Independent Banker - August 2018 - 35

Next: How to deal with offsite compliance
cybersecurity incidents, " says Mark Weatherford, senior vice
president and chief cybersecurity strategist for vArmour, and
former deputy undersecretary for cybersecurity at the Department
of Homeland Security. " People are typically helpful by
nature, and in a service industry like finance, it is essential and
necessary. This is what makes community banking employees
susceptible to social engineering. "
Phishing specifically, and social engineering more broadly,
allows attackers to assume trusted insider positions. Weatherford
points out that this can give them access to everything
those trusted insiders have available to them. This is what often
results in cyber-enabled financial fraud. " While JP Morgan
Chase & Co. can afford to spend $500 million each year on
cybersecurity-related activities, including continuous employee
training and security tools used to protect employees from
themselves, " Weatherford says, " most community banks can't
expect to even get near that percentage of funding. "
Further exacerbating the issue of insider threat is the
ever-increasing concentration of computer power and network
access provided to so-called privileged users-people
within a company who have been given special powers within
that company's network. When asked who posed the biggest
internal threat to corporate data, 55 percent of respondents
to the 2015 Vormetric Insider Threat Report identified privileged
users, followed by contractors, service providers and
business partners. Traditionally, network defense focused
outward, reacting to potential hacks and breaches coming
from parties outside the firewall. Today, the focus is broader.
Privileged users
With this in mind, it's not surprising that less than one-third
of IT security pros feel confident about identifying insider
threats, with third-party and employee access their biggest
concerns, according to a report by Atlanta-based identity and
access management firm Bomgar. Also, a full three-quarters
of respondents to Bomgar's Privileged Access Threat Report
2018 have seen the number of vendors with access to their
networks increase in the past year, and 33 percent believe they
spend too little time monitoring third-party vendor access.
It is not necessarily the malicious employees who are
doing the most harm. Research from Forrester shows that
the greatest volume of security breaches (36 percent) comes
from employees simply inadvertently misusing data.
" Community banks tend to distinguish themselves from
large banks as closer to customers, and more friendly, which
can be a bit at odds with security protocols, " says Seth P.
Berman, a partner and leader of the privacy and data security
practice group at Nutter McClennen & Fish LLP.
In 2015, 60 percent of breaches came through insiders,
according to IBM. And that issue has only grown more prevalent.
The EY Global Banking Outlook 2018 reports roughly nine out
of 10 (89 percent) banks rank enhancing data security as a top
priority for 2018. Oleg Kolesnikov, director of cybersecurity
and threat research at Securonix, believes that in light of the
recent series of banking compromises-including Moneytaker,
Lazarus and others-insiders represent a " significant risk. "
Kolesnikov points to the $1.8 billion Society for Worldwide
Interbank Financial Telecommunications (SWIFT)
compromise at Punjab National Bank (PNB). In February
2018, two bank employees-a loan manager with a young
" People are typically helpful
by nature, and in a services
industry like finance,
[cybersecurity] is essential
and necessary. "
-Mark Weatherford, vArmour
subordinate-colluded with a loan recipient and misused
their access to SWIFT to send more than 150 fraudulent
letters of undertaking over a period of more than a year,
exploiting a loophole in the internal controls (CBS) to avoid
detection. (Based on publicly available details, there was no
automated monitoring or security analytics in place. A lack of
integration between SWIFT and CBS logs meant employees
were required to manually log activity, effectively watching
over themselves.) The activity went undetected for a significant
period of time, and no Suspicious Transaction Report
(STR) of First Information Report (FIR) was filed until nearly
$2 billion was stolen.
" The risk from employees is very serious and very high
regardless of the size of the bank, " says Sean Feeney, CEO of
DefenseStorm. He adds that big money center banks " have
thousands of people focused on cybersecurity and cyber fraud; a
community bank cannot match that. " When it comes to threats
from employees, the issue is particularly pronounced-70
percent of audits and investments show businesses have
deficiencies in monitoring insider threat, and three-quarters
(75 percent) of all insider threats go unnoticed, according to
research from SANS.
Karen Epper Hoffman is a writer in Washington state.
independentbanker.org Q 35
http://www.independentbanker.org
Independent Banker - August 2018

Table of Contents for the Digital Edition of Independent Banker - August 2018
