Vulnerability Management Archives

07 Dec 2023

Banks, Compliance, Credit Unions, Security, Technology Christine Ray 0 comment

NetConnect 2023 – A Glimpse into the Future of Technology and Compliance

Safe Systems hosted its 2023 NetConnect Customer User Conference last month in Alpharetta, GA. After taking a hiatus due to the pandemic, Safe Systems customers, employees, and partners were eager to reconvene to discuss the latest trends, challenges, and innovations. This year’s conference provided insights into the evolution of banking and the critical role technology plays in shaping the industry’s future.

Here are some key highlights and insights shared at this year’s conference.

“I have been to several vendor conferences in the last 20 years, and I would say this is one of the best, if not the best, one I have been to. The sessions were informative and on-target. The presenters were all well qualified and engaging.” – Community banking CFO

Celebrating 30 Years of Excellence

NetConnect 2023 marked the 30th anniversary of Safe Systems’ journey in the banking technology landscape. The conference began by reflecting on the early days when our services primarily focused on PC and network policies, network installations, and troubleshooting. Safe Systems highlighted that our evolution and growth were driven by customer feedback and collaboration. Customers have always been the cornerstone of our success.

Randy Ross at NetConnect 2023

Keynote speaker Dr. Randy Ross

The Power of Hope in Business

Keynote speaker, Dr. Randy Ross, shared insights on the importance of hope in the workplace. Hope is not merely wishful thinking or passive optimism; it’s a dynamic motivational system tied to inspirational goal setting. The case for hope in business was backed by impressive statistics, including lower absenteeism, increased productivity, and enhanced morale and creativity. Dr. Ross also provided guidelines on how anyone can apply hope to make life happier, healthier, and more productive.

Regulatory Compliance in a Changing Landscape

Tom Hinkel, VP of Compliance Services, delved into the dynamic world of regulatory compliance. He discussed the latest statistics, including a surge in cyber insurance claims due to zero-day attacks and ransomware. Regulatory changes like third-party risk management (TPRM) guidance and FDIC InTREx updates were highlighted. The session also touched on the cyber incident notification rules approved by the Federal Deposit Insurance Corporation (FDIC), Federal Reserve, and Office of the Comptroller of the Currency (OCC) in 2022 and the Conference of State Bank Supervisors (CSBS) updated R-SAT 2.0 (Ransomware Self-Assessment Tool).

Crowd at NetConnect

Brian Brannon, VP of Security Product Strategy, and James Minstretta, Endpoint Security Engineer, doing a live demo of Azure vulnerability settings.

Security and Vulnerability Management

Brian Brannon, VP of Security Product Strategy, addressed the critical topic of vulnerability management. He explained the proactive strategy of identifying, assessing, and mitigating network weaknesses, aligning it with the expectations of regulators. The session included a live demo to demonstrate the importance of effective vulnerability management.

Azure Security 101

Our Microsoft 365 Certified Technology DevOps Engineer took a deep dive into Azure fundamentals, including Entra ID, M365, and Resource Subscriptions. He explored how to mitigate risks using Conditional Access Policies, enabling multi-factor authentication (MFA), limiting geographic locations, and more. The session included interactive labs of the Entra ID Admin Center, SharePoint Online, and OneDrive to allow attendees to explore logs, manage settings, and review reports firsthand.

Panel Discussion on Regulatory Changes

The conference concluded with a panel of auditors and regulatory compliance specialists, who discussed topics such as the increasing importance of cyber insurance, the impact of AI on exams and audits, and third-party risk management. Attendees had the opportunity to ask questions and engage with experts on these vital topics.

Panel of experts at NetConnect 2023

Safe Systems’ former VP of Compliance Services Tom Hinkel hosting a panel of compliance experts that included Senior Compliance Specialist Paige Hembree (Safe Systems), Financial and Information Security Auditor Matthew Jones (Symphona), Wipfli’s Senior Manager Jim Rumpf, and Director for Supervision Kevin Vaughn (Georgia Department of Banking and Finance)

NetConnect 2023 offered a comprehensive overview of the current state and future prospects of banking technology and regulatory compliance. The industry continues to evolve, and staying informed and adaptable is key to success in this ever-changing landscape. Safe Systems remains committed to supporting financial institutions on their journey, as demonstrated by our 30 years of excellence and our forward-looking approach to technology and compliance.

30 Nov 2023

Banks, Compliance, Credit Unions, Security, Technology Jamie Davis 0 comment

Important Industry Insights on the Use of Anti-Malware and Advanced Features for Ransomware Protection

According to the IC3 2022 Internet Crime Report, the FBI received 2,385 complaints identified as ransomware with adjusted losses of more than $34.3 million. Moreover, 870 of these complaints indicated that organizations belonging to a critical infrastructure sector, such as financial services, were victims of a ransomware attack. This makes it imperative for banks and credit unions to employ a variety of measures to protect themselves against the growing threat of ransomware attacks. Yet many financial institutions that are leveraging anti-malware solutions are not using advanced features that can help protect against ransomware threats. According to Safe Systems’ 2023 Cybersecurity Outlook for Community Banks and Credit Unions, advanced features for anti-malware/anti-ransomware solutions such as root cause analysis, advanced machine learning algorithms, and sandbox analysis only received 12% or less of the answers among the survey participants.

