|
July 5, 2020
Please stay safe - We will recover.
|
Does Your Financial Institution need an
affordable cybersecurity Internet security audit? Yennik, Inc.
has clients in 42 states that rely on our cybersecurity audits
to ensure proper Internet security settings and
to
meet the independent diagnostic test requirements of
FDIC, OCC, FRB, and NCUA, which provides compliance with
Gramm-Leach Bliley Act 501(b)
as well as the penetration
test complies with the FFIEC Cybersecurity Assessment Tool
regarding resilience testing.
The cybersecurity penetration audit and Internet security testing
is an affordable-sophisticated process than goes far beyond the
simple scanning of ports. The audit
focuses on
a hacker's perspective, which will help
you identify real-world cybersecurity weaknesses.
For more information, give R. Kinney Williams a call today at
Office/Cell 806-535-8300 or visit
http://www.internetbankingaudits.com/. |
Virtual/remote IT
audits
-
As a result of the crisis and to help protect your staff, I am performing
virtual/remote FFIEC IT audits
for banks and credit unions. I am a
former bank examiner with years
of IT auditing experience.
Please contact R. Kinney Williams at
examiner@yennik.com from your bank's email and I will send you information
and fees. All correspondence is
confidential.
FYI
- IT Security Questions to Ask for the Great Return to the Workplace
- With all the talk about “turning the economy back on” we need to
think about what that looks like from an information security
perspective. Whether it’s this summer or after the first of the new
year, at some point, computers that have been in home offices will
return to the workplace. Security pros will have a lot to think
about and now it’s time to do some early planning.
https://www.scmagazine.com/home/opinion/executive-insight/it-security-questions-to-ask-for-the-great-return-to-the-workplace/
Dem bill would ban federal law enforcement from using facial
recognition technology - Democrats in the House and Senate today
introduced legislation banning federal law enforcement from using
facial recognition technology.
https://www.scmagazine.com/home/security-news/dem-bill-would-ban-federal-law-enforcement-from-using-facial-recognition-technology/
New Bill Targeting ‘Warrant-Proof’ Encryption Draws Ire - The Lawful
Access to Encrypted Data Act is being decried as “an awful idea” by
security experts. Privacy advocates are decrying a new bill, which
would force tech companies to unlock encrypted devices if ordered to
do so by law enforcement with a court issued warrant.
https://threatpost.com/new-bill-targeting-warrant-proof-encryption-draws-ire/156877/
Union Pacific tracks cyber risk via its own probability modeling
methodology - The Assistant VP and CISO at Union Pacific Railroad,
detailed at InfoSec World 2020 how the transportation giant
incorporates cybersecurity risk into its larger enterprise risk
management process in order to help senior executives estimate
losses caused by potential cyber incidents and make better decisions
on where to invest in defenses.
https://www.scmagazine.com/infosec-world-2020/union-pacific-tracks-cyber-risk-via-its-own-probability-modeling-methodology/
This training tool could be the answer to stop mass cyberattacks -
At air bases across Europe, networks are under attack. Malicious
hackers have gained access to sensitive systems, information,
controls and critical infrastructure. But cyber operators from U.S.
Cyber Command, in concert with Five Eyes partners, have been called
in to thwart these attempts in real time.
https://www.c4isrnet.com/dod/cybercom/2020/06/25/this-training-tool-could-be-the-answer-to-stop-mass-cyberattacks/
ATTACKS, INTRUSIONS, DATA THEFT & LOSS
FYI
- Frost & Sullivan employee, customer data for sale on dark web - A
group is hawking records of more than 12,000 Frost & Sullivan’s
employees and customers on a hacker folder.
https://www.scmagazine.com/home/security-news/database-security/frost-sullivan-employee-customer-data-for-sale-on-dark-web/
Lion gets breweries up and running following ransomware attack - But
the beverage giant cannot confirm that data won't eventually make
its way out into the wild, despite not finding any evidence of it
being removed.
https://www.zdnet.com/article/lion-gets-breweries-up-and-running-following-ransomware-attack/
LG Electronics allegedly hit by Maze ransomware attack - Maze
ransomware operators have claimed on their website that they
breached and locked the network of the South Korean multinational LG
Electronics.
https://www.bleepingcomputer.com/news/security/lg-electronics-allegedly-hit-by-maze-ransomware-attack/
UCSF paid $1.4 million ransom in NetWalker attack - The University
of California, San Francisco (UCSF) ponied up $1.4 million to
hackers to retrieve data encrypted during a NetWalker ransomware
attack disclosed in early June.
