Independent Banker - December 2017 - 73

or if social security numbers and
dates of birth are separate. " When
this type of information is released,
we often see an influx of phishing
and spoofing attacks, generally by
email, aimed at bank employees and
individuals, " says Dalpiaz.
Criminals may also call banks
and walk into branches attempting
to impersonate accountholders.
For example, one might approach
a teller with an urgent story about
a false emergency she is having on
vacation and request a wire transfer.
For this reason, it's not just customers
who need to monitor their
accounts for fraud; bank employees
should also be trained to recognize
suspicious activity and take the
appropriate actions.
Proactive vendors will have
audits they can present to the bank
to show they have appropriate security
protocols in place.
4
3
Vet your vendors
Community banks that
rely on third-party
vendors to handle back-office operations
may want to consider asking
many security questions during the
due-diligence process. Dalpiaz says
banks may want to know how vendors
secure their data, their process
for alerting the bank of a security
incident, and if subcontractors have
access to the bank's data. Banks may
also want to ask vendors if they can
share recent audit results.
Educate customers
Through a community
bank's website, social
media accounts or interviews with
local print and television media,
banks can arm customers with
helpful tools for protecting their
identities before and after a breach.
For example, ICBA has a customer
notification letter template at
icba.org that member banks can
customize with links advising customers
how to put a credit freeze in
place, obtain their credit report or
report identity theft.
Banks can also offer solid advice
to customers based on consumer
data protection tips from ICBA or
the National Cyber Security Alliance
(staysafeonline.org/ncsam).
Education must be an ongoing
activity among bank employees
and customers. " It's incumbent on
management to create a culture of
security that goes across all business
lines and all levels of staff, "
Dalpiaz says.
Susan Thomas Springer is a writer
in Oregon.
Banks may want to know how vendors secure
their data, their process for alerting the bank of
a security incident, and if subcontractors have
access to the bank's data.
Tools for
outsmarting
new threats
To stay up to date on the
ever-changing tactics of cybercriminals,
your bank can become
a member of the Financial
Services Information Sharing and
Analysis Center (FS-ISAC). The
organization gathers intelligence
from banks across the country,
removes identifying details and
then sends it to FS-ISAC membership.
The goal is real-time
intelligence sharing so banks are
aware of current threats. Reports
detail the tactics, techniques and
procedures, called TTPs, of criminal
actors, along with mitigation
tools and techniques available to
fix technical vulnerabilities. FSISAC
also offers the Community
Institution Council, called a circle
of trust, in which community
banks and credit unions ask
security questions and share
useful information with each
other. Learn more at fsisac.com.
ICBA's Data Breach Information
Center also offers members
current cyberthreat information.
See the latest at icba.org.
_______
independentbanker.org
ICBA Independent Banker 69
http://www.icba.org http://www.staysafeonline.org/ncsam http://www.fsisac.com http://www.icba.org http://www.independentbanker.org
Independent Banker - December 2017

Table of Contents for the Digital Edition of Independent Banker - December 2017
