Tag Archives: NCUA

Success of Our vCISO Program in a Credit Union Client

Posted on by
Reply

Our vCISO program recently celebrated a significant success with one of our credit union clients, demonstrating the profound impact of our tailored security strategies and expert guidance.

From the onset, we approached the partnership with a comprehensive risk assessment, focusing on the unique needs and regulatory requirements of the credit union sector. Leveraging our deep understanding of financial services and compliance, we crafted a robust security roadmap aligned with the NCUA ISE and CIS CSC guidelines. This foundational work set the stage for a series of strategic implementations and continuous improvements.

Key Components of Our Success

A key component of our success was the execution of tailored table-top exercises, as outlined in our proprietary workflow. These exercises simulated various incident scenarios, enabling the credit union’s team to refine their incident response protocols and improve their readiness for potential cyber threats. Our iterative approach ensured that the scenarios were realistic and relevant, leading to significant enhancements in their incident management capabilities.

Moreover, our ongoing advisory services included regular reviews and updates to their security policies and procedures, ensuring alignment with best practices and regulatory standards. This proactive stance not only fortified their security posture but also provided assurance to their stakeholders about the integrity of their financial processes.

We also prioritized the implementation of advanced threat detection and response mechanisms. Utilizing our HoneyPoint™ Security Server, the credit union achieved real-time threat intelligence and a deeper understanding of their network security landscape. This capability was crucial in detecting and mitigating threats before they could escalate into significant incidents.

One of the standout achievements was the credit union’s enhanced resilience against ransomware attacks, a prevalent threat in the financial sector. Our detailed ransomware preparedness checklist guided their implementation of critical controls, from regular data backups to comprehensive user education on phishing risks. This multi-layered defense strategy significantly reduced their vulnerability to such attacks.

Conclusion

The success of this engagement underscores the value of our vCISO program. By combining strategic oversight, hands-on exercises, and continuous improvement initiatives, we enabled our credit union client to not only meet but exceed their security and compliance objectives. This partnership exemplifies our commitment to empowering clients with the tools and knowledge necessary to navigate the complex cybersecurity landscape effectively.

To learn more about how our vCISO program can transform your organization’s security posture, visit our blog at stateofsecurity.com or contact MicroSolved directly. Together, we can build a more secure future.

 

* AI tools were used as a research assistant for this content.

Ransomware-Proof Your Credit Union: A Checklist of NCUA Guidance

Posted on by
Reply

In today’s digital landscape, credit unions face numerous cybersecurity threats, including the rising risk of ransomware attacks and vulnerabilities in their information and communications technology supply chain. To help credit unions protect themselves against these risks, the National Credit Union Administration (NCUA) has compiled an FAQ. This checklist covers the essential steps to safeguard against ransomware attacks, additional resources for cybersecurity, understanding supply chain risk management, developing effective practices, mitigating risks associated with using a Managed Service Provider (MSP), and other insights based on their FAQ. By following this checklist, credit unions can enhance their overall security posture and minimize the potential impact of cyber threats.

1. Protect against ransomware attacks:
– Update software and operating systems regularly with the latest patches.
– Avoid clicking on links or opening attachments in unsolicited emails.
– Follow safe browsing practices.
– Replace equipment running older unsupported operating systems.
– Verify the security practices of vendors and third-party service providers.
– Maintain complete and tested backups of critical systems and data.

2. Additional resources for cybersecurity:
– Use the Ransomware Self-Assessment Tool (R-SAT) from the Conference of State Bank Supervisors.
– Read the Center for Internet Security white paper on ransomware.
– Visit the cybersecurity pages of the National Security Agency Central Security Service and the Cybersecurity & Infrastructure Security Agency. (CISA)
– Refer to the Treasury Department’s advisory on potential sanctions risks for facilitating ransomware payments.

3. Understand Technology Supply Chain Risk Management (SCRM):
– Recognize that technology supply chain vulnerabilities can pose risks to the entire institution.
– Consider the risks associated with third-party vendors and the entire technology supply chain.
– Identify vulnerabilities in all phases of the product life cycle.