With advanced features, financial institutions can more effectively monitor security threats on endpoints and ascertain the source and extent of an attack. Institutions that want to enhance their ability to detect and respond to threats might consider expanding their cybersecurity budget to increase spending on advanced anti-malware and endpoint protection features.

Recovery Strategies

As part of their recovery strategies, more than one-third of 144 survey respondents say they have implemented notification measures, including notifications to customers, regulators, and applicable insurance carriers. This is critical given the recently finalized interagency Computer-Security Incident Notification Rule. It requires banking organizations to notify their primary federal regulator about any significant “computer-security incident” as soon as possible after a cyber incident happens. (A computer-security incident, as defined by the rule, is an occurrence that results in actual harm to the confidentiality, integrity, or availability of an information system or the information that the system processes, stores, or transmits.) Nearly 30% also leverage other important recovery strategies such as monitoring for the early detection of potential incidents and eliminating intruder access points.

Other Key Security Issues

In addition to shedding light on how institutions use advanced features for anti-malware/anti-ransomware solutions, our comprehensive survey highlights several other security issues, including Microsoft 365 services, email infrastructure, advanced firewall features, vulnerability and patch management, and more. Banks and credit unions must effectively address all of these areas to stay ahead of the constantly evolving cybersecurity landscape.

Download a copy of our latest white paper to read the complete survey findings, which can provide a deeper understanding of current cybersecurity concerns and best practices to enhance your institution’s security posture.

16 Nov 2023

Banks, Compliance, Credit Unions, Security, Technology Jamie Davis 0 comment

What You Need to Know from the 2023 Cybersecurity Outlook for Community Banks and Credit Unions

As cyber threats become more complex, aggressive, and prevalent, implementing cybersecurity mitigation strategies is becoming more critical in the financial services sector. Not surprisingly, cyber preparedness and budget restraints are the top security challenges for more than half of the financial institutions that responded to the Safe Systems survey, 2023 Cybersecurity Outlook for Community Banks and Credit Unions.

Our analysis presents input from approximately 160 participants who responded to 55 questions (including multiple-choice) based on how relevant each query was to their organization.* In addition to focusing on the top security challenges, the survey highlights respondents’ input on several other critical areas, including:

Prevention and Detection Security Layers: Modern operating environments require a more robust security strategy that goes beyond implementing a basic firewall or anti-malware solution to protect their information and infrastructure from the growing number of cyber threats. Survey respondents are implementing multiple security layers, including firewall, patch management, anti-malware, email encryption, employee training and testing, vulnerability monitoring, and security log monitoring. However, less than 50% of all respondents use every security layer listed in the survey, which indicates they can do more to protect themselves against cyberattacks.
Employee Security Awareness Training and Testing: 95% of all cybersecurity issues can be linked to mistakes made by individuals, with 43% of breaches attributed to insider threats, according to the 2022 Global Risk Report by the World Economic Forum, making employee security awareness training and testing critical for financial institutions. Accordingly, survey respondents are deploying multiple types of security training, including simulated phishing attacks, self-service online training and exercises, interactive classroom training, and more. Of the 144 participants responding to this question, 60% indicate they conduct individual training based on need, which is notable because this method of instruction normally requires more time and resources.
Advanced Firewall Features: A majority of the participants responding to this question indicate that they are using one or more advanced firewall (or next-gen firewall) features, such as intrusion prevention or detection systems (IPS/IDS), transport layer security (TLS)/secure socket layers (SSL), and Geo-IT filtering. Whether managed in-house or through an outside provider, these expanded capabilities can help institutions protect their network and institution against a broad array of threats. Sandboxing, for example, provides a safe, isolated environment to execute and observe potentially malicious code from unverified programs, files, suppliers, users, or websites. Out of 135 respondents, only 24% indicate they have sandboxing despite its ability to identify threats.
Cybersecurity Preparedness: Examiners recognize the increasing volume and sophistication of cyber threats and have an increased focus on cybersecurity preparedness in assessing the effectiveness of an institution’s overall information security program. Out of 128 respondents, 52% confirm that the focus on information security, including cybersecurity, has increased during their IT audits and exams. IT examiners and auditors are also reviewing whether institutions have completed any of the common cybersecurity assessments (e.g., CAT, ACET, or CRI/NIST), and they are using them to evaluate institutions’ security posture during an exam. According to the same respondents, 43% say they had their cybersecurity assessment reviewed and used as part of their latest IT exam, and 39% indicate that they received recommendations based on it.

To access the complete survey and gain valuable peer-to-peer insights that can help your institution enhance its cybersecurity decision-making process, read “2023 Cybersecurity Outlook for Community Banks and Credit Unions“.

* The number of respondents varies per question. For multiple-choice questions, the Percent (Respondents) is calculated by dividing each answer count by the total unique respondents, and the Percent (Answers) is calculated by dividing each answer count by the total counts collected.