By Gale Yocom Copyright2008 Financial Institutions can look to more in-depth examinations this year since the FDIC issued FIL-105-207, which updated the IT Examination Officer's Questionnaire. The FDIC wants to make sure that insured depository institutions have security programs that guarantee the confidentiality of customer information in addition to anticipating and protecting against security threats and unauthorized access of customer information. To ensure that these issues were addressed, there are five sections on the questionnaire, which includes Risk Assessment, Operations Security & Risk Management, Audit/Independent Review Program, Disaster Recovery/ Business Continuity Management and Vendor Management/Service Provider Oversight. Parts 1 and 4, namely Risk Management and Disaster Recovery are much the same as the 2005 questionnaire, with some minor changes. The other sections have a number of significant changes; one of the most important is that the 2007 questionnaire has included an entirely new section that focuses on questions about Vendor Management. One particular topic of concern addresses the FIL, because most institutions do not have standard security awareness training programs in place. Training Awareness Using Non-Conventional Methods With so many new complex threats going beyond the standard pharming, phishing and vishing attacks, assaults are now focusing on the end user or client side exploits. These attacks are exploiting and affecting mail readers, Internet browsers and third party applications such as Adobe Reader. Because of these more sophisticated attacks, it is more important than ever to educate users/employees about these risks, which can be achieved by making sure IT Managers have compliant training sessions in place. What we at Covetrix discovered is that most security awareness training programs are simply not enough. They are usually done annually or only when the employee is initially hired. Even with extensive training, the level of absorption of these topics is often forgotten in just a matter of weeks, usually because of a lack of interest or because of the approach of the material presentation. After a while, employees almost get the feeling of someone crying wolf when it comes to phishing / pharming / vishing attacks, which for future reference we will refer to social engineering. The training programs must be adapted so that the critical level of importance remains high. We believe by providing non-conventional, educational and real world examples, a financial institution will not only be able to educate employees with increased absorption, but they will also be able to understand how these scams work thereby being able to spot a scam and then quickly catching it before it impedes on the customer's privacy. Tracking Employee Review is Critical to Retention As our clients are eager to improve on their security levels, we believe it is vitally important to build strong teams, teams that can provide a quick response to potential threats, keeping security risks from causing havoc in the financial institution. At Covetrix, we see a need to track employee reviews of the security training material. The reason? It has been proven that more often then not, an individual may watch security awareness training videos, read e-mail messages, or review computer use handbooks with the best of intentions, yet their level of retention and absorption of the security knowledge is often limited. Covetrix has designed IT training videos that keep interest high and retention longer. The way they work is the video pauses and asks the viewer questions about the previously viewed content before continuing. This information is also reported to IT staff for compliance during examinations. Trained individuals must be ready and prepared to make quick decisions so that nothing threatens the security of the financial institution. Yet even with willing participants, individuals are sometimes overwhelmed with too much information. Despite the idea of ensuring that videos are watched and questioned and then asked about their understanding of content, we need the information to stick. To ensure that training methods stay in the minds of the users/employees, new ways of implementing the information must be enforced, which means it is necessary to implement non-conventional techniques. How Non-Conventional Methods Work In the event of identity theft scams, placing untrained people in security roles is not going to keep security risks away! What will keep them away is giving individuals the proper training, continually expanding on knowledge through effective training programs. As a well-qualified technology expert and experienced security specialist, it has become very obvious that when individuals are properly trained, they retain and absorb information more readily. And based on my years of experience, one of the best ways to help retain and absorb information is through non-conventional strategies. What do I mean by non-conventional strategies? In most training programs, the user is given a direction of lists which may include things like the following: 1. Don't open bad mail 2. Don't go to a bad website 3. Report all phishing emails The problem stems from the user's actual understanding of this information. Our videos are using non-conventional training by actually showing a user exactly what is a bad mail, how they are created, or how a hacker creates a phishing site and attacks their institution. Combined with the employee's review of the information and non-conventional training, the knowledge transfers information in a far more effective manner. The Outcome As a result of implementing these innovative awareness training video strategies, we have seen a high level of success during our third party penetration testing and audits. Equally important are the individuals who are able to understand and retain information more efficiently. It's very clear that even the most effective training program requires periodic testing to ensure that the training program is serving the ever-changing needs of the financial institution. And just as technological challenges continue to change and grow, so too must training programs grow and change as well. With non-conventional training strategies, financial institutions have a far better chance of keeping customers safe from scams and unauthorized access to private information. About the Author Mr. Gale Yocom is a recognized technology expert and President of the Dallas-based security specialist company Covetrix. For the past ten years his company has provided full service networking and security solutions to government entitities, financial institutions, and commercial businesses across the U.S. Performing security audits, asessments and implementation of security measures on ISP networks, he brings a wealth of knowledge and information to Internet security. Mr. Yocom is known for effectively uncovering weaknesses in large institution's security practices and has impressively strengthened the security posture of many financial institutions. Mr. Yocom can be reached by contacting him at gale@covetrix.com or by visiting him on the web at www.covetrix.com
Wednesday, January 30, 2008
Why Using Non-Conventional Security Awareness Training is Crucial!
