Risk
10/16/2012
02:10 PM
50%
50%

How One Midsize Bank Protects Against Hacks

In light of ongoing hacktivist attacks on major banks, Lake Trust Credit Union information security pro shares insights on how a smaller bank stays secure without too-big-to-fail resources.

IW: Do the recent hacktivist attacks on large banks concern you?

Reinders: Somewhat. We are a non-profit financial cooperative, owned by our members, so we care a lot about doing the right thing for them. It is my hope that most hacktivists would recognize that and not make us a target for perceived harms caused by financial institutions. That said, sometimes there are misunderstandings and we could become collateral damage.

There is a very big range in the level of sophistication, and security professionals do need to recognize that there are highly skilled individuals involved with hacktivism. The techniques that hacktivists have been using are not necessarily new; they may be sophisticated, but they're not necessarily something different. [A denial-of-service attack] or a SQL injection is not new. They just happen to leverage it really well and know how to get the media involved.

I think our playbook is to do right by our members and keep an eye out for any vulnerabilities that already exist or [methods] that are already being exploited.

IW: Can you explain Governance, Risk Management, and Compliance (GRC) to someone outside the field? How do you manage it as a midsize bank?

Reinders: GRC does not compress down to an elevator speech without having to leave things out. In short, you have regulatory requirements to meet and a myriad of risks you face externally and from the way an organization is run. You attempt to deal with these issues through proper management. Many organizations are struggling to come with a cohesive response. In our case we have worked to show the organization how GRC actually benefits everyone, how it is not restrictive but can be an enabler of opportunities. We are now also starting to leverage tools like TraceCSO to reduce our costs by centralizing efforts, cutting out piecemeal solutions. It also helps ensure we are meeting or exceeding every regulatory requirement in a non-time-consuming manner.

IW: What are the critical technologies for your industry moving forward? How are you planning to leverage them?

Reinders: Our critical technologies are based on member demand. As we are owned by our members, we grow in the areas where they have a need. Mobile banking is something we see demand for, so now we offer mobile apps, and that of course comes with its own challenges. There are a variety of new mobile and online services and products in the pipeline. To a member, their concern is not how something is offered—say, cloud computing or an in-house virtual machine--but whether it is convenient and secure.

Organizations challenged by meeting the requirements of multiple regulatory mandates are increasingly looking at the alignment of governance, risk, and compliance under a unified framework, GRC.In our report, A Security Pro's Guide To GRC, we examine where the security professionals figure into the mix and recommend the steps organizations should take to align IT GRC with existing security programs and processes. (Free registration required.)

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8148
Published: 2015-01-26
The default D-Bus access control rule in Midgard2 10.05.7.1 allows local users to send arbitrary method calls or signals to any process on the system bus and possibly execute arbitrary code with root privileges.

CVE-2014-8157
Published: 2015-01-26
Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, which triggers a heap-based buffer overflow.

CVE-2014-8158
Published: 2015-01-26
Multiple stack-based buffer overflows in jpc_qmfb.c in JasPer 1.900.1 and earlier allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image.

CVE-2014-9571
Published: 2015-01-26
Cross-site scripting (XSS) vulnerability in admin/install.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the (1) admin_username or (2) admin_password parameter.

CVE-2014-9572
Published: 2015-01-26
MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to /*/install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.