Category Archives: Credit Unions

Success of Our vCISO Program in a Credit Union Client

Posted on by
Reply

Our vCISO program recently celebrated a significant success with one of our credit union clients, demonstrating the profound impact of our tailored security strategies and expert guidance.

From the onset, we approached the partnership with a comprehensive risk assessment, focusing on the unique needs and regulatory requirements of the credit union sector. Leveraging our deep understanding of financial services and compliance, we crafted a robust security roadmap aligned with the NCUA ISE and CIS CSC guidelines. This foundational work set the stage for a series of strategic implementations and continuous improvements.

Key Components of Our Success

A key component of our success was the execution of tailored table-top exercises, as outlined in our proprietary workflow. These exercises simulated various incident scenarios, enabling the credit union’s team to refine their incident response protocols and improve their readiness for potential cyber threats. Our iterative approach ensured that the scenarios were realistic and relevant, leading to significant enhancements in their incident management capabilities.

Moreover, our ongoing advisory services included regular reviews and updates to their security policies and procedures, ensuring alignment with best practices and regulatory standards. This proactive stance not only fortified their security posture but also provided assurance to their stakeholders about the integrity of their financial processes.

We also prioritized the implementation of advanced threat detection and response mechanisms. Utilizing our HoneyPoint™ Security Server, the credit union achieved real-time threat intelligence and a deeper understanding of their network security landscape. This capability was crucial in detecting and mitigating threats before they could escalate into significant incidents.

One of the standout achievements was the credit union’s enhanced resilience against ransomware attacks, a prevalent threat in the financial sector. Our detailed ransomware preparedness checklist guided their implementation of critical controls, from regular data backups to comprehensive user education on phishing risks. This multi-layered defense strategy significantly reduced their vulnerability to such attacks.

Conclusion

The success of this engagement underscores the value of our vCISO program. By combining strategic oversight, hands-on exercises, and continuous improvement initiatives, we enabled our credit union client to not only meet but exceed their security and compliance objectives. This partnership exemplifies our commitment to empowering clients with the tools and knowledge necessary to navigate the complex cybersecurity landscape effectively.

To learn more about how our vCISO program can transform your organization’s security posture, visit our blog at stateofsecurity.com or contact MicroSolved directly. Together, we can build a more secure future.

 

* AI tools were used as a research assistant for this content.

Ransomware-Proof Your Credit Union: A Checklist of NCUA Guidance

Posted on by
Reply

In today’s digital landscape, credit unions face numerous cybersecurity threats, including the rising risk of ransomware attacks and vulnerabilities in their information and communications technology supply chain. To help credit unions protect themselves against these risks, the National Credit Union Administration (NCUA) has compiled an FAQ. This checklist covers the essential steps to safeguard against ransomware attacks, additional resources for cybersecurity, understanding supply chain risk management, developing effective practices, mitigating risks associated with using a Managed Service Provider (MSP), and other insights based on their FAQ. By following this checklist, credit unions can enhance their overall security posture and minimize the potential impact of cyber threats.

1. Protect against ransomware attacks:
– Update software and operating systems regularly with the latest patches.
– Avoid clicking on links or opening attachments in unsolicited emails.
– Follow safe browsing practices.
– Replace equipment running older unsupported operating systems.
– Verify the security practices of vendors and third-party service providers.
– Maintain complete and tested backups of critical systems and data.

2. Additional resources for cybersecurity:
– Use the Ransomware Self-Assessment Tool (R-SAT) from the Conference of State Bank Supervisors.
– Read the Center for Internet Security white paper on ransomware.
– Visit the cybersecurity pages of the National Security Agency Central Security Service and the Cybersecurity & Infrastructure Security Agency. (CISA)
– Refer to the Treasury Department’s advisory on potential sanctions risks for facilitating ransomware payments.

3. Understand Technology Supply Chain Risk Management (SCRM):
– Recognize that technology supply chain vulnerabilities can pose risks to the entire institution.
– Consider the risks associated with third-party vendors and the entire technology supply chain.
– Identify vulnerabilities in all phases of the product life cycle.

4. Develop an effective Technology Supply Chain Risk Management Practice:
– Build a team with representatives from various roles and functions.
– Document policies and procedures based on industry standards and best practices.
– Create a list of technology components and understand their criticality and remote access capability.
– Identify suppliers and verify their security practices.
– Assess and evaluate the SCRM program regularly.

