# Presentation: 707501

## E-Commerce And You

*Lake Buena Vista, Fl*

*November 3, 2004*

* **Roger Blake*
*Senior Information Systems Officer*
*National Credit Union Administration*

## Notable Quotes

*“...**The Internet is the single greatest threat to the economy and national security of the United States today...”*

*Richard Clark*
*President’s Chief Advisor of*
*Critical Infrastructure*
*National Security Council*

**Notes:**
The Internet has grown beyond its original purpose. Timeline:
Share information among government agencies.
Scientist began sharing information and ideas.
Universities/educators came on board to share information/ideas.
Accessible to any individual with a computer...medical information, financial services, research, news, entertainment, etc.

Now has impact on all aspects of our lives...in ways never envisioned. With its “open” infrastructure comes both good and the bad.

## Notable Quotes

*“...**Anyone in the privacy of their own home can create a very persuasive vehicle for fraud over the Internet...”*

*Louis J. Freeh*
*Director of the FBI*

**Notes:**
You can hide...but this is getting more difficult to do.

How do you know who you are conducting business with???

## Notable Quotes

*“...**The use of digital media also can lend fraudulent material an air of credibility. Someone with a home computer and knowledge of computer graphics can create an attractive, professional-looking Web site, rivaling that of a Fortune 500 company...”*

*Arthur Levitt*
*Chairman of the SEC*

**Notes:**
In fact, one can easily copy another website, directly from the Internet. One doesn’t necessarily need to be all that creative to commit fraud.

## NCUA Strategic Plan2003-2008

*Goal #2:*
*Facilitate the ability of credit unions to safely integrate financial services and emerging technology in order to meet the changing expectations of their members.*

## e-Commerce Services

*Does NCUA expect all credit unions to develop and implement e-Commerce services?*

***No!***

*NCUA encourages credit unions to consider offering e-Commerce services.*

## Slide 7

## Slide 8

## Credit Union Statistics

*Website Trends*
*June ‘98 – June ‘04*

*5300 Call Report Data*

## Credit Union Industry Statistics

*Credit Union Websites*

**Notes:**
5300 Call Report: One schedule dedicated to collecting website/e-commerce/EFS info.
Types of websites:
Informational-Marketing information, CU information (location, phone, operational hours, etc.).
Interactive-Secure Messaging, Loan Applications, Account Inquiry
Transactional-Financial Transactions (transfer funds, pay bills, etc.).

## Credit Union Industry Statistics

## Credit Union Industry Statistics

*Website Growth*

## Credit Union Industry Statistics

## Computer Security Institute(CSI)

*Computer Security*
*Issues & Trends*
*2004 CSI/FBI Computer*
*Crime and Security Survey*

*www.gocsi.com*

**Notes:**
Joint effort of CSI and FBI (Computer Intrusion Squad; Computer Fraud and Abuse Act, Title 8, Section 1030).
9th year survey conducted.
Disclaimer:
Non-scientific, informal, narrowly focused poll of information security practitioners.
Data represents “raw intelligence” and should not be used to extrapolate numbers.
Should be used for identifying trends.

## Key Findings

*Unauthorized use and financial losses declined*
*Virus and denial of service top cost*
*Law enforcement reporting declined*
*Security audits used*
*Security outsourcing low*
*Sarbanes-Oxley impact*
*Security training needed*

**Notes:**
2004 Findings:
Unauthorized use of computer systems is on the decline, as is the reported dollar amount of annual financial losses resulting from security breaches.
Both virus attacks and denial of service outpaced the former top cost, theft of proprietary information. Virus costs jumped to $55 million.
The percentage of organizations reporting computer intrusions to law enforcement over the last year is on the decline. The key reason cited for not reporting intrusions to law enforcement is the concern for negative publicity.
Over 80 percent of the organizations conduct security audits.
The majority of organizations do not outsource computer security activities. Among those organizations that do outsource some computer security activities, the percentage of security activities outsourced is quite low.
The Sarbanes-Oxley Act is beginning to have an impact on information security in some industries.
The vast majority of the organizations view security awareness training as important, although (on average) respondents from all sectors do not believe their organization invests enough in this area

