MISCELLANEOUS CYBERSECURITY NEWS:

Top 5 compliance deadlines for cybersecurity pros in 2024 - Several new rules and regulations around cybersecurity will be taking effect in 2024, including five state privacy laws. Let's add the word "compliance" to those things certain in life; well, at least in the business world. https://www.scmagazine.com/news/5-cybersecurity-compliance-deadlines-in-2024

By caring about insider threats, CISOs show they care about their coworkers - The 2023 Insider Threat Report from Cybersecurity Insiders found that 74% of organizations are moderately vulnerable to insider threats. https://www.scmagazine.com/perspective/by-caring-about-insider-threats-cisos-show-they-care-about-their-coworkers

CYBERSECURITY ATTACKS, INTRUSIONS, DATA THEFT & LOSS:

Crooks push holiday misery with ‘Leaksmas’ release of 50M PII records - Cybercriminals spilled 50 million stolen consumer records including credit card data and personally identifiable information (PII) in what is being spun by hackers as a 'Free Leaksmas' gift. https://www.scmagazine.com/news/festive-hackers-pilfer-50m-stolen-records

2.7M medical records exposed in double-extortion ransomware attack - A ransomware attack against medical software company ESO Solutions has exposed personal details and healthcare information belonging to 2.7 million U.S. patients. https://www.scmagazine.com/news/eso-solutions-says-2-7m-medical-records-exposed-in-oct-ransomware-attack

Return to the top of the newsletter

WEB SITE COMPLIANCE - We continue covering some of the issues discussed in the "Risk Management Principles for Electronic Banking" published by the Basel Committee on Bank Supervision.
   
   Risk management principles (Part 2 of 2)
   
   The Committee recognizes that banks will need to develop risk management processes appropriate for their individual risk profile, operational structure and corporate governance culture, as well as in conformance with the specific risk management requirements and policies set forth by the bank supervisors in their particular jurisdiction(s). Further, the numerous e-banking risk management practices identified in this Report, while representative of current industry sound practice, should not be considered to be all-inclusive or definitive, since many security controls and other risk management techniques continue to evolve rapidly to keep pace with new technologies and business applications.
   
   This Report does not attempt to dictate specific technical solutions to address particular risks or set technical standards relating to e-banking. Technical issues will need to be addressed on an on-going basis by both banking institutions and various standards-setting bodies as technology evolves. Further, as the industry continues to address e-banking technical issues, including security challenges, a variety of innovative and cost efficient risk management solutions are likely to emerge. These solutions are also likely to address issues related to the fact that banks differ in size, complexity and risk management culture and that jurisdictions differ in their legal and regulatory frameworks.
   
   For these reasons, the Committee does not believe that a "one size fits all" approach to e-banking risk management is appropriate, and it encourages the exchange of good practices and standards to address the additional risk dimensions posed by the e-banking delivery channel. In keeping with this supervisory philosophy, the risk management principles and sound practices identified in this Report are expected to be used as tools by national supervisors and implemented with adaptations to reflect specific national requirements where necessary, to help promote safe and secure e-banking activities and operations.
   
   The Committee recognizes that each bank's risk profile is different and requires a risk mitigation approach appropriate for the scale of the e-banking operations, the materiality of the risks present, and the willingness and ability of the institution to manage these risks. These differences imply that the risk management principles presented in this Report are intended to be flexible enough to be implemented by all relevant institutions across jurisdictions. National supervisors will assess the materiality of the risks related to e-banking activities present at a given bank and whether, and to what extent, the risk management principles for e-banking have been adequately met by the bank's risk management framework.

Return to the top of the newsletter

FFIEC IT SECURITY - We continue our series on the FFIEC interagency Information Security Booklet.  
   
   INFORMATION SECURITY RISK ASSESSMENT
   
   KEY RISK ASSESSMENT PRACTICES (1 of 2)
   
   A risk assessment is the key driver of the information security process. Its effectiveness is directly related to the following key practices:
   
   1)  Multidisciplinary and Knowledge - based Approach - A consensus evaluation of the risks and risk mitigation practices followed by the institution requires the involvement of a broad range of users, with a range of expertise and business knowledge. Not all users may have the same opinion of the severity of various attacks, the importance of various controls, and the importance of various data elements and information system components. Management should apply a sufficient level of expertise to the assessment.
   
   2)  Systematic and Central Control - Defined procedures and central control and coordination help to ensure standardization, consistency, and completeness of risk assessment policies and procedures, as well as coordination in planning and performance. Central control and coordination will also facilitate an organizational view of risks and lessons learned from the risk assessment process.
   
   3)  Integrated Process - A risk assessment provides a foundation for the remainder of the security process by guiding the selection and implementation of security controls and the timing and nature of testing those controls. Testing results, in turn, provide evidence to the risk assessment process that the controls selected and implemented are achieving their intended purpose. Testing can also validate the basis for accepting risks.

Return to the top of the newsletter

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY - We continue the series on the National Institute of Standards and Technology (NIST) Handbook.
 
 11.7 Interdependencies
 
 Since all controls help to prevent contingencies, there is an interdependency with all of the controls in the handbook.
 
 Risk Management provides a tool for analyzing the security costs and benefits of various contingency planning options. In addition, a risk management effort can be used to help identify critical resources needed to support the organization and the likely threat to those resources. It is not necessary, however, to perform a risk assessment prior to contingency planning, since the identification of critical resources can be performed during the contingency planning process itself.
 
 Physical and Environmental Controls help prevent contingencies. Although many of the other controls, such as logical access controls, also prevent contingencies, the major threats that a contingency plan addresses are physical and environmental threats, such as fires, loss of power, plumbing breaks, or natural disasters.
 
 Incident Handling can be viewed as a subset of contingency planning. It is the emergency response capability for various technical threats. Incident handling can also help an organization prevent future incidents.
 
 Support and Operations in most organizations includes the periodic backing up of files. It also includes the prevention and recovery from more common contingencies, such as a disk failure or corrupted data files.
 
 Policy is needed to create and document the organization's approach to contingency planning. The policy should explicitly assign responsibilities.
 
 11.8 Cost Considerations
 
 The cost of developing and implementing contingency planning strategies can be significant, especially if the strategy includes contracts for backup services or duplicate equipment. There are too many options to discuss cost considerations for each type.

 One contingency cost that is often overlooked is the cost of testing a plan. Testing provides many benefits and should be performed, although some of the less expensive methods (such as a review) may be sufficient for less critical resources.