5. Risks associated with using a Managed Service Provider (MSP):
– APT actors actively attempt to infiltrate IT service provider networks.
– Conduct proper due diligence and ongoing monitoring of MSPs.
– Understand the risks of centralizing information with an MSP.
– Recognize that compromises in an MSP’s network can have cascading effects.

6. Mitigate the risk of using an MSP:
– Manage supply chain risk by working with the MSP to address security concerns.
– Implement architecture measures to restrict access and protect networks.
– Use dedicated VPNs for MSP connections and restrict VPN traffic.
– Ensure proper authentication, authorization, and accounting practices.
– Implement operational controls, such as continuous monitoring and software updates.

7. Additional references for Information and Communications Technology Supply Chain Risk Management:
– Refer to guidance from the NCUA, NIST, and CISA.
– Evaluate third-party relationships and outsourcing technology services.
– Learn about supply chain threats and cyber supply chain risk management.

Note: This checklist is a summary of the information provided. For more detailed guidance, refer to the full content on the NCUA website.

 

* We used some AI tools to gather the information for this article.

Closing the CUSO Security Loop Hole

Posted on by
Reply

The CUSO Security Loop Hole

The NCUA Inspector General (IG) suggested this week that the agency have regulatory oversight of Credit Union Service Organizations (CUSOs) to reduce the overall risk to the system. CUSOs have long been seen as a separate firm from the credit unions, though they may have an ownership stake in them. To date, many of these organizations have been outside the regulatory and oversight controls that are applied to the very credit unions they serve. In terms of information security, that often means they aren’t held to the same level of security and risk management controls as required by NCUA 748 and other guidance.

DigitalMoneyCUSO Security Oversight Challenges

The NCUA IG suggests that NCUA guidance and regulatory oversight be directly applied to CUSOs, instead of through vendor or partner risk management programs of the CUSO customers. This would provide for more direct regulation of the security controls and risk management processes in use at the CUSOs themselves. However, this introduces several challenges for some CUSOs, who may be more focused on agility, market speeds and innovation – areas where regulatory guidance can be especially impactful and can create significant budgetary challenges. This gets even more complicated when regulatory guidance is vague, or can be inflexible – the very opposite of the needs of organizations focused on innovation and market speed adaptation. An excellent example of this is CUSOs working on financial technologies, crypto currencies, blockchain and other exciting new areas. Regulatory guidance lags or lacks in most of those areas and hasn’t caught up to these new, and in some cases, experimental technologies.

One Approach – Best Practices CUSO Security and Third Party Attestation

One approach that might work, is for CUSOs to work with independent third-party assessors who could then measure the CUSO against industry standard best practices that apply to their specific lines of business, research or innovation. These vendors could then help the CUSO build a relevant and respectable CUSO security and risk management program – which they could attest to the NCUA. If this attestation were required on a yearly basis, along with some basic guidance, like ongoing risk management reviews, ongoing vulnerability management, etc – this could go a long way to mitigating the risks that concern the NCUA IG, while still maintaining independence and control by the CUSOs – thus, empowering their mission. Programs like these have been very successful in other industries and don’t have to add the overhead and bureaucracy of full regulatory compliance or programs like PCI-DSS. 

If you’d like to build such a program for your CUSO, please get in touch with us. We’d love to work on creating this process with a handful of CUSOs around the US, and are more than capable of applying our 30 years of experience in information security to each organization’s independent needs. Drop us a line or give us a call at (614) 351-1237 and let’s work together to close the CUSO Security loop hole in a way that reduces risk but doesn’t destroy the power and flexibility of the CUSO ecosystem.

Three Things I’ve Learned About Credit Union Risk Management

Posted on by
Reply

I have been working with Credit Unions for more than 20 years and have done a wide variety of information security and risk management work over that time. I’ve worked with technical teams, management and boards over the span of more than two decades. Here are three things I’ve learned about how CUs manage risk during that time. 

1) Most credit unions that I’ve worked with care just as much, if not more, about information security than most of the regional size banks they often compete with.

I’ve heard more than one CU leader tell me that they have to be better than the banks, because when a bank gets hacked – that bank makes the news and feels the impact. However, he said, when a credit union gets hacked – all credit unions suffer from the bad press. I am not sure the data supports his claim, but it’s an example of how CUs often focus on working together to solve big problems, and put a lot more attention to detail into it.

2) Many of the credit unions I have worked with look at information security and threat awareness as something that they can offer to their members (“customers, in bank speak”).

