President Encourages Companies to Add Educaton to Cyber Security Efforts

Cyber risks are so prevalent these days that in February of 2013, the President issued Executive Order 13636 stating that it “is the policy of the United States to enhance the security and resilience of the nation’s critical infrastructure and to maintain a cyber environment that encourages efficiency, innovation, and economic prosperity while promoting safety, security, business confidentiality, privacy and civil liberties.” In addition, this executive order directed the National Institute of Standards and Technology (NIST) to create a set of standards and best practices to help organizations manage cyber security risks. The first version was released a year later and focuses on five areas: Identify, Protect, Detect, Respond, and Recover.

Coincidently, these are similar to what the FDIC Rules and Regulations, Appendix B, Part 364 discuss. This required each financial institution to develop an information security program intended to modify their traditional information security programs to address emerging cyber risks. All organizations are strongly encouraged to include not only an incident response plan, but also training for employees, and in the case of financial institutions, for members and customers alike.

Cyber security is one of the biggest challenges for companies and financial institutions in particular. This is in part because of the increasing frequency and sophistication of cyber attacks. Trojans are getting more and more difficult to combat. Malware such as the recently reported SlemBunk are now able to adapt to a changed payload based off of the attacker’s parameters and preferences. This makes it virtually impossible to catch using traditional technologies.

Therefore, it is imperative that organizations continually educate employees (identify), create processes and response plans (protect), implement technologies for detection (detect), perform actions in the response plans should they become necessary (respond), and take steps to get everything back in order (recover).

Identifying Risks and Threats with Education

Teaching employees what to watch for is the first step at identifying threats and phishing is the primary way that malware makes its way into any organization or even into individual homes. Typically an email is sent with a link or an attachment. The message will attempt to convince the recipient to perform some type of action, such as clicking the link or opening the attachment. If the email message is authentic enough and either of these actions is performed, additional information is requested. Usually login credentials to some site that has value to the attacker such as for banking sites. They often request credit card details or sensitive information that can be used against the individual or to gain access to the company’s financial information.

Protect by establishing processes and planning for an incident should it be needed

Every organization should set aside time to create an incident response plan (IRP) and cyber security program. These not only establish what technologies will be used to protect the network and systems, but also will put a plan into place for dealing with an incident. The IRP should include, at a minimum, the names and contact information of the team members who will perform the functions in the plan, what roles they will play, how to perform those roles, and a thorough communication plan for employees and customers. This should be updated regularly, but at least annually and don’t forget to change contact information and roles if someone on the team departs the organization.

Put technology into place to detect intrusions

Technologies for detecting cyber attacks has come a long way over the years. There are solutions for every company, regardless of size; software, hardware, services, and combinations of all of them. While they will not detect every issue, they will significantly reduce the effort of detection.

Take action to respond

Should it be necessary to respond to an incident, that IRP created earlier will be a huge help. It spelled out the plan so action could take place when needed. That is why it is created. Better to have it and not need it, than need it and not have it.

2

Once the incident has been managed, it’s time to recover. Get out the backups and start recovering systems. Perform a lesson’s learned on the IRP and take notes on how everyone performed during the crisis. This is time for reflection and to pat yourselves on the back for what went well and make adjustments to what didn’t.

The executive management team, as well as Board of Directors play key roles in overseeing programs that protecting the organization. They should create a corporate culture that is in line with the company’s risk tolerance and should consider cyber risks in the same manner as it does any other business-related risk.