Your State Association Presents Preparing for & Conducting a FFIEC IT Audit in 2016 Program Materials Use this document to follow along with the webinar presentation. Please test your system before the broadcast. Be sure to print enough copies for all listeners. Friday, August 12, 2016 Presented by: Jim Stempak Technical Support (for faster service please submit inquiries via email or online): (Registration & Tech Support): Email- [email protected], Phone- (877)988-7526 FOR ADDITIONAL ASSISTANCE PLEASE REFER TO OUR FAQs
Transcript
Your State Association Presents
Preparing for & Conducting a FFIEC IT
Audit in 2016
Program Materials
Use this document to follow along with the webinar
presentation. Please test your system before the broadcast.
Be sure to print enough copies for all listeners.
Friday, August 12, 2016
Presented by: Jim Stempak
Technical Support (for faster service please submit inquiries via email or online): (Registration & Tech Support): Email- [email protected], Phone- (877)988-7526 FOR ADDITIONAL ASSISTANCE PLEASE REFER TO OUR FAQs
Make sure your speakers are turned up on your computer. You should be hearing music playing in the background.
If you do not have computer speakers available and need to hear the audio over a phone line instead, please dial in to this number: 1 (855) 267-3984 followed by your unique audio code in your reminder email
In order to use the Q&A function during the webinar you will need to exit full screen mode.
If you are experiencing any technical issues please contact Support one of the following ways: Live Chat: Enter a question in the Q&A Box on the left-hand side of your webinar
Your registration entitles you to one web connection at the same physical location. However, you may have unlimited participants in the same room.
You have received a unique link for today’s event. If your organization has only paid for one registration and attempts to connect additional sites by forwarding the link, they will not be able to access the broadcast.
Don't forget, your organization has access to a recorded copy of this presentation online for 30 days following the broadcast.
Polling question one: What is an example of a change that could impact your IT environment?
a) New IT Management or IT Personnelb) Adding new features to your mobile banking solutionc) Introduction of FinTech Solution at the Bankd) All of the abovee) Unsure / don’t know
The Point of Entry represents how the attacker obtains initial access. Examples could include social engineering, unpatched Internet accessible systems, or weak passwords on externally accessible systems.
Fortify Access and Access DataAs the attacker pivots around the network, they continue to attempt to escalate their authority until they have the necessary access. They will typically fortify their access by installing malware or backdoors to maintain access. The administrator credentials the attacker obtained likely has authority to the cardholder network, where they can install card harvesting malware to capture credit card data.
Pivot PointThe initial access typically does not provide the information the attacker is looking for. They will leverage the access they do have to try to increase authority on the network. This could be occur through shared passwords, unpatched systems, or excessive privileges. In the Mandiant report, the attackers leveraged misconfigured devices and shared passwords to eventually obtain domain administrator authority.
Data ExfiltrationOnce the attacker has data, they need to get it out of the network. This can be completed through email or FTP. Malware can write the cards to a temp file on the database, which can then be copied to a server, then to a workstation that has Internet access, where is can be sent via FTP to the attacker.
• Many are still asking and many still have differences of opinion. Information Security IT Security Information Assurance
• Reflection of where we are Information Security is the protection of information in all forms;
intellectual, hardcopy, softcopy/electronic Cybersecurity is the protection of information in the cyber “space” IT Security (same as cybersecurity but sounds cooler)
"Cybersecurity encompasses a broad range of practices, tools and concepts related closely to those of information and operational technology security. Cybersecurity is distinctive in its inclusion of the offensive use of information technology to attack adversaries.“
DoD:
"A comprehensive cybersecurity program leverages industry standards and best practices to protect systems and detect potential problems, along with processes to be informed of current , threats and enable timely response and recovery."
Cyber Security Executive Order 13636 February 2013 State of the Union
Increasing the sharing of information (Real Time) for “Critical Infrastructure”
Calls for risk-based set of industry standards and best practices
First Version Released on February 12, 2014. “Framework for Improving Critical Infrastructure Cybersecurity”
Public and Private input
Both Protection and Reaction
Voluntary
NIST is seeking commentary based on this release, Version 2 anticipated NIST has said that they will “continue to serve in the capacity of ‘convener and coordinator’ at least
through version 2.0 of the Framework.”
The latest update was released on December 15, 2014. A formal RFI asking for further feedback will be issued.
• What is the process for ensuring ongoing and routine discussions by the board and senior management about cyber threats and vulnerabilities to our financial institution?
• How is accountability determined for managing cyber risks across our financial institution? Does this include management’s accountability for business decisions that may introduce new cyber risks?
• What is the process for ensuring ongoing employee awareness and effective response to cyber risks?
• What is the process to gather and analyze threat and vulnerability information from multiple sources? • How do we leverage this information to improve risk management practices? • What reports are provided to our board on cyber events and trends? • Who is accountable for maintaining relationships with law enforcement?
• In the event of a cyber attack, how will our financial institution respond internally and with customers, third parties, regulators, and law enforcement?
• How are cyber incident scenarios incorporated in our financial institution’s business continuity and disaster recovery plans? Have these plans been tested?
1. Understand your “Data” before creating an IRP. In other words determine data that you are trying to protect and the level of protection. Knowing this and the ways that data can be accessed is important for developing the appropriate response to an incident
2. Inventory incidents or scenarios and classify them into manageable categories or buckets
3. Understand the threats that you are likely to face – start off with “known” threats and then create a source for new and emerging threats for on-going monitoring
4. Determine the stakeholders and define the IR “TEAM”. At a minimum this team should include: Corporate Communications, Legal, Compliance, Line of business representative(s), IT, and External Forensics Partner or Vendor
5. Set up a “Command Center” and Command Center Leader – could be a conference room
6. Incident – containment and investigation strategy
7. Evidence preservation strategy
8. Overall communication plan including customers, media, federal and state agencies
9. Conduct a post-mortem or lessons learned and update IRP procedures
Consumer Deposit Capture (assess during E-Banking)
Different kinds of payment methods
How many locations and types of locations are originating payments? Testing should include appropriate sample of both internal and external parties Branches
Perform Required Process Steps for Each Audit Unit Audit Scope Report Client Assistance Letter Opening Meeting Fieldwork Exit Meeting Draft Report Management Responses Final Report
1. Approach cybersecurity as an enterprise-wide risk management issue, not just an IT issue.
2. Understand the legal implications of cyber risks as it relates to a company's specific situation.
3. Have adequate access to cybersecurity expertise and discuss cyber-risk management regularly at board meetings.
4. Directors should expect management to establish a risk management framework with adequate staffing and budget.
5. Board and management discussion of risks should identify which risks to avoid, accept, mitigate, or transfer through insurance, and plans for each tactic.