More than a few of the CUs have engaged so deeply with their customers on phishing and identify theft, that they include them in discussions about what products and services the CU buys. They do trials, include members in beta-tests and I’ve even seen them do onsite training for how to use new multi-factor authentication tools – even ones that weren’t in use at the CU – just to help make the members more secure and reduce the threat of password re-use across personal sites.

3) The board is often more involved in the risk management process at my CU clients than my banking clients.

The NCUA has taken a lot of steps to increase board member awareness about information security, and it often shows at credit unions. Several times a year, I am asked to present threat updates or review the information security program of a CU, specifically with a presentation to the board in mind. I am often engaged as a third party, to spend a couple of days looking at a security program and reporting to the board on it’s maturity and areas of potential improvement.

During these board sessions, it is not uncommon for the board questions to last more than an hour, after the presentation has completed. The point is, most CU boards that I have worked with are deeply engaged in thinking about risk management at the credit union.

For those of you interested in more about risk management at credit unions, here are some of the best sources, which I refer to often in my presentations:

  • Credit unions also face such internal risks as internal fraud, legal and regulatory noncompliance, data breaches, and injuries to staff and visitors. (boardeffect.com)

  • The bottom line: Figuring out the risk appetite will help guide credit unions to create realistic and measurable risk guidelines. (visibleequity.com)

  • We have helped Credit Unions develop risk appetite statements and risk frameworks and can work with your Credit Union to develop the documentation you require. (creditunionupdate.com)

If you’d like to learn more about MSI and our work with credit unions, just drop us a line (info@microsolved.com) or give us a call (614-351-1237) and we’d be happy to talk about how we might be able to help your credit union excel in IT risk management.

MicroSolved vCISO for Credit Unions

Posted on by
Reply

I recently asked MicroSolved COO, Dave Rose, to share his thoughts with all of us about the vCISO program. He has been leading the effort this last year across several credit unions and regional banks around the US. I asked him for the 3 biggest benefits an organization can expect and here is what he said:

“MicroSolved has been providing vCISO services to Credit Unions for over 20 years. Whether you are a corporate or a natural person CU, hiring MSI for vCISO Services will allow you to:

  • Obtain CISO expertise without having to incur the expense of finding and hiring a CISO. This is an affordable solution that will help keep the risk budget under control.
  • MSI vCISO program comes with the benefit of a focus towards financial expertise and compliance. MSI has had extensive experience working with banks and credit unions on their risk programs, and have spent time educating regulators on risk events and controls.
  • MSI is in the business of mitigating risk. We live it everyday and our clients benefit from that experience. Our clients get to pick the risk work they want resolved and the issues they want remediated. 

You will be hard pressed to find a more efficient and cost effective way to address risk issues and move the regulatory needle. Don’t bear the burden of mitigating risk alone, let MSI be a partner to help you solve your risk needs!”

—Dave Rose

For more information, give us a call at 614-351-1237 or email us at info@microsolved.com. 

Follow Up to Out of Band Authentication Post

Posted on by
2

(This is a commentary follow up to my earlier post, located here.)

A couple of folks have commented on Twitter that they have a fear of using SMS for any sort of security operations. There have been discussions about the insecurity of SMS and the lack of attention to protecting the cellular network by carriers around the world. I generally disagree with blanket statements, and I would push for organizations considering SMS as a means of authentication to undertake a real risk assessment of the process before they jump in.
 
However, if the controls in place in the cell networks meet their appetite for risk, then I think it is a perfectly acceptable business case. It certainly beats in-band simple authentication mechanisms like “pictures of trust” and traditional login/password as a security control.
 
At least in SMS authentication, the attacker would usually need to have control over or access to more than one device belonging to the user. I think this helps make the risk model more acceptable for my views.
 
Other folks discussed how Out of Band Authentication (OOBA) has been done now successfully in many places. I agree with this. We know how to do it. There are a LOT of vendors out there who can successfully integrate, deploy and manage a solution for you. Sadly, though, there are still more than a few who are struggling to get it right or done at all. As with most things in life, it helps to do a little research. Organizations should perform due diligence on their vendors and factor vendor risks into the equation of purchases and project planning. 
 
Lastly, a few folks commented on the fact that they, too, are running into speed bumps with deployments and logistics. Several folks echoed the sentiments of the original challenges and few offered suggestions beyond simply “doing more homework” and looking for “quickly scalable solutions”. The good news with this is that you are not alone out there. Other folks are facing AND BEATING challenges. Feel free to reach out to your peers and discuss what is and what isn’t working for them.
 