## Respondents

**Notes:**
Respondents:
Respondents: 494 Security Practitioners (U.S. Corporations and Government).
Responses were anonymous.
Security Officer/Manager/Director 53%; System Administrator 9%; CIO 8%; CSO 6%; CEO 4%; Other 19%.
Types of organizations surveyed included:
corporations;
financial institutions;
government agencies; 
medical institutions; and
universities.

## Percentage of IT BudgetSpent on Security

*2004: 481 Respondents/97%*

**Notes:**
46% of respondents spent between 1% and 5% of their IT budget on security.
16% of respondents spent less than 1% of their IT budget on security.
Only 7% of the respondents indicated that they outsourced 40% or more of the security function.

## Technologies

*2001: 530 Respondents/99%*
*2000: 629 Respondents/97%*

*1999: 501 Respondents/96%*
*1998: 512 Respondents/98%*

*2004: 483 Respondents/98%*
*2003: 525 Respondents/99%*
*2002: 500 Respondents/99%*

**Notes:**
2004 survey-Updated categories (clarified, added, and deleted).
Intrusion Detection vs. Intrusion Prevention vs. Firewalls
ID-Detect an intrusion.
IP-Prevent an intrusion. Pass all traffic unless there is a reason to block.
FW-Block all traffic except that which has a reason to pass through.

## Unauthorized Use

*2001: 532 Respondents/99.6%*
*2000: 585 Respondents/91%*
*1999: 512 Respondents/98%*

*1998: 515 Respondents/99%*
*1997: 391 Respondents/69%*
*1996: 410 Respondents/96%*

*2004: 481 Respondents/97%*
*2003: 524 Respondents/99%*
*2002: 481 Respondents/96%*

**Notes:**
Positive Trend-Decline in Yes’s and increase in No’s.
Concerns:
Over 50% with unauthorized use.
Over 10% still don’t know.

## Breach Frequency

*2002: 321 Respondents/64%*
*2001: 348 Respondents/65%*

*2000: 392 Respondents/61%*
*1999: 327 Respondents/63%*

*2004: 280 Respondents/57%*
*2003: 356 Respondents/67%*

## Website Incidents

*2000: 120 Respondents/18%*
*1999: 92 Respondents/18%*

*2002: 244 Respondents/49%*
*2001: 211 Respondents/40%*

*2004: 132 Respondents/27%*
*2003: 135 Respondents/25%*

**Notes:**
Seems to indicate that once compromised, companies are implementing patches quicker to prevent additional incidents.

## Types of Losses

*2004: 269 Respondents/54%*

**Notes:**
Total losses reported declined.
Respondents generally either unable or unwilling to estimate the dollar losses.

## Computer IntrusionsActions Taken

*2001: 345 Respondents/64%*
*2000: 407 Respondents/63%*
*1999: 295 Respondents/57%*

*1998: 321 Respondents/72%*
*1997: 317 Respondents/56%*
*1996: 325 Respondents/76%*

*2004: 320 Respondents/65%*
*2003: 376 Respondents/71%*
*2002: 389 Respondents/77%*

**Notes:**
High patch rate.
Low reporting (law enforcement and legal counsel).

## Computer IntrusionsNot Reported

*2001: 345 Respondents/64%*
*2000: 407 Respondents/63%*
*1999: 295 Respondents/57%*

*1998: 321 Respondents/72%*
*1997: 317 Respondents/56%*
*1996: 325 Respondents/76%*

*2004: 267 Respondents/54%*
*2003: 376 Respondents/71%*
*2002: 389 Respondents/77%*

