Sign Ohio Banking Agreement Secure

Industry sign banking arkansas contract secure

FIS and Bank director partnered together on the 2016 risk practices survey with the goal to uncover what is top of mind for Bank boards CEOs and other senior executives I'd like to share with you what is top of mind and the best practices uncovered in the survey that you can immediately implement for results the survey identified overwhelmingly that cyber security is the most critical risk challenge 18% reported that their bank had experienced data breach however due to the advanced and persistent threats that banks are under today there really are two kinds of institutions those that know they have an intrusion and data breach and those that have one but have not yet discovered it so how can the board tackle the number one threat facing banks today cyber risk and what are the best practices that deliver maximum value the survey uncovered five risk best practices that your bank should implement right away first assign cybersecurity oversight responsibilities either to the entire board or to the risk committee if you do not have a risk committee assign oversight to the Audit Committee make sure there is a cybersecurity expert on the board or on the risk or Audit Committee be sure to add the duty to the written charter second review cyber security at every board meeting even if the risk Audit Committee has oversight over cyber security while cybersecurity is the top concern 66 percent of respondents still do not yet review cybersecurity at every board meeting there is room for improvement here the stakes are very high cybersecurity is not an IT issue it's a board issue it must be reviewed thoroughly at every board meeting to ensure that cyber risk is being mitigated effectively and promptly also make sure there is a risk dashboard with key risk indicators for cyber risk that are leading not lagging indicators that is reviewed at every board meeting third complete a cybersecurity assessment using the new FFIEC cybersecurity assessment tool this is a must several states are mandating that banks use the tool and complete the assessment the federal banking agencies have already examiner's to start to ask to see the assessment in examinations and if banks don't have one the examiners are required to complete it to assess cyber risk at the bank surely you do not want the examiner to complete one do you it will not be a pretty picture and you will be caught by surprise and risk criticism and possible enforcement action so you have to get it done and done right forth speaking of getting the cybersecurity assessment done right many institutions don't make effective use of the results only 61% have implemented a plan to address weaknesses and attain target levels only 48 percent have implemented a sustainable plan to keep the assessment updated only 39% have independently validated their results only 18% have established board approved triggers for updating the assessment and more reporting so there's more work to do with the new cybersecurity assessment and must be a board priority fifth the FFIEC cybersecurity assessment tool prompts banks to evaluate their ability to detect anomalous activity approach cybersecurity with the guiding principle that it is not a question of if but when the attacker will successfully break into your network is impossible to prevent intrusion so the key to success is to find the needle in the haystack before cyber disaster in other words find the attacker in your network before the attacker steals your customer data or your internship property remove the attackers access and shut down all front back and side doors this is an area where banks must improve 45% of survey respondents say that detecting malicious insider activity is an area where the bank is least prepared and 43% say that detecting hijacking of privileged user credentials by a hacker is another area where the bank is least prepared bottom line having a system in place to detect malicious activity is a must have cyber security control bank employees susceptibility to phishing and social engineering attacks and schemes must also be tested regularly to prevent an attacker from stealing credentials to break into the network many banks only test their employees annually this is too little too late employees must be tested more frequently on the latest phishing and social engineering schemes to stay one step ahead of cyber attackers Bank board CEOs and executive teams must stay educated on cyber risks and cyber security best practices and stay one step ahead I hope you implement all the best practices uncovered in the FIS and bank director 2016 risk practices survey especially cyber security best practices to tackle the top risk faced today and take your bank to the next level of high-performance risk management