Wednesday, January 09, 2008
Security Awareness Training Video
One of our sales directors said this to our customer in a meeting:
If you have related stories you would like to share please let us know; one organization’s experience is someone else’s prevention.
I though that was a great idea. Send me your stories to share with others so that maybe we can all learn something from someone else tribulations.
First training video from Covetrix is making progress, we decided on the topic to be Incident Response Plan to Pharming and Phishing Attacks. I hope you guys enjoy it.
GY
Share Your Stories.
One of our sales directors said this to our customer in a meeting:
If you have related stories you would like to share please let us know; one organization’s experience is someone else’s prevention.
I though that was a great idea. Send me your stories to share with other so that maybe we can all learn something from someone else tribulations.
First traing video from Covetrix is making progress, we decided on the topic to be Incident Response Plan to Pharming and Phishing Attacks. I hope you guys enjoy it.
GY
Friday, January 04, 2008
Examples from Community Banks
This is an email from the IT Dept of a community bank in Arkansas
From:
Sent: Friday, January 04, 2008 11:49 AM
To:
Subject: Phishing
I just received a phone call from a person who stated that she was a representative from Experian. She said that she needed to update their records. She was given my first name from the teller who transferred the call to me and from my greeting. She asked me for my last name and if I was in charged of my location. She asked for my title, how long I have been with the bank, the last name of the teller who transferred her, and what her position in the bank is. I did not give her any of this information.
I asked her why Experian needed to verify bank information. She told me that she just needed to verify and update the banks information for the New Year. When I told her that I needed to know why she needed to verify my information and information about the bank when she works for Experian. I told her that Experian should have all of the information that they need. She asked if there was anyone else she could speak to who could verify information about the bank.
I told her that I would transfer her to Marketing and she asked for the Marketing person’s name. I gave her the first name. Then she asked for her last name, and if she was in charge of Marketing or just worked in Marketing. I told her that I would not give her that information. But, I would be happy to transfer her. When I began to transfer the call, she hung up.
Please use caution when giving out information about the bank and the Associates. Anonymity in these situations is crucial. It is important to ask questions, so do not be afraid to. Please be aware of the signs of a phishing phone call. If you get one please transfer the call to your Manager or HR.
Thursday, January 03, 2008
Sophisticated Attacks on Community Financial Institutions Increasing!
