within Financial Institutions

Learn why five of the most commonly believed “facts” about IT outsourcing within community financial institutions are actually myths.

It is very common to have people that you know in the community who run great IT companies. Many of these people often have personal relationships with the bank and bank employees, may have accounts with the bank, and may even have stock or sit on the board of the bank. In addition to the established personal relationship, most banks also like the idea of having someone who can physically be at the bank to assist when something breaks or needs attention.

These are all valid reasons for using a local IT service provider; however, it is also important to understand the risks that these providers pose to your institution, especially given today’s oversight environment.

1. Examiner expectations

   In recent years the FFIEC has published very clear regulations focused on vendor management. To this point, several IT Examination Handbook booklets address managed security providers and cloud services. For example, the Outsourcing Technology Services and Business Continuity Planning booklets both contain explicit guidance on technology service providers.

IT vendors that provide services, including antivirus, patch management, and event logging, have heightened expectations from the regulators. Your institution must perform a risk assessment on each vendor to validate that they conduct themselves in a sound and secure manner. Ideally, technology service providers should submit themselves to independent audits that take Trust Service principles into account (security, availability, processing integrity, confidentiality and privacy), and provide evidence in the form of an audit report. Many local IT support companies may not have the audits to validate that they are managing outsourced business processes consistent with the way financial institutions must manage them.

2. They don’t know the expectations specific to our industry

   In the same addenda mentioned above, the regulators address risk assessment processes for IT vendors. They specifically mention knowing how many financial institution customers the vendors have versus their total customer counts. Vendors that don’t have a large number and percentage of their customers as financial institutions may not have the proper controls in place to validate compliance.

   From a purely technical perspective, working with banks is more complex. For example, one of the great advantages of technology management today is the ability to work remotely. Vendors with remote access that have no way to log and track access are not acceptable from either a business or compliance risk perspective.

3. Limited knowledge of banking applications

   One recurring theme with vendors that support multiple industries is that they are usually very good at supporting systems that are common among their customer base. This includes items like Microsoft Office, email, printing and network communications. When vendors are supporting your systems their knowledge of your banking applications is vital. Making sure that the teller, new account, imaging, loan, and other applications continue to work within the updated IT infrastructure is imperative. In today’s world customers expect minimal downtime, and having a vendor with limited expertise in your bank’s critical applications lengthens the time required for problem resolution. When you need help with IT support, you don’t have time for your vendor to learn how the applications work before they start resolving the problem.

4. Lack of documentation and reporting

   Most IT vendors are quite good at working to fix a problem or setting up systems to work correctly. However, that technical configuration is just a piece of the puzzle. As a regulated financial institution, you can’t outsource responsibility, so having proper reporting and documentation is imperative. You must prove that the way your devices are configured and managed adhere to your Information Security policies. For instance, if you can’t install a patch because it will break the teller system, you have to document the reasons why the patch was not deployed. This type of reporting and validation needs to be available so the technology steering committee and senior management can make informed decisions about IT issues.

Perhaps more importantly, auditors and examiners will also expect a thorough paper trail to prove that daily practices match defined policies and procedures. In today’s ever-changing environment of regulatory compliance requirements, it is essential your financial institution’s policies, procedures and practices are in perfect alignment with regulator’s expectations. Not doing so can cost your bank severely.
As a reputable partner to community banks, Safe Systems specializes in delivering technology, security and compliance products and services. We understand that community financial institutions like yours are under pressure to manage the constant evolution of technology and compliance. We maintain the proper audit certifications (SOC 2, Type II) to assure your examiners that our business practices are sound and secure. With our expert solutions, you can stay ahead of this ever changing environment while managing costs and limited resources.

Dispelling 5 IT Outsourcing Myths within Financial Institutions

Learn why five of the most commonly believed “facts” about IT outsourcing within community financial institutions are actually myths.

There are many reasons to step away from your desk. Coffee, for example, is an excellent reason. Or maybe you just need to stretch your legs (honestly, you probably deserve to take a break). But managing the functionality provided by your servers need not be a reason to leave your desk. With the right mix of tools you can control and manage many aspects of your servers and your domain(s) from the convenience of your primary machine.

When it comes to managing the network at a distance Windows Terminal Services\Remote Desktop and VMWare’s ESX VSphere (for those of you with a little virtual in your infrastructure) are two well-documented options. In this article I’d like to introduce you to a third, possibly less well known option – the Remote Server Admin Tool (RSAT). This optional update from Microsoft (KB958830, although it is not available through Windows/Microsoft Update) can allow easy access to server functions right from your desktop.

RSAT extends the functionality provided by the Microsoft Management Console (MMC). The MMC offers a centralized interface into which specific functionalities can be snapped.

Manage Server Roles and Features

1. You can access the MMC by pressing the Start button and typing MMC into the search box. Note: Depending on the current inherent or delegated administrative rights assigned to your user account, you may need to use the “Run as Administrator” function when opening the MMC.



2. Here, you can see the MMC in its default state.



3. The default console is rather sparse, so your next step is to start adding snap-ins. From within the MMC, click on “File”, and then “Add/Remove Snap Ins”.



4. By selecting items from the left pane (“Available snap-ins”), and clicking “Add” to move them to the right pane (“Selected snap-ins”), you will add those items into the console, as shown here.

You can now manage those Server Roles and Features as if you were interacting with them directly on the server! This is especially useful for unlocking domain accounts, managing group assignments, or (re)configuring group policy objects. However there are quite a few more specialized features you can manage with RSAT, some of which are shown in the “Add/Remove snap-ins” screenshot above.

Setting Up RSAT

(Updated May 11, 2020)

1. Open the Start menu, and search for Settings.



2. Once within Settings, go to Apps.



3. Click Manage Optional Features.



4. Click Add a feature.



5. Scroll down to the RSAT features you would like installed.



6. Click to install the selected RSAT feature.



7. Click back to the Manage Optional Features menu and you will see it installing.



8. It will also be in this list to uninstall afterwards.

Download RSAT (not required for W10): https://www.microsoft.com/en-us/download/details.aspx?id=45520

Microsoft’s RSAT documentation page (has an updated system requirements): https://docs.microsoft.com/en-us/windows-server/remote/remote-server-administration-tools

One more note on the MMC: Nobody likes to repeat themselves, so once you have selected your snap-ins of choice, you should save your console to a location of your choosing for quick access.

In summary, after a brief initial setup you can use the Remote Server Admin Tool to enhance the Windows Microsoft Management Console and manage aspects of your Domain, Active Directory, and Network directly from your desktop. You may be surprised at just how quick, easy, and powerful the combination of RSAT and MMC can be. Now, how about that cup of coffee?

Dispelling 5 IT Outsourcing Myths within Financial Institutions

Learn why five of the most commonly believed “facts” about IT outsourcing within community financial institutions are actually myths.