As per the original post, the more communication and discussion we can have amongst the community about these topics, the better off we all will be. So, discuss, seriously…
 
##Special thanks to the vendors that replied with case studies, references or stories about how they have done integration and deployment. There are a lot of good vendors out there with knowledge in this area. Careful review of their capabilities will help you sort them out from the less capable. Communication is key.
 
Thanks for reading! 

Financial Organizations Struggle with Out of Band Authentication

Posted on by
4

Many of our client financial organizations have been working on implementing out of band authentication (OOBA) mechanisms for specific kinds of money transfers such as ACH and wires.

 A few have even looked into performing OOBA for all home and mobile banking access. While this authentication method does add some security to the process, effectively raising the bar for credential theft by the bad guys, it does not come without its challenges.

For starters, the implementation and integration of some of the software designed for this purpose has been a little more difficult than expected by many of the teams working on the projects. We are hearing that in some cases, the vendors are having difficulty integrating into some of the site platforms, particularly those not using .NET. Other platforms have been successful, but over time (and many over budget), the lesson learned is this: communicate clearly about the platforms in use when discussing implementations with potential vendors.
 
Other problems we have been hearing about include: availability issues with the number of outbound phone connections during peak use periods, issues with cellular carriers “losing” SMS messages (particularly a few non-top tier carriers), and integrating solutions into VoIP networks and old-style traditional PBX systems.
 
In many cases, these telephonic and cellular issues have caused the systems to be withdrawn during pilot, even turned off for peak periods during use and other “fit and start” approaches as the rough patches were worked out. The lesson in this area seems to be to design for peak use as a consideration, or at least understand and communicate acceptable delays, outages or round-robin processes, and make sure that your systems properly communicate these parameters to the user.
 
In the long run, proper communication to the users will lower the impact of the onslaught some of these systems call to the customer support and help desk folks.
 
It is getting better though. Vendors are learning to more easily and effectively develop and implement these solutions. The impact on account theft has been strong so far and customers seem to have a rapid adjustment curve. In fact, a few of our clients have shared that they have received kudos from their members/customers for implementing these new tools when they were announced, documented, and explained properly to the user base.
 
If your organization is considering this technology and has struggled with it, or has emerged victorious in the mastery of it; please drop me a line on Twitter (@lbhuston) and let me know your thoughts. The more we share about these tools, the better we can all get at making the road less bumpy for the public.
 
As always, thanks for reading and stay safe out there!

Credit Unions and Small Banks Need Strong Security Relationships

Posted on by
3
With all of the attention in the press these days on the large banks, hacking, and a variety of social pressures against the financial institutions, it’s a good time to remember that credit unions and small banks abound around the world, too. They may offer an alternative to the traditional big banking you might be seeking, but they sometimes offer an alternative to the complex, well staffed information security teams that big banks have to bear against attackers and cyber-criminals, too.
 
While this shouldn’t be a worry for you as a consumer (in that your money is secure in a properly licensed and insured institution), it should be a concern for those tasked with protecting the data assets and systems of these organizations.
 
That’s where strong vendor relationships come in. Partnerships with good solution providers, security partners, virtual security teams and monitoring providers can be very helpful when there are a small number of technical resources at the bank or credit union. Ongoing training with organizations like SANS, CUISPA and our State of the Threat series is also very likely to assist the resources they do have in being focused against the current techniques used by attackers. Whether with peers or vendors, relationships are a powerful tool that help security admins in the field.
 
Smaller organizations need to leverage simple, effective and scalable solutions to achieve success. They simply won’t have the manpower to manage overwhelming alerts, too many log entries or some of the other basic mechanisms of infosec. They either must invest in automation or strategically outsource some of those high resource functions to get them done. If your bank has a single IT person who installs systems, manages software, secures the network, helps users, and never goes on vacation; you have one overwhelmed technician. Unfortunately, this all too common. Even worse is that many times, the things that can’t be easily done sometimes end up forgotten, pushed off or simply ignored. 
 
In some cases, where some of the security balls may have been dropped, attackers take advantage. They use malware, bots, social engineering and other techniques to scout out a foothold and go to work on committing fraud. That’s a bad way to learn the lessons of creating better security solutions.
 
So, the bottom line is if you are one of these smaller organizations, or one of the single technicians in question, you need to find some relationships. I suggest you start with your peers, work with some groups in your area (ISSA, ISACA, ISC2, etc.) and get together with some trusted vendors who can help you. Better to get your ducks in a row ahead of time than to have your ducks in the fire when attackers come looking for trouble. 

