Independent Banker - July 2017 - 66

Nuts & Bolts
that most community banks are doing
" a better job today than several years
ago " in vetting and reviewing their
third-party vendors, there is still
" opportunity for improvement. "
" In some instances, the banks may
have a great [vendor review] program
and process in place to gather documents
from their vendors, but they do
not go beyond the basic SSAE16, " he
says. " They do not address everything
that might be of concern. "
But with so much ground to cover,
Bjorklund and other industry insiders
recommend community banks
focus their limited resources on
vendors providing " critical services
to run their bank, " particularly those
" Whether they can
get at a bank through
identity theft or a thirdparty
relationship, they
are consistently refining
their attacks. "
-THOMAS L. FRALE JR.,
RLR MANAGEMENT CONSULTING INC.
involved in processing and those
with access to sensitive network
information.
" It comes down to banks truly
understanding what is being provided
[by the vendor] and what the bank's
risks are, and having a solid vendor
management program, " Bjorkland
says. He adds that aside from initially
vetting vendors, banks should conduct
annual reviews, looking at key
vendors' risk methodology, security
practices and financial information.
" Community banks need to do a
thorough level of due diligence, " says
Agcaoili, adding that banks should
implement the NIST framework for
understanding risk and look to groups
like the FC-ISAC and the Financial
Services Roundtable. " There is support
in the community. "
Karen Epper Hoffman is a writer in
Washington state.
66 ICBA IndependentBanker July 2017
Three third parties to keep an eye on
For community banks, there are many potential inroads that hackers can
use get to banks' internal operations. These may include:
1
Financial technology firms
Speaking on the potential cybersecurity risk of third-party access, former
OCC comptroller Thomas Curry pointed out, " While fintech companies
are still a small portion of the industry, their rapid growth requires banks
and regulators to ask big-picture questions about the future of banking,
how consumer needs are being met, and whether we have the necessary
regulatory tools and structure to ensure that the changes occur in a
safe and sound manner, promote financial inclusion and avoid consumer
abuse. " In lieu of long-term track records, community banks often must rely
on these vendors' cyber savvy as a main defense of their online security.
Billing software and portals
Every community bank has to remit invoices and therefore is using
software or online technology such as SAP Ariba, which many banks and
other enterprises use for billing and procurement. " Banks need to understand
the structure and segmentation of their network, " says Julie Conroy,
research director for Aite Group.
2
3
Payments providers
Payment systems are " well-protected, but as with anything or anyone,
they are vulnerable, " says PeoplesBank's Joseph Zazzaro. " Zero-day
malware, ransomware and many other hacking-type events are targeting
the end users, and as they say, people are our weakest link and can be
easily fooled. "
Banks should require that risk and vendor assessments be completed,
with scheduled reviews to see if there have been any changes at the
vendor and with its service level. This is especially important for payment
providers, which offer direct access to a bank's most valuable data.
" We have report cards on vendors to see if service issues have occurred
and whether a new vendor should be sought out, " Zazzaro says. " This is not
a new environment for us; [there are] just many more public channels to
utilize services from now, which opens up more vulnerabilities and threats. "
-Karen Epper Hoffman
Independent Banker - July 2017

Table of Contents for the Digital Edition of Independent Banker - July 2017
