Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

10/16/2012
02:10 PM
50%
50%

How One Midsize Bank Protects Against Hacks

In light of ongoing hacktivist attacks on major banks, Lake Trust Credit Union information security pro shares insights on how a smaller bank stays secure without too-big-to-fail resources.

IW: Do the recent hacktivist attacks on large banks concern you?

Reinders: Somewhat. We are a non-profit financial cooperative, owned by our members, so we care a lot about doing the right thing for them. It is my hope that most hacktivists would recognize that and not make us a target for perceived harms caused by financial institutions. That said, sometimes there are misunderstandings and we could become collateral damage.

There is a very big range in the level of sophistication, and security professionals do need to recognize that there are highly skilled individuals involved with hacktivism. The techniques that hacktivists have been using are not necessarily new; they may be sophisticated, but they're not necessarily something different. [A denial-of-service attack] or a SQL injection is not new. They just happen to leverage it really well and know how to get the media involved.

I think our playbook is to do right by our members and keep an eye out for any vulnerabilities that already exist or [methods] that are already being exploited.

IW: Can you explain Governance, Risk Management, and Compliance (GRC) to someone outside the field? How do you manage it as a midsize bank?

Reinders: GRC does not compress down to an elevator speech without having to leave things out. In short, you have regulatory requirements to meet and a myriad of risks you face externally and from the way an organization is run. You attempt to deal with these issues through proper management. Many organizations are struggling to come with a cohesive response. In our case we have worked to show the organization how GRC actually benefits everyone, how it is not restrictive but can be an enabler of opportunities. We are now also starting to leverage tools like TraceCSO to reduce our costs by centralizing efforts, cutting out piecemeal solutions. It also helps ensure we are meeting or exceeding every regulatory requirement in a non-time-consuming manner.

IW: What are the critical technologies for your industry moving forward? How are you planning to leverage them?

Reinders: Our critical technologies are based on member demand. As we are owned by our members, we grow in the areas where they have a need. Mobile banking is something we see demand for, so now we offer mobile apps, and that of course comes with its own challenges. There are a variety of new mobile and online services and products in the pipeline. To a member, their concern is not how something is offered—say, cloud computing or an in-house virtual machine--but whether it is convenient and secure.

Organizations challenged by meeting the requirements of multiple regulatory mandates are increasingly looking at the alignment of governance, risk, and compliance under a unified framework, GRC.In our report, A Security Pro's Guide To GRC, we examine where the security professionals figure into the mix and recommend the steps organizations should take to align IT GRC with existing security programs and processes. (Free registration required.)

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Cyberattacks Are Tailored to Employees ... Why Isn't Security Training?
Tim Sadler, CEO and co-founder of Tessian,  6/17/2021
Edge-DRsplash-10-edge-articles
7 Powerful Cybersecurity Skills the Energy Sector Needs Most
Pam Baker, Contributing Writer,  6/22/2021
News
Microsoft Disrupts Large-Scale BEC Campaign Across Web Services
Kelly Sheridan, Staff Editor, Dark Reading,  6/15/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-22382
PUBLISHED: 2021-06-22
Huawei LTE USB Dongle products have an improper permission assignment vulnerability. An attacker can locally access and log in to a PC to induce a user to install a specially crafted application. After successfully exploiting this vulnerability, the attacker can perform unauthenticated operations. A...
CVE-2021-22383
PUBLISHED: 2021-06-22
There is an out-of-bounds read vulnerability in eCNS280_TD V100R005C10 and eSE620X vESS V100R001C10SPC200, V100R001C20SPC200, V200R001C00SPC300. The vulnerability is due to a message-handling function that contains an out-of-bounds read vulnerability. An attacker can exploit this vulnerability by se...
CVE-2021-22342
PUBLISHED: 2021-06-22
There is an information leak vulnerability in Huawei products. A module does not deal with specific input sufficiently. High privilege attackers can exploit this vulnerability by performing some operations. This can lead to information leak. Affected product versions include: IPS Module versions V50...
CVE-2021-22363
PUBLISHED: 2021-06-22
There is a resource management error vulnerability in eCNS280_TD V100R005C10SPC650. An attacker needs to perform specific operations to exploit the vulnerability on the affected device. Due to improper resource management of the function, the vulnerability can be exploited to cause service abnormal ...
CVE-2021-22377
PUBLISHED: 2021-06-22
There is a command injection vulnerability in S12700 V200R019C00SPC500, S2700 V200R019C00SPC500, S5700 V200R019C00SPC500, S6700 V200R019C00SPC500 and S7700 V200R019C00SPC500. A module does not verify specific input sufficiently. Attackers can exploit this vulnerability by sending malicious parameter...