Training your employees on cybersecurity and how they can ... WBA...2016/04/26 · Training and...

4/12/16

1

WEALTHADVISORY|OUTSOURCING|AUDIT,TAX,ANDCONSULTING

InvestmentadvisoryservicesareofferedthroughCliMonLarsonAllenWealthAdvisors,LLC,

anSEC-registeredinvestmentadvisor.|©2015CliMonLarsonAllenLLP

TrainingyouremployeesoncybersecurityandhowtheycanhelpprotectthebankCarlH.York

360-710-5631

www.CLAconnect.com

[email protected]

©2015CliMonLarsonAllenLLP


Agenda

•  WhoisCLA?

•  Cybersecurity•  Consumerac[vi[es

•  Customerac[vi[es

•  Businesscustomerac[vi[es

•  Bankemployees

•  Hackers:whattheywantandwhattheydo•  Recommenda[onsfortraining

2

4/12/16

2



CLASta<s<cs

•  Oneofthena[on’stop10cer[fiedpublicaccoun[ngandconsul[ngfirms

•  Largeenoughtoefficientlyserveavarietyofour

clients’needsyetsmallenoughtoprovideclientsthe

personaladen[ontheydeserve

•  Nearly4,000professionals,opera[ngfrommore

than90officesacrosstheUnitedStates

•  Servesmorethan1,200financialins[tu[onsin37

states

3



Carl H. York•  Involvedinfinancialservicesfor25years•  FormerSecurityandComplianceOfficerfora$700M

bankwith14branches

•  ResponsibleforthedeliveryofallCLAinforma[on

securityservicesintheWest

•  FathertoJake(20)andEmma(18)

•  BAfromWWU,CISA,CRISC

4

4/12/16

3



Cybersecurity

5



Cybersecurity

6

•  Cybersecurityisthebodyoftechnologies,processesandprac[cesdesignedtoprotectnetworks,

computers,programsanddatafromadack,damage

orunauthorizedaccess.Inacompu[ngcontext,the

termsecurityimpliescybersecurity.

•  hdp://wha[s.techtarget.com/defini[on/

cybersecurity

4/12/16

4



ConsumerAc<vi<es

7



Somanyop<ons…

8

4/12/16

5



ConsumerAc<vi<es

9



SocialMediaSites

10

4/12/16

6



PayOnline

11



School

12

4/12/16

7



Rela<onships

13



Laptops

14

4/12/16

8



I-Pad

15



Phones

16

4/12/16

9



WirelessAccessPoints

17



PortableMedia

18

4/12/16

10



PortableDisks

19



It’saWonderfulLife!

20

4/12/16

11



ConsumerWeaknesses

21

•  ResponsibleforthesecurityoftheirInternetconnec[on

•  Controlwhoconnectstotheirnetwork•  Responsibletokeeptheirdevicesuptodate–opera[ngsystems,applica[ons,an[-virus

•  NolimitsonwheretheybrowsetheWeb

•  NolimitsonUSBorCDdriveuse

•  One-thirdofallusersusethesameIDandpassword

forEVERYTHING



Customer Activities•  Weneedtostartwithalloftheconsumerac[vi[es

previouslyoutlinedasourcustomersare

consumers…thenadd

22

4/12/16

12



Online Banking

23



BillPay

24

4/12/16

13



MobileBanking

25



RemoteDeposit

26

4/12/16

14



CustomerWeaknesses

27

•  Consumerweaknessesmen[onedearlier…

•  Greaterconcern–  Theirnetworkisnowconnec[ngtotheBank’snetwork–  Theirmobiledeviceisnowconnec[ngtotheBank’s

network

–  Theirnetworkandmobiledevicesareoutofthecontrolof

theBank

–  TheBankcouldincurrfinanciallossifacustomers’account

iscompromised



BusinessCustomerAc<vi<es

28

4/12/16

15



AutomatedClearinghouse(ACH)