**Notes:**
Suspicious Activity Report Filing:
 Insider abuse involving any amount.
Violations aggregating $5,000 or more where a suspect can be identified.
Violations aggregating $25,000 or more regardless of a potential suspect.
Transactions aggregating $5,000 or more that involve potential money laundering or violations of the Bank Secrecy Act.
Computer Intrusion:
For purposes of the SAR, computer intrusion is defined as gaining access to a computer system of a financial institution to:
a. Remove, steal, procure or otherwise affect funds of the institution or the institution’s customers;
b. Remove, steal, procure or otherwise affect critical information of the institution including customer account information; or
c. Damage, disable or otherwise affect critical systems of the institution.

## Risk Assessment

*Risk Assessment Modeling*

## e-Commerce Risks

*Risk that are generally associated with e-Commerce and IT include:*
*Compliance*
*Transaction*
*Strategic*
*Reputation*

**Notes:**
Compliance-Risk arising from violations of, or nonconformance with, laws, rules, regulations, required practices, contracts, or ethical standards. This risk could arise if a credit union failed to comply with regulatory guidance or an enforcement action. This risk can expose a credit union to significant and costly litigation.
Transaction-Risk of financial losses arising from problems with integrity or delivery of a service or product. It often results from deficiencies in computer system design, implementation, or maintenance.
Strategic-Risk to earnings or capital arising from adverse business decisions or adverse implementation of those decisions. Usually present whenever a credit union introduces a new product or service.
Reputation-Risk of negative public/member opinion that causes a loss in confidence in the management or products/services of the credit union. Poor management of the other risk areas (transaction, strategic, compliance, etc.) increases the credit union’s reputation risk.

## e-Commerce Risks

*Potential impact of risks facing a credit unions engaging in e-commerce activities may include: *
*Lack of member trust due to poor public image*
*Potential legal or regulatory sanctions*
*Fraudulent loans, disbursements and withdrawal of member funds*

## e-Commerce Risks

*Potential impact of risks facing a credit unions engaging in e-commerce activities may include: *
*Misappropriation of funds*
*Extended disruption of member services *
*Unauthorized access to member data*
*Theft of confidential member data*

**Notes:**
Generally, the level of IT-related risk exposure is not static and can change quite quickly. Risk exposure may change due to: 
Advances in technology products and services
Organizational restructuring or cultural changes
New business line processes
New products and services
Management should continually seek to identify and take corrective actions against new risks.

## Risk Management

**Notes:**
Risk management is the process of identifying and assessing all risk categories relevant to the credit union and mitigating risks to acceptable levels through the execution of necessary, reasonable, and sufficient controls. 
A comprehensive risk management cycle consists of five stages:
Identify Risks-Identify those risks that may be present due to the types of services offered and the systems used to deliver those services.
Assess Impact-Assess the impact of those risks identified on the credit union’s operations.
Prioritize Threats-Rank the risks in order of importance and impact on credit union’s operations.
Develop Action Plan-Take action to limit the impact of the risk.
Implement, Monitor, Report-Monitor the risks, reevaluate mitigation strategies, implement revised strategies in a timely manner, and ensure senior management and the board are apprised of the result of the ongoing risk management process

## Risk Management Process

**Notes:**
Five stages:
Identify
Assess Impact
Prioritize (Rank)
Develop Plan
Implement, Monitor, & Report
Non-ending cycle. As new products and/or services deployed, or when the environment changes, need to reassess the risks.

## Risk Management ProcessIdentify Risks

*Risk identification involves the evaluation of: *
*What risk categories impact the credit union as it relates to IT (e.g., operational, financial, informational, transactional)?*
*Which assets should be reviewed?*

**Notes:**
Categories:  For a credit union with online capabilities, the categories should conform with those identified for e-commerce.
Assets: IT refers to information systems, its components (e.g., hardware, software, telecommunications, data), and facilities which house the components, including third party service providers.

