|
July 25, 2021
|
Does Your Financial Institution need an
affordable cybersecurity Internet security audit? Yennik, Inc.
has clients in 42 states that rely on our cybersecurity audits
to ensure proper Internet security settings and
to
meet the independent diagnostic test requirements of
FDIC, OCC, FRB, and NCUA, which provides compliance with
Gramm-Leach Bliley Act 501(b)
as well as the penetration
test complies with the FFIEC Cybersecurity Assessment Tool
regarding resilience testing.
The cybersecurity penetration audit and Internet security testing
is an affordable-sophisticated process than goes far beyond the
simple scanning of ports. The audit
focuses on
a hacker's perspective, which will help
you identify real-world cybersecurity weaknesses.
For more information, give R. Kinney Williams a call today at
Office/Cell 806-535-8300 or visit
http://www.internetbankingaudits.com/. |
Virtual/remote IT audits
- I am performing
virtual/remote FFIEC IT
audits for banks and credit unions.
I am a former
bank examiner with 40 years of IT auditing experience.
Please contact R. Kinney Williams at
examiner@yennik.com from your bank's email and I will send you
information and fees. All correspondence is
confidential.FYI - Two cyber insurance industry
initiatives grapple with rise of ransomware - Twice in the past few
weeks, insurers have joined together in response to the spiraling
ransomware attacks that have rocked their industry.
https://www.cyberscoop.com/cyberacuview-apcia-cyber-insurance-ransomware/
FYI - US government launches plans to cut cybercriminals off
from cryptocurrency - The White House on Thursday announced a flurry
of actions launched by a new interagency task force to combat
ransomware.
https://www.cyberscoop.com/us-government-crypocurrency-ransomware-criminals-treasury-state-reward/
CISA orders federal agencies to patch Windows PrintNightmare bug - A
new emergency directive issued by the Cybersecurity and
Infrastructure Security Agency (CISA) orders federal agencies to
mitigate the actively exploited Window Print Spooler vulnerability
on their networks.
https://www.bleepingcomputer.com/news/security/cisa-orders-federal-agencies-to-patch-windows-printnightmare-bug/
Cybersecurity risk: The number of employees going around IT security
may surprise you - The findings detail a complex security balancing
act between IT teams and users; especially in the age of remote work
and virtual collaboration at scale.
https://www.techrepublic.com/article/cybersecurity-risk-the-number-of-employees-going-around-it-security-may-surprise-you/
Pittsburgh medical center to pay $2.65M in settlement for 2014 data
breach - The University of Pittsburgh Medical Center has agreed to a
$2.65 million settlement with the 66,000 employees impacted by the
theft of data from its human resource database in 2014.
https://www.scmagazine.com/news/backup-and-recovery/pittsburgh-medical-center-to-pay-2-65m-in-settlement-for-2014-data-breach
ATTACKS, INTRUSIONS, DATA THEFT & LOSS
FYI - Summer of SAM - incorrect permissions on Windows 10/11
hives - If you opened Twitter today you were probably flooded with
news about the latest security issue with Windows. For those that
have ISC as their home page (yay!) the issue is the following:
apparently starting with Windows 10 1809 (hey, that’s a version from
2018) Microsoft messed up permissions on the SAM and SYSTEM hives
which became readable for any user on the system.
https://isc.sans.edu/forums/diary/Summer+of+SAM+incorrect+permissions+on+Windows+1011+hives/27652/
Law firm for Ford, Boeing, Exxon, Marriott, Walgreens, and more
hacked in ransomware attack - The law firm said attackers may have
accessed Social Security numbers, passport numbers, payment card
information, medical information and biometric data.
https://www.zdnet.com/article/law-firm-for-ford-boeing-exxon-marriott-walgreens-and-more-hacked-in-ransomware-attack/
Cyberattack on Moldova's Court of Accounts destroyed public audits -
Moldova's "Court of Accounts" has suffered a cyberattack leading to
the agency's public databases and audits being destroyed.
https://www.bleepingcomputer.com/news/security/cyberattack-on-moldovas-court-of-accounts-destroyed-public-audits/
Return to the top
of the newsletter
WEB SITE COMPLIANCE -
Over the next few
weeks, we will cover some of the issues discussed in the "Risk
Management Principles for Electronic Banking" published by the Basel
Committee on Bank Supervision.