29



WireTransfer

30

4/12/16

16



RemoteDepositCapture

31



BusinessCustomerWeaknesses

•  ConsumerandCustomerweaknessesmen[oned

earlier

•  Greaterconcern–  Theirbusinesscouldbephysicallybreached–  Thepoten[allossesincurredbytheBankcouldbelargerdueto“highrisk”transac[ons

–  LossesnotcoveredbytheBankorBankinsurancecouldleadtolawsuits

–  BusinessesareassignedanAdministratorovertheironline

bankingsystems

32

4/12/16

17



BankEmployees

33



BankEmployees

•  TheGood–  Backgroundchecksareperformed

–  Creditchecksareperformed

–  CodeofConductacknowledgement

–  AcceptableUseacknowledgement

–  SystemsareprovidedandsecuredbytheITDepartment

34

4/12/16

18



BankEmployees

•  TheBad–  ITinheritedinsecuresystemsandareunawareof

vulnerabili[es

–  InboundInternettrafficistypicallyblockedorlimitedto

whatisonlynecessary;however,outboundInternettraffic

isnotrestricted

–  Monitoring,aler[ngandloggingaretypicallyfoundnotin

placenoreffec[ve

35



BankEmployees

•  TheUgly–  Bankemployeess[llfallforsocialengineering

–  Anadackeronlyneedsonepersontofail–  Ifasession(connec[on)isestablished,theadackerisnowanauthen[cateduser

–  Employeesaretestedwithsocialengineeringtovalidate

theeffec[venessofsecurityawarenesstrainingbut

incidentresponseisexcludedfromtes[ng

–  Mostcommonpasswordcracked=SeasonYear

36

4/12/16

19



What’sthepoint?

37



TheHackers

38

4/12/16

20



2014–YearoftheBreach

39



Iden<tyThe[

40

4/12/16

21



TheHackers

•  Whatdotheywant?

–  Sensi[vecustomerinforma[on

–  Sensi[veBankinforma[on

–  TotransferthatdataoutoftheBank’snetwork–  Gainfullcontrolofyournetwork–  Gainpersistenceandreconnectwhenevertheyplease–  Tonotbedetected–  Togetinwhereit’seasiest–theydon’twanttoworkveryhard

41



TheHackers

•  Whattheydo?

–  SocialEngineer–  “…Manyofthemostdamagingsecuritypenetra6onsare,andwillcon6nuetobe,duetoSocialEngineering,notelectronichackingorcracking…SocialEngineeringisthesinglegreatestsecurityriskinthedecadeahead.”—

Gartner,2010

–  Phonecalls,emailphishing,sitevisits,dumpsterdive

–  Leaveportablemedia

–  Paythecleaningcrew

42

4/12/16

22



TheHackers

•  Whattheydo?

–  Onceaconnec[onisestablished–  Scanforvulnerabili[es–whereisthedooropen?–  Exploitvulnerabili[es–  Finddata–  Collectortransmitdata

–  Elevaterights–  Gainpersistence

43



TheHackers

•  Whodotheytarget?

–  Historicallyretailersforcreditcardinforma[on

–  Mostbreachesthathaveimpactedfinancialins[tu[ons

arebecauseofthirdpar[eswhowerebreached–TJMaxx,

Target,Heartland,HomeDepot,etc.

–  Todateonly3%ofbreacheshaveoccurredatfinancialins[tu[ons–theyfounditdifficulttomone[ze

44

4/12/16

23



TheHackers

•  ChangeinTac[cs–  Carbanak–  ACHFiles–notpublicized

45



Carbanak–TheGreatBankRobberyFebruary2015

46

4/12/16

24



Carbanak–TheGreatBankRobberyFebruary2015

47




48

4/12/16

25




49



Somuchtothinkabout…

50

4/12/16

26



Isthistheendoftheworld?