## Risk Management ProcessAssess Impact

*Impact Assessment includes:*
*Threat Analysis*
*Asset Valuation*
*Vulnerability Analysis*

**Notes:**
Threat Analysis: Identify specific threats and the likelihood of occurrence.
Asset Valuation: Determine each asset’s replacement cost and acceptable loss thresholds. Loss impact is a key factor in determining the proper risk reduction strategy and includes: 
The cost of applying risk reduction procedures should not outweigh the value of the asset. 
The data classification process outlined in the security policy module will also assist in the impact assessment. 
An asset’s value can be measured: 
Quantitatively, such as the dollar amounts attached to hardware and software used to process information. 
Qualitatively, as in whether loss of the information or system would compromise credit union operations.
Criteria used to determine this value (e.g., monetary, member confidence) should be determined and documented.
Vulnerability Analysis: Identify: 
The susceptibility of an asset to a threat, given the nature of an asset 
The practices/measures in place (or not in place) that could increase the impact of a threat.

## Risk Management ProcessPrioritization (Rank)

**Notes:**
Risk evaluation involves measuring, or ranking, the chance of loss and expected magnitude of loss for each asset. 
Those threats with the greatest impact on the credit union and the highest likelihood of occurrence should receive the highest priority.

## Risk Management ProcessAction Plans (Mitigation)

*Mitigation recommendations should, at a minimum, address: *
*The medium to high risk exposures *
*Those exposures that exceed management’s expectations and allowances (i.e., unacceptable risks)*

**Notes:**
All analysis, results, and recommendations should be documented and reported to management for review and approval.

## Risk Management ProcessAction Plans (Mitigation)

*Recommendations can fall into one of four categories: *
*Preventative Safeguards *
*Mitigating Safeguards*
*Detective Safeguards*
*Recovery Safeguards*

**Notes:**
Preventative Safeguards: Those that reduce the of risk to zero by preventing the risk event from occurring. 
Mitigating Safeguards: Those that reduce the risk, but do not entirely prevent exposure, and/or that reduce the impact if it an event was to occur. 
Detective Safeguards: Those that detect risk events after they occur, thereby allowing for timely responses to reduce the impact. 
Recovery Safeguards: Those that assist in the recovery from risk events that have occurred, thereby reducing the overall risk exposure.

## Risk Management ProcessImplement, Monitor, Report

*Implement revised strategies in a timely manner*
*Monitor the risks*
*Report results*

**Notes:**
Monitor:
As changes occur in the credit union (e.g., new service offerings, new vendors, new systems)
As new threats and vulnerabilities are identified, which might impact existing service offerings and systems.
Report: Report results of ongoing risk management process to senior management and the board.

## Outsourcing

*Vendor Management*

## Outsourcing

*Risk Management*
*Vendor Selection*
*Contracts*
*Oversight*
*Service Level Agreements*

**Notes:**
Credit union management has responsibility for managing strategic, operational, security, regulatory/compliance, and reputational risks in situations when third parties provide technology services.
Topics:
Risk management considerations when dealing with outsourced vendors 
Controls and procedures necessary to select outsourced vendors 
Controls and procedures necessary to monitor and maintain productive vendor relationships 
Security and management responsibilities of both the credit union and its vendors 
Importance of establishing and monitoring vendor service level agreements

## OutsourcingRisk Management

*Board of directors and senior management responsible for:*
*Understanding risks associated with outsourcing arrangements for technology services. *
*Ensuring effective risk management practices are in place. *

## OutsourcingRisk Management

*Board of directors and senior management responsible for:*
*Assessing how outsourcing arrangements will support the credit union’s objectives and strategic plans. *
*Assessing how relationships will be managed.*