4. Develop an effective Technology Supply Chain Risk Management Practice:
– Build a team with representatives from various roles and functions.
– Document policies and procedures based on industry standards and best practices.
– Create a list of technology components and understand their criticality and remote access capability.
– Identify suppliers and verify their security practices.
– Assess and evaluate the SCRM program regularly.

5. Risks associated with using a Managed Service Provider (MSP):
– APT actors actively attempt to infiltrate IT service provider networks.
– Conduct proper due diligence and ongoing monitoring of MSPs.
– Understand the risks of centralizing information with an MSP.
– Recognize that compromises in an MSP’s network can have cascading effects.

6. Mitigate the risk of using an MSP:
– Manage supply chain risk by working with the MSP to address security concerns.
– Implement architecture measures to restrict access and protect networks.
– Use dedicated VPNs for MSP connections and restrict VPN traffic.
– Ensure proper authentication, authorization, and accounting practices.
– Implement operational controls, such as continuous monitoring and software updates.

7. Additional references for Information and Communications Technology Supply Chain Risk Management:
– Refer to guidance from the NCUA, NIST, and CISA.
– Evaluate third-party relationships and outsourcing technology services.
– Learn about supply chain threats and cyber supply chain risk management.

Note: This checklist is a summary of the information provided. For more detailed guidance, refer to the full content on the NCUA website.

 

* We used some AI tools to gather the information for this article.

Closing the CUSO Security Loop Hole

Posted on by
Reply

The CUSO Security Loop Hole

The NCUA Inspector General (IG) suggested this week that the agency have regulatory oversight of Credit Union Service Organizations (CUSOs) to reduce the overall risk to the system. CUSOs have long been seen as a separate firm from the credit unions, though they may have an ownership stake in them. To date, many of these organizations have been outside the regulatory and oversight controls that are applied to the very credit unions they serve. In terms of information security, that often means they aren’t held to the same level of security and risk management controls as required by NCUA 748 and other guidance.

DigitalMoneyCUSO Security Oversight Challenges

The NCUA IG suggests that NCUA guidance and regulatory oversight be directly applied to CUSOs, instead of through vendor or partner risk management programs of the CUSO customers. This would provide for more direct regulation of the security controls and risk management processes in use at the CUSOs themselves. However, this introduces several challenges for some CUSOs, who may be more focused on agility, market speeds and innovation – areas where regulatory guidance can be especially impactful and can create significant budgetary challenges. This gets even more complicated when regulatory guidance is vague, or can be inflexible – the very opposite of the needs of organizations focused on innovation and market speed adaptation. An excellent example of this is CUSOs working on financial technologies, crypto currencies, blockchain and other exciting new areas. Regulatory guidance lags or lacks in most of those areas and hasn’t caught up to these new, and in some cases, experimental technologies.

One Approach – Best Practices CUSO Security and Third Party Attestation

One approach that might work, is for CUSOs to work with independent third-party assessors who could then measure the CUSO against industry standard best practices that apply to their specific lines of business, research or innovation. These vendors could then help the CUSO build a relevant and respectable CUSO security and risk management program – which they could attest to the NCUA. If this attestation were required on a yearly basis, along with some basic guidance, like ongoing risk management reviews, ongoing vulnerability management, etc – this could go a long way to mitigating the risks that concern the NCUA IG, while still maintaining independence and control by the CUSOs – thus, empowering their mission. Programs like these have been very successful in other industries and don’t have to add the overhead and bureaucracy of full regulatory compliance or programs like PCI-DSS. 

If you’d like to build such a program for your CUSO, please get in touch with us. We’d love to work on creating this process with a handful of CUSOs around the US, and are more than capable of applying our 30 years of experience in information security to each organization’s independent needs. Drop us a line or give us a call at (614) 351-1237 and let’s work together to close the CUSO Security loop hole in a way that reduces risk but doesn’t destroy the power and flexibility of the CUSO ecosystem.