Unlike large financial institutions, community banks do not have teams of security professionals or vast resources to dedicate to cyber security. Yet they still need to uphold a high security standard — both for their customers and to comply with regulatory requirements.
The Threat Landscape Has Changed
Today we see threats from negligent, malicious or compromised third-party insiders, overprivileged or super users, and cyber criminals. With the U.S. National Security Agency (NSA) and Central Intelligence Agency (CIA) toolkits in the public domain, it’s easier than ever to circumvent existing security tools. For community banks and credit unions, these threats and incidents expose a number of issues:
- Very limited IT staff with deep security skills
- Limited budget to invest in a fragmented set of cyber security tools
- Most defenses are focused on the network perimeter
- The scope of the network is no longer confined to the institution itself
FFIEC Compliance and Network Security
With the increasing volume and sophistication of cyber threats, the Federal Financial Institutions Examination Council (FFIEC) developed the Cybersecurity Assessment Tool (Assessment) to help institutions identify their risks and determine their cybersecurity preparedness.
Here are some of the common challenges community banks face in performing well on the Assessment:
- NETWORKS are evolving and dynamic. Many community banks and credit unions have only cursory knowledge of their network assets and are unable to interpret traffic and truly understand what’s happening on the network.
- SECURITY ALERTS are overwhelming network and security operations center (NOC/SOC) analysts. There are too many alerts and not enough time or resources to review each. Popular tools that focus on prevention, like firewalls and endpoint security, cannot keep up with today’s security threats. You must be able to quickly identify and remedy threats that have breached your first line of defense.
- RESOURCE CONSTRAINTS are a major issue in cybersecurity with too few skilled professionals — all demanding high salaries. Cybersecurity Ventures estimates that there will be a shortfall of 3.5M security positions by 2021.
- DATA growth is overwhelming the ability of humans to process it. The volume, variety, and velocity of data passing through banking networks requires advanced tools that parse through it to identify activity that is potentially a cyber threat in near-real-time.
- UNKNOWN THREATS are emerging every day. They have successfully penetrated large organizations like Equifax, Facebook, Sony, Target, and Yahoo. But the reality is, smaller organizations have to deal with these same threats without the same ability to bounce back from reputational damage.
Networks Are the Greatest Opportunity for Attacks
All cyber breaches rely on the network. It’s the single source of connectivity from a hacker to a bank’s most valuable assets. But most banks have poor network visibility that severely hinders threat detection. The network is also ill-defined: is it the local branches, the head office, a customer’s home computer or mobile device? Which third parties are approved to access the network? Part of the challenge is not simply understanding the inventory of network connections, but knowing which connections are appropriate and which are not.
CyGlass addresses community banks’ cyber risks in 3 ways:
- COMPLIANCE BOX TICKED
The requirement from regulators is for banks to monitor their networks to identify cyber security threats. CyGlass Network Defense as a Service (NDaaS) simply and effectively identifies, detects, and responds to threats to your network. This ticks the regulator’s boxes and also allows you to take your cyber security beyond the basic audit measures. - EASY TO DEPLOY & USE
Unlike other security solutions, CyGlass doesn’t require any additional hardware, software, or people. It’s up and running in hours and has a low rate of false positives so it won’t overburden staff. CyGlass works on the network, which means there is no additional cost or friction in protecting each branch a community bank has. - SECURITY BEYOND COMPLIANCE
The best defense is knowing what normal network activity looks like so you can identify anomalies quickly and act to mitigate attacks. This is what CyGlass provides: you can see your entire digital network through a security lens and therefore can plan, prioritize and protect it effectively.
Without breaking the bank (pun intended), you can have sophisticated threat detection that goes beyond basic compliance to protect assets and assure customers that their money is secure from cyber threats.
Interested to learn more about how CyGlass supports the 5 domains of the FFIEC Assessment? Download our whitepaper below.