Executive Summary
Continuing technological innovation and competition among
existing banking organizations and new entrants have allowed for a
much wider array of banking products and services to become
accessible and delivered to retail and wholesale customers through
an electronic distribution channel collectively referred to as
e-banking. However, the rapid development of e-banking capabilities
carries risks as well as benefits.
The Basel Committee on Banking Supervision expects such risks to
be recognized, addressed and managed by banking institutions in a
prudent manner according to the fundamental characteristics and
challenges of e-banking services. These characteristics include the
unprecedented speed of change related to technological and customer
service innovation, the ubiquitous and global nature of open
electronic networks, the integration of e-banking applications with
legacy computer systems and the increasing dependence of banks on
third parties that provide the necessary information technology.
While not creating inherently new risks, the Committee noted that
these characteristics increased and modified some of the traditional
risks associated with banking activities, in particular strategic,
operational, legal and reputational risks, thereby influencing the
overall risk profile of banking.
Based on these conclusions, the Committee considers that while
existing risk management principles remain applicable to e-banking
activities, such principles must be tailored, adapted and, in some
cases, expanded to address the specific risk management challenges
created by the characteristics of e-banking activities. To this end,
the Committee believes that it is incumbent upon the Boards of
Directors and banks' senior management to take steps to ensure that
their institutions have reviewed and modified where necessary their
existing risk management policies and processes to cover their
current or planned e-banking activities. The Committee also believes
that the integration of e-banking applications with legacy systems
implies an integrated risk management approach for all banking
activities of a banking institution.
Return to
the top of the newsletter
FFIEC IT SECURITY -
We continue our series on the FFIEC
interagency Information Security Booklet.
SECURITY
CONTROLS - IMPLEMENTATION
LOGICAL AND ADMINISTRATIVE ACCESS CONTROL
Access Rights Administration (3 of 5)
The enrollment process establishes the user's
identity and anticipated business needs to information and systems.
New employees, IT outsourcing relationships, and contractors may
also be identified, and the business need for access determined
during the hiring or contracting process.
During enrollment and thereafter, an authorization process
determines user access rights. In certain circumstances the
assignment of access rights may be performed only after the manager
responsible for each accessed resource approves the assignment and
documents the approval. In other circumstances, the assignment of
rights may be established by the employee's role or group
membership, and managed by pre - established authorizations for that
group. Customers, on the other hand, may be granted access based on
their relationship with the institution.
Authorization for privileged access should be tightly controlled.
Privileged access refers to the ability to override system or
application controls. Good practices for controlling privileged
access include
! Identifying each privilege associated with each system
component,
! Implementing a process to allocate privileges and allocating
those privileges either on a need - to - use or an event - by -
event basis,! Documenting the granting and administrative limits on
privileges,
! Finding alternate ways of achieving the business objectives,
! Assigning privileges to a unique user ID apart from the one
used for normal business use,
! Logging and auditing the use of privileged access,
! Reviewing privileged access rights at appropriate intervals and
regularly reviewing privilege access allocations, and
! Prohibiting shared privileged access by multiple users.
Return to the top of the newsletter
NATIONAL INSTITUTE OF STANDARDS
AND TECHNOLOGY -
We continue
the series on the National Institute of Standards and Technology
(NIST) Handbook.
Chapter 15 - PHYSICAL AND ENVIRONMENTAL SECURITY
15.7 Mobile and Portable Systems
The analysis and management of risk usually has to be modified if a
system is installed in a vehicle or is portable, such as a laptop
computer. The system in a vehicle will share the risks of the
vehicle, including accidents and theft, as well as regional and
local risks.