51



Wemustfindtherightbalance

52

Convenience

Security

4/12/16

27



Wemustfindtherightbalance

•  Staffneedaccesstoresourcestoperformtheirjobs

–  Lenders–  ITStaff

•  CLevelstaffshouldnotbeexempt

•  Vendordesignedsystemssome[meshamper

security

•  Vendorcontractsshouldincludetheircommitment

tokeepsystemsuptodate(opera[ngsystems)and

patched

53


WEALTHADVISORY|OUTSOURCING|AUDIT,TAX,ANDCONSULTING 54

4/12/16

28



PoliciesandStandards

•  Ensureyourpoliciesaresimpleandclear

•  Tonefromthetop–annualapproval

•  Annualacknowledgement–technologyisrapidly

changing

•  Standardsaremoredetailedandmustbeadheredto

–enforcedbytechnicalcontrolsifatallpossible

55



TrainingandExpecta<ons

•  Ini[alandongoingtraining•  Periodicnewsledersthatcontaincurrentcybersecurityevents

•  Hackersarelazy–showthemexamples

•  Passwords–  Randomcharactersubs[tu[on

–  Lengthiskey–usepass-phrases–  Segmentworkandpersonalpasswords

–  Varypasswordsbysystem

56

4/12/16

29




•  Vendorvisits–  Confirmallvendorvisita[ons

–  Ifnotconfirmed,turnaway

–  Cashcontrolscomparison

◊  ArmoredCarriers

◊  SameDay,SameTime,SameCarrier

◊  Howisthishandledifall3don’tmatchup?

◊  HandleinthesamemannertoprotectdataandtheBank

•  Ques[onthoseyoudonotrecognize•  Howdoyouhandleastrangerwhoknocksonyourdoorathome?

57




•  EmailPhishing

–  Onlyopenemailfromtrustedsources

–  Don’tclickonalinkwithinanemail

–  Don’topenanadachment

◊  GiMCards◊  PeepingTom

–  NevershareyourIDandpassword(creden[als)withanyone–includingITstaff

–  Ifyouques[ontheemail–calltoconfirm

–  Ifyouques[ontheemail–reportit

58

4/12/16

30




•  PhoneCalls–  Doacallback–spoofingiseasy–  NevershareyourIDandpassword(creden[als)withanyone–includingITstaff

–  Ifyouques[onthecall–callbacktoconfirm

–  Ifyouques[onthecall–reportit

59




•  SimpleSugges[ons

–  KnowthenamesofyourITStaff

–  Requireacallback–  Confirmvendorvisits

–  Ques[ontheunknown–  Thelitmustest

–  Reportsuspicions

60

4/12/16

31




•  SpecificTrainingforITStaff–  EnsureITStaffareprovidedthetrainingtheyneedtounderstandandsecurethesystemsusedbytheBank

–  Ensuretheyknowhowtorespondtoareportedincidentorpoten[albreach

–  PartTimePenetra[onTes[ngforFullTimeSystemAdmins

–aCLA-designedcourse

61




•  HowITcanhelp–  Iden[fyexternalemail

◊  [External]inthesubjectline◊  InternalpullspicturefromAc[veDirectory

–  Usecodeforiden[fica[on◊  Thishastobedonerightorcanmakelifeeasierforanadacker

–  Ensureopera[ngsystemsareuptodate

–  Ensureopera[ngsystemsandapplica[onsarepatched

–  Ensureconfigura[onstandardsarefollowed

62

4/12/16

32



Tes<ngandValida<on

•  BanksarerequiredtohaveanInforma[onSecurity

Program

•  Banksarerequiredtoperiodicallytestcontrols•  Haveanindependentthirdpartyperformtes[ng

•  WhiteBox–testofemployees

•  BlackBox–testofemployeesandITresponse

•  CLAofferstheseservices•  CLAclientscanreceivesecurityawarenesstrainingatnoaddi[onalcost–expensesreimbursed

63



Ques<onsandAnswers?

64

4/12/16

33

twider.com/CLAconnectfacebook.com/

cliMonlarsonallen

linkedin.com/company/

cliMonlarsonallen


CLAconnect.com

CarlH.YorkSeniorManager360-710-5631carl.york@CLAconnect.comwww.CLAconnect.com

Date post:	09-Sep-2020
Category:	Documents
Upload:	others
View:	0 times
Download:	0 times

Training your employees on cybersecurity and how they can ... WBA...2016/04/26 · Training and...

Documents