Hacker intrusions to firms have now become a regular event. The most recent affected many banks worldwide and involved malware being dispersed within the banks, according to a report issued by a security firm on Monday.
If you do not have an aggressive plan to prevent this type of impact to your information, funds or reputation you should start now – or this could likely be you.
As we discussed in our blog post on 09 February 2015, there are three critical components to this strategy: create a security culture with your staff, implement a holistic security strategy and collaborate closely with your technology vendors. This might seem overwhelming, but it shouldn’t be. Your CRO (Chief Risk Officer) should be having dialog with your leadership, technical teams and technology vendors around these 11 Critical Security Questions.
- Is the perimeter of the network secure?
- Are there open ports into the data/application tier from the internet?
- Are application IP addresses exposed to the public?
- Where and how does customer authentication occur?
- Are whitelists & blacklists being used?
- How does File Sync and Share occur?
- Is data/information being scanned for malware prior to a system or employee taking action on it?
- Is data being encrypted in transit, in use and at rest?
- If employee credentials are compromised what is the risk?
- Does the firm have a Digital Vault?
- What is the Data Loss Prevention plan?
These questions should augment your formal CSA (Control Self-Assessment) program that evaluates the effectiveness of risk management and control processes. The CSA strategy fosters open dialog and inclusiveness because the staff whose daily responsibilities fall within the control/risk being evaluated, actually rate and document their effectiveness. These ratings will be a significant asset to your internal auditors and CRO and can be very effective for small and large firms.
Whether you have a formal or informal risk strategy, the important part of this is that the dialogue is occurring, action is being taken and the implementation plan is being executed on an accelerated path. Otherwise the outcome might not be favorable for you or your customers. It is safe to assume you are being hacked!