Portable and mobile share an increased risk of theft and physical
damage. In addition , portable systems can be "misplaced" or left
unattended by careless users. Secure storage of laptop computers is
often required when they are not in use.
If a mobile or portable system uses particularly valuable or
important data, it may be appropriate to either store its data on a
medium that can be removed from the system when it is unattended or
to encrypt the data. In any case, the issue of how custody of mobile
and portable computers are to be controlled should be addressed.
Depending on the sensitivity of the system and its application, it
may be appropriate to require briefings of users and signed briefing
acknowledgments.
Encryption of data files on stored media may also be a
cost-effective precaution against disclosure of confidential
information if a laptop computer is lost or stolen.
15.8 Approach to Implementation
Like other security measures, physical and environmental security
controls are selected because they are cost-beneficial. This does
not mean that a user must conduct a detailed cost-benefit analysis
for the selection of every control. There are four general ways to
justify the selection of controls:
1) They are required by law or regulation. Fire exit doors
with panic bars and exit lights are examples of security measures
required by law or regulation. Presumably, the regulatory authority
has considered the costs and benefits and has determined that it is
in the public interest to require the security measure. A lawfully
conducted organization has no option but to implement all required
security measures.
2) The cost is insignificant, but the benefit is material. A
good example of this is a facility with a key-locked low-traffic
door to a restricted access. The cost of keeping the door locked is
minimal, but there is a significant benefit. Once a significant
benefit/minimal cost security measure has been identified, no
further analysis is required to justify its implementation.
3) The security measure addresses a potentially "fatal" security
exposure but has a reasonable cost. Backing up system software
and data is an example of this justification . For most systems, the
cost of making regular backup copies is modest (compared to the
costs of operating the system), the organization would not be able
to function if the stored data were lost, and the cost impact of the
failure would be material. In such cases, it would not be necessary
to develop any further cost justification for the backup of software
and data. However, this justification depends on what constitutes a
modest cost, and it does not identify the optimum backup schedule.
Broadly speaking, a cost that does not require budgeting of
additional funds would qualify.
4) The security measure is estimated to be cost-beneficial.
If the cost of a potential security measure is significant, and it
cannot be justified by any of the first three reasons listed above,
then its cost (both implementation and ongoing operation) and its
benefit (reduction in future expected losses) need to be analyzed to
determine if it is cost-beneficial. In this context, cost-beneficial
means that the reduction in expected loss is significantly greater
than the cost of implementing the security measure.
Arriving at the fourth justification requires a detailed analysis.
Simple rules of thumb do not apply. Consider, for example, the
threat of electric power failure and the security measures that can
protect against such an event. The threat parameters, rate of
occurrence, and range of outage durations depend on the location of
the system, the details of its connection to the local electric
power utility, the details of the internal power distribution
system, and the character of other activities in the building that
use electric power. The system's potential losses from service
interruption depends on the details of the functions it performs.
Two systems that are otherwise identical can support functions that
have quite different degrees of urgency. Thus, two systems may have
the same electric power failure threat and vulnerability parameters,
yet entirely different loss potential parameters.
Furthermore, a number of different security measures are available
to address electric power failures. These measures differ in both
cost and performance. For example, the cost of an uninterruptible
power supply (UPS) depends on the size of the electric load it can
support, the number of minutes it can support the load, and the
speed with which it assumes the load when the primary power source
fails. An on-site power generator could also be installed either in
place of a UPS (accepting the fact that a power failure will cause a
brief service interruption) or in order to provide long-term backup
to a UPS system. Design decisions include the magnitude of the load
the generator will support, the size of the on-site fuel supply, and
the details of the facilities to switch the load from the primary
source or the UPS to the on-site generator.
This example shows systems with a wide range of risks and a wide
range of available security measures (including, of course, no
action), each with its own cost factors and performance parameters. |
PLEASE NOTE: Some of the above links may have expired,
especially those from news organizations. We may have a copy of the
article, so please e-mail us at
examiner@yennik.com if we can be of assistance. |
