Independent Banker - July 2017 - 65

cloud and the " shallowness of the talent
pool " in cybersecurity expertise.
" There is no 'cloud'; it's just someone
else's computer, " Olson points out.
" When you look at community banks
and their back-end operators ... even
if they haven't been hit already, they
have a big bullseye on their backs. "
Phil Agcaoili, chief information
security offi cer for Elavon, a global
provider of payment processing solutions
and a subsidary of U.S. Bancorp,
likens this particular cybersecurity
risk to public health concerns. " If
there's a weak person, or a weak organization,
any weak link in the chain,
that is where concerns will strike and
spread, " he says.
All banks at risk
This uptick in third-party risk is
not specifi c to community banks; it
concerns all banks, according to Joan
McGowan, senior industry analyst
for consultancy Celent. " This is forcing
banks to treat all third parties as
they would treat their own [internal]
operational risk, " she says. " To consider
human resource management,
resilience, risk activity levels and
metrics, insurance coverage, technology
infrastructure and operational
adequacy of subcontractors, all this is
up for question now. "
Joseph Zazzaro, senior vice president
and chief information offi cer
for the $2 billion-asset PeoplesBank
of Holyoke, Mass., points out, " With
so many partnerships with hosted
solutions now becoming the normal
operating environment for banks, we
have to rely on outside audits, SOC
[security operations center] reports
and other information to help ensure
that these third-party vendors are
doing their due diligence when offering
services. "
PeoplesBank requires SOC and/
or SSAE16 (auditing standards for
service organizations developed by
the American Institute of Certifi ed
Public Accountants), reports on every
third-party vendor. " They provide the
details of their best practices, including
background checks and facility
access, " Zazzaro says. " One of the best
things you can do is visit a vendor site
and see for yourself. "
In December 2016, Thomas
Curry, then head of the OCC, not
only named cybersecurity as the
single greatest systemic threat to our
fi nancial system; he also cited the
tremendous growth of fi ntech companies
as a major strategic risk.
It's clearly not an issue that can be
swept under the carpet. But what are
community banks, short on resources
and staff, to do?
Wes Bjorklund, senior director
at Cornerstone Advisors, says
community banks should focus on
vetting and reviewing vendors that
have " non-escorted or unsupervised
access " to their facilities, as well as
those third parties that have network
access to a bank's computer systems.
" That's where you have to rely on a
variety of safeguards and controls, "
he says. While Bjorklund maintains
The party's over
Four major third-party data breaches
Who: Target
When: November-December 2013
What: 40 million customer payment
details
How: Hackers infi ltrated Target's
data systems through its HVAC
contractor.
What happened next? Target
agreed to various settlements
with card issuers, banks and
customers, which cost it more
than $148 million in damages.
Target stock prices took a hit,
customers became skeptical of
the retail giant's security and the
CEO stepped down in 2014. In 2015,
Target invested in chip-and-PIN
terminals and chip cards for all
REDcard customers.
Who: Wendy's
When: October 2015
What: Customer payment details
at 1,025 locations
How: Malware compromised the
fast-food chain's third-party pointof-sale
providers.
What happened next? Wendy's
faced class-action lawsuits due
to its " inadequate approach to
data security, " and its stock price
tumbled in 2016.
Who: U.S. Bancorp
When: May 2016
What: Sensitive employee
information
How: Fraudsters compromised U.S.
Bank's payroll provider, ADP.
What happened next? The ADP
breach aff ected a dozen other
companies, and its shares dropped.
About 2 percent of U.S. Bank
employees were aff ected, and a
class-action lawsuit for tax fraud
was fi led against ADP.
Who: Netfl ix
When: April 2017
What: Hackers claim to have stolen
unaired episodes of Orange is the
New Black.
How: System breach of postproduction
company Larson Studio.
What happened next? The hackers
threatened to release the show
before its release date unless a
ransom was paid. An FBI investigation
is underway.
-Sara Schlueter
independentbanker.org
ICBA IndependentBanker 65
http://www.qmags.com/clickthrough.asp?url=www.independentbanker.org&id=20303&adid=P65E1
Independent Banker - July 2017

Table of Contents for the Digital Edition of Independent Banker - July 2017