https://www.scmagazine.com/home/security-news/ucsf-paid-1-4-million-ransom-in-netwalker-attack/
University of California San Francisco pays ransomware gang $1.14m
as BBC publishes 'dark web negotiations' - Publicity-hungry crims
find new way of pressuring victims - A California university which
is dedicated solely to public health research has paid a $1.14m
ransom to a criminal gang in the hopes of regaining access to its
data.
https://www.theregister.com/2020/06/29/ucsf_1_14m_dollar_ransom_paid_netwalker/
Eight cities using Click2Gov targeted in Magecart skimming attacks -
Since April 10, eight cities in three states using the Click2Gov
web-based platform to collect payments for services have been hit
with Magecart card-skimming attacks that still appear active.
https://www.scmagazine.com/home/security-news/eight-cities-using-click2gov-targeted-in-magecart-skimming-attacks/
Chinese bank forced western companies to install malware-laced tax
software - GoldenSpy backdoor trojan found in a Chinese bank's
official tax software, which the bank has been forcing western
companies to install.
https://www.zdnet.com/article/chinese-bank-forced-western-companies-to-install-malware-laced-tax-software/
Xerox apparent victim of Maze attack - It appears that Xerox is
among the victims of Maze ransomware attackers, if screenshots
posted by the ransomware’s operators are legitimate.
https://www.scmagazine.com/home/security-news/ransomware/xerox-apparent-victim-of-maze-attack/
Return to the top
of the newsletter
WEB SITE COMPLIANCE -
We continue our review of the
FFIEC interagency statement on "Weblinking:
Identifying Risks and Risk Management Techniques."
(Part 4 of 10)
A. RISK DISCUSSION
Reputation Risk
Trade Names
If the third party has a name similar to that of the
financial institution, there is an increased likelihood of confusion
for the customer and increased exposure to reputation risk for the
financial institution. For example, if customers access a similarly
named broker from the financial institution's website, they may
believe that the financial institution is providing the brokerage
service or that the broker's products are federally insured.
Website Appearance
The use of frame technology and other similar technologies
may confuse customers about which products and services the
financial institution provides and which products and services third
parties, including affiliates, provide. If frames are used, when
customers link to a third-party website through the
institution-provided link, the third-party webpages open within the
institution's master webpage frame. For example, if a financial
institution provides links to a discount broker and the discount
broker's webpage opens within the institution's frame, the
appearance of the financial institution's logo on the frame may give
the impression that the financial institution is providing the
brokerage service or that the two entities are affiliated. Customers
may believe that their funds are federally insured, creating
potential reputation risk to the financial institution in the event
the brokerage service should fail or the product loses value.
Compliance Risk
The compliance risk to an institution linking to a
third-party's website depends on several factors. These factors
include the nature of the products and services provided on the
third-party's website, and the nature of the institution's business
relationship with the third party. This is particularly true with
respect to compensation arrangements for links. For example, a
financial institution that receives payment for offering
advertisement-related weblinks to a settlement service provider's
website should carefully consider the prohibition against kickbacks,
unearned fees, and compensated referrals under the Real Estate
Settlement Procedures Act (RESPA).
The financial institution has compliance risk as well as
reputation risk if linked third parties offer less security and
privacy protection than the financial institution. Third-party sites
may have less secure encryption policies, or less stringent policies
regarding the use and security of their customer's information. The
customer may be comfortable with the financial institution's
policies for privacy and security, but not with those of the linked
third party. If the third-party's policies and procedures create
security weaknesses or apply privacy standards that permit the third
party to release confidential customer information, customers may
blame the financial institution.
Return to
the top of the newsletter
FFIEC IT SECURITY -
We continue our coverage of
the FDIC's "Guidance
on Managing Risks Associated With Wireless Networks and Wireless
Customer Access."
Using "Wired Equivalent Privacy" (WEP) by itself to provide
wireless network security may lead a financial institution to a
false sense of security. Information traveling over the network
appears secure because it is encrypted. This appearance of security,
however, can be defeated in a relatively short time.
Through these types of attacks, unauthorized personnel could gain
access to the financial institution's data and systems. For example,
an attacker with a laptop computer and a wireless network card could
eavesdrop on the bank's network, obtain private customer
information, obtain access to bank systems and initiate unauthorized
transactions against customer accounts.