Deeper Than X-Ray Vision: Device Configuration Reviews

Posted on by
1

Many of our assessment customers have benefitted in the last several years from having their important network devices and critical systems undergo a configuration review as a part of their assessments. However, a few customers have begun having this work performed as a subscription, with our team performing ongoing device reviews of one to three devices deeply per month, and then working with them to mitigate specific findings and bring the devices into a more trusted and deeply hardened state.

From credit unions to boards of elections and from e-commerce to ICS/SCADA teams, this deep and focused approach is becoming a powerful tool in helping organizations align better with best practices, the 80/20 Rule of Information Security, the SANS CAG and a myriad of other guidance and baselines.

The process works like this:
  1. The organization defines a set of systems to be reviewed based on importance, criticality or findings from vulnerability assessments.
  2. The MSI team works with the organization to either get the configurations delivered to MSI for testing or to access the systems for local assessments in the case of robust systems like servers, etc.
  3. The MSI team performs a deep-level configuration assessment of the system, identifying gaps and suggested mitigations.
  4. The MSI team provides a technical level detail report to the organization and answers questions as they mitigate the findings.
  5. Often, the organization has the systems re-checked to ensure mitigations are completed, and MSI provides a memo of our assertions that the system is now hardened.
  6. Lather, rinse and repeat as needed to continually provide hardening, trust and threat resistance to core systems.
Our customers are also finding this helpful as a separate service. Some smaller credit unions and IT departments may simply want to identify their critical assets and have this deep-level review performed against them in advance of a regulatory audit, to prepare for the handling of new sensitive data or important business process or simply to harden their environment overall.
 
Deep-dive device configuration reviews are affordable, easy to manage, and effective security engagements. When MSI works with your team to harden what matters most, it benefits your team and your customers. If you want to hear more about these reviews, engage with MSI to perform them; or to hear more about device/application or process focused assessments, simply drop us a line or give us a call. We would be happy to discuss them with you and see how we can help your organization get clarity with a laser-focus on testing the systems, devices and processes that you value most.
 
As always, thanks for reading and stay safe out there! 

Know Who’s Out to Hack Your Credit Union

Posted on by
1
 
 
 
 
 
 
 
 
 
 
 
 
One of the biggest questions we get when we talk to Credit Unions is about threats. They often want to know who might be targeting Credit Unions and how they might get attacked. Based on these questions and how often we hear them, we have come up with a way for you to actually get some metrics and intelligence around your own threat postures.
 
I am proud to introduce a new short-term service for Credit Unions that leverages our patent-pending HoneyPoint technology in a useful, powerful, easy and affordable way.  The MSI Threat Posture Analysis is a new service that does just that. The service is comprised of the following phases:
 
1. Initial consultation – our teams work together to plan for a quick, safe and easy deployment of our HoneyPoint technology; this initial discussion helps us decide if we are going to leverage a HoneyPoint hardware, software or combined deployment and exactly what we want to emulate for metrics gathering; the length of the metrics gathering mission is also determined (usually 90 days).
 
2. Pricing and contracts – based on our work together, fixed bid pricing is provided for the analysis and monitoring.
 
3. Delivery of technology – our teams work together to deliver and install the technology; MSI monitors the deployment remotely back at our NOC.
 
4. Analysis – MSI performs analysis of the data gathered; generating a set of reports that details sources of attacks, general estimated capabilities, attack frequency and other metrics designed to feed real world threat data into the Credit Union’s information security program.
 
5. Decommission and return of the technology – our teams work together to uninstall the technology and return any hardware to MSI. 
 
6. Follow on Q&A – for 3 months, MSI will continue to be available to answer questions or discuss the data and metrics identified in the analysis.
 
It’s that easy. You can quickly, easily, safely and affordably, move from blunt estimations of threats to real world data and intelligence. If you would like that intelligence as an ongoing basis, give us a call and we can discuss our managed services with you as well. 
 
So, if you’re tired of doing risk assessments without real numbers to back up your data or if your team has hit the maturity point where they can use real world metrics and threat source data to create firewall rules, black holes and other dynamic defenses, this approach can give them the data they are hungry for.
 
If you would like to discuss the analysis or hear more about it, give your account executive a call or reach out to me on Twitter (@lbhuston). I look forward to talking with you about the successes we are seeing.
 
As always, thanks for reading and stay safe out there!