By Gale Yocom Copyright2007 In today's' high tech world, maintaining the privacy and protection of customers and employees' information grows more and more difficult particularly for many financial institutions. These days' scammers are getting bolder and more brazen in their abilities to get personal information from banking customers as they aggressively target the smaller locally owned community financial institutions. In fact, a recent customer reported a complex, malicious, and targeted attack took place on their institution's customers and employees. A well-recognized phishing activity trends website reported that financial institutions saw a continuing rise in phishing activities with 92.5% of attacks targeted on financial institutions. On average, a phishing site stays online for 3.8 days. The relevance to the number of days online is that the longer it remains online, the more possibilities for the scammer to gather personal information. It is imperative that we are prepared for this type of incident and the response that is needed. Phishing and Pharming Attacks There was a time when only the larger financial institutions such as Wells Fargo bank were targeted for phishing and pharming scams, but that's no longer the case. The increase in phishing attacks on community financial institutions stems from the fact that smaller financial institutions are simply more profitable and are usually less protected from fraudulent activities. As mentioned above, one of our local community financial institutions was hit with a complex and sophisticated vishing/pharming/phishing telephone scam that focused on customers as well as on the bank's employees. Fortunately, we have been preparing our client for years for these types of attacks, and therefore they were on the alert, so the attack caused minimum disruption. Sharp customers and employees recognized that the e-mail messages were a scam because of poor grammar and content in addition to the salutation being addressed to "member" or some other non-descript person. A genuine message from a financial institution always addresses the customer by their full name. Furthermore, the scams did not provide a means for contacting the institution if there were any questions, but instead told the customers and employees in the e-mail message not to reply. No legitimate institution would ever tell you not to reply. But even with preparation and after years of working in the Internet security arena, we were surprised at the combination of attack vectors used. Combination of Attack Vectors The scammers' used a variety of strategies starting with a mass email and pharming scam as an attempt to steal personal information using a Do-IT-Yourself Phishing kit. The initial attack was then followed up with telephone calls to certain area codes with spoofed numbers and using a technique called Vishing. Besides, using pharming, phishing, and vishing tactics aimed at stealing valuable information such as credit cards, social security numbers, IDs and passwords, the attackers didn't stop there. The scammers also included Spear Phishing, an email spoofing fraud that targets financial institution employees in an attempt to gain unauthorized access to confidential data. Because of the banks watchful eye, they caught it in time, but these types of attacks are getting bolder and more commonplace and require a great deal more vigilance in keeping personal information away from scammers. Why Customers Are Fooled Approximately 19% of recipients respond to Spear-Phishing, which today is one of the most menacing threats to Internet users. Unfortunately, users do not clearly understand the importance of checking for authenticity, which should include specific indications that the site they are being sent to is secure. As a busy society, we are so focused on getting the job done quickly and efficiently, we often don't check for important clues, which is why many users receiving messages or paying bills online don't watch out for the clues that indicate whether an e-mail message or site is fraudulent. An Incident Response Plan As these scams are on the rise in financial institutions, if a financial institution is prepared, and in today's world, they have to be, the consequences will be minimal. In the event of phishing and pharming scams, staff members in a financial institution should know how to deal with this type of situation effectively. To ensure the customer's safety and privacy, an incident response plan should be in place and is required by examiners to be in place. Included in the plan should be an organized approach as to how the problem is going to be handled as well as having a clearly laid out plan to address the situation. The following should be considered in regard to an Incident Response Plan: This is not intended to be a complete incident response plan, but trigger the thought process on items to be covered. At one time or another your institution will be affected by a fraud scam, therefore being prepared with a good response plan for employees as well as providing customer education, in addition to having the resources (either in-house or outsourced) to handle the problem efficiently and effectively are the most effective preventive actions. Prevention of course is primary insofar as keeping phishing and pharming scams at bay, and therefore as a preventive measure, customers who use online banking in any financial institution should be warned to use caution when opening any type of email with links that appear to come from their financial institution. Even if the message looks legitimate, prudence is always best. Educate customers to be proactive rather than reactive. Alert customers not to click any links that come in emails, especially if they appear somewhat suspicious. In addition, if the customer has any doubt about the e-mail message, alert the customer to call their financial institution directly to determine whether it could potentially be a phishing or pharming scam. Provide customers with Security Awareness Training by developing a web page about information disclosure in addition to providing About the Author Mr. Gale Yocom is a recognized technology expert and President of the Dallas-based security specialist company Covetrix. For the past ten years his company has provided full service networking and security solutions to government entitities, financial institutions, and commercial businesses across the U.S. Performing security audits, penetration testing and implementation of security controls, he brings a wealth of knowledge and information to Internet security. Mr. Yocom is known for effectively uncovering weaknesses in institution's security practices and has impressively strengthened the security posture of many financial institutions. Mr. Yocom can be reached by contacting him at gale(at)covetrix.com or by visiting him on the web at www.covetrix.comPreventative Actions
a closely monitored email address for this activity should be set up by your institution where customers can send suspicious activities.