Another risk in implementing wireless networks is the potential
disruption of wireless service caused by radio transmissions of
other devices. For example, the frequency range used for 802.11b
equipment is also shared by microwave ovens, cordless phones and
other radio-wave-emitting equipment that can potentially interfere
with transmissions and lower network performance. Also, as wireless
workstations are added within a relatively small area, they will
begin to compete with each other for wireless bandwidth, decreasing
the overall performance of the wireless network.
Risk Mitigation Components -- Wireless Internal Networks
A key step in mitigating security risks related to the use of
wireless technologies is to create policies, standards and
procedures that establish minimum levels of security. Financial
institutions should adopt standards that require end-to-end
encryption for wireless communications based on proven encryption
methods. Also, as wireless technologies evolve, new security and
control weaknesses will likely be identified in the wireless
software and security protocols. Financial institutions should
actively monitor security alert organizations for notices related to
their wireless network devices.
For wireless internal networks, financial institutions should
adopt standards that require strong encryption of the data stream
through technologies such as the IP Security Protocol (IPSEC). These
methods effectively establish a virtual private network between the
wireless workstation and other components of the network. Even
though the underlying WEP encryption may be broken, an attacker
would be faced with having to defeat an industry-proven security
standard.
Financial institutions should also consider the proximity of their
wireless networks to publicly available places. A wireless network
that does not extend beyond the confines of the financial
institution's office space carries with it far less risk than one
that extends into neighboring buildings. Before bringing a wireless
network online, the financial institution should perform a limited
pilot to test the effective range of the wireless network and
consider positioning devices in places where they will not broadcast
beyond the office space. The institution should also be mindful that
each workstation with a wireless card is a transmitter. Confidential
customer information may be obtained by listening in on the
workstation side of the conversation, even though the listener may
be out of range of the access device.
The financial institution should consider having regular
independent security testing performed on its wireless network
environment. Specific testing goals would include the verification
of appropriate security settings, the effectiveness of the wireless
security implementation and the identification of rogue wireless
devices that do not conform to the institution's stated standards.
The security testing should be performed by an organization that is
technically qualified to perform wireless testing and demonstrates
appropriate ethical behavior.
Return to the top of
the newsletter
NATIONAL INSTITUTE OF STANDARDS
AND TECHNOLOGY -
We continue
the series on the National Institute of Standards and Technology
(NIST) Handbook.
Chapter 6 - COMPUTER SECURITY PROGRAM MANAGEMENT
6.6 Central and System-Level Program Interactions
A system-level program that is not integrated into the
organizational program may have difficulty influencing significant
areas affecting security. The system-level computer security program
implements the policies, guidance, and regulations of the central
computer security program. The system-level office also learns from
the information disseminated by the central program and uses the
experience and expertise of the entire organization. The
system-level computer security program further distributes
information to systems management as appropriate.
Communications, however, should not be just one way. System-level
computer security programs inform the central office about their
needs, problems, incidents, and solutions. Analyzing this
information allows the central computer security program to
represent the various systems to the organization's management and
to external agencies and advocate programs and policies beneficial
to the security of all the systems.
6.7 Interdependencies
The general purpose of the computer security program, to improve
security, causes it to overlap with other organizational operations
as well as the other security controls discussed in the handbook.
The central or system computer security program will address most
controls at the policy, procedural, or operational level.
Policy. Policy is issued to establish the computer security
program. The central computer security program(s) normally produces
policy (and supporting procedures and guidelines) concerning general
and organizational security issues and often issue-specific policy.
However, the system-level computer security program normally
produces policy for that system. Chapter 5 provides additional
guidance.
Life Cycle Management. The process of securing a system
over its life cycle is the role of the system-level computer
security program. Chapter 8 addresses these issues.
Independent Audit. The independent audit function should
complement a central computer security program's compliance
functions.
6.8 Cost Considerations
This chapter discussed how an organization wide computer security
program can manage security resources, including financial
resources, more effectively. The cost considerations for a
system-level computer security program are more closely aligned with
the overall cost savings in having security.
The most significant direct cost of a computer security program is
personnel. In addition, many programs make frequent and effective
use of consultants and contractors. A program also needs funds for
training and for travel, oversight, information collection and
dissemination, and meetings with personnel at other levels of
computer security management. |
PLEASE NOTE: Some of the above links may have expired,
especially those from news organizations. We may have a copy of the
article, so please e-mail us at
examiner@yennik.com if we can be of assistance. |