**Notes:**
Effective risk assessment practices include assessing:
Ability to evaluate and oversee outsourcing relationship 
Importance and criticality of services provided 
Defined requirements for outsourced activity 
Contractual obligations and requirements for the service provider, including independent validation/certification of service providers’ control environment 
Vendor and credit union responsibilities for security, privacy, and regulatory compliance and guidance for affected parties 
Contingency plans, including availability of alternative service providers, costs, and resources required to switch service providers.
Once a credit union has completed its risk assessment, management should continually evaluate service providers to determine their ability, both operationally and financially, to meet the credit union’s needs. Some things to consider include:
Ongoing vendor due diligence
Financial statement review, when available 
Vendor liability analysis
Monitoring of compliance with service level agreements 
Review of reports evaluating service provider’s control environment (i.e. SAS70, SysTrust, or WebTrust).

## OutsourcingVendor Selection

*Selection criteria:*
*Ensure potential vendors have relevant expertise and references *
*Evaluate vendor’s capabilities, references, and personnel involved *
*Ensure stable financial position *
*Evaluate consequences of selecting inappropriate vendor*

**Notes:**
Perform requirements analysis to identify credit union's specific needs.
Level of services and/or support required
Functionality and capacity required
System performance requirements
Consider developing and distributing Requests for Proposals (RFPs) to solicit responses from potential vendors.
Include specific requirements
Request qualifications and references
Request timeframes
Fee estimates or caps
Obtain and review multiple bids from reputable vendors. Rule out unacceptable responses and identify “best of breed”.
Perform due diligence when selecting a service provider. Some factors to be considered include:
Technical and industry expertise
Demonstration of capabilities
Operations and controls
Internal controls to be maintained by service provider.
Records to be maintained by service provider.
Credit union’s access to records.
Service provider’s notification to credit union and credit union’s rights relative to material changes to services, systems, controls, key personnel and new service locations.
Service provider’s responsibility to comply with security standards and privacy regulations.
Service provider’s due diligence process for their subcontractors, support vendors, and other parties
Some service providers may contract with third parties, including foreign-based providers, to support or provide critical services to the service provider that impact its credit union clients.
Credit unions should analyze the service provider’s selection process and determine the level of access such supporting vendors have to credit union data.
Feedback from references
Financial condition
Analyze service provider’s recent audited financial statements and annual report as well as other indicators.
Evaluate factors such as how long service provider has been in business and market share.
Determine the significance of credit union’s contract on service provider’s financial condition.
Consequences of selecting an inappropriate vendor may include:
Inadequate services
Disruption of services
Unforeseen costs
Dissatisfied members
Inability to meet strategic goals

## OutsourcingContracts

*As a minimum, contracts should address:*
*Scope of services*
*Cost and duration of services*
*Security and confidentiality*
*Audit and controls*
*Performance standards*

**Notes:**
Scope of services issues include:
Timeframes and activities for implementation and assignment of responsibility 
Services to be performed by service provider (software support, maintenance, training, customer service) 
Obligations of credit union 
Credit union’s rights in modifying existing services 
Guidelines for adding new services and contract renegotiation.
Cost issues include:
Fees and calculations for base services fully disclosed, including:
Development costs
Conversion costs
Recurring services costs
Responsibility for purchase and maintenance of hardware and software
Any conditions under which the cost structure may change.
Duration issues include:
Appropriate length of time required to notify service provider of intent to renew.
Penalties for early terminations.
Security and confidentiality issues include:
Service provider and its agents are prohibited from using or disclosing credit union or members information.
Service provider is required to immediately report any security breaches or other unauthorized intrusions that may materially affect the credit union or its members.
Service provider is required to report any corrective actions in response to intrusions.
Audit issues include:
Types of audit reports the credit union is entitled to receive
Specific audit frequency and any costs to credit union for audit services.
Rights for credit union to obtain documentation regarding resolution of deficiencies noted during the audit.
Contracts for Internet-related services should require periodic security reviews, including:
Attack and penetration tests
Tests of intrusion detection and firewall configuration.
Control issues include:
Internal controls to be maintained by the service provider.
Compliance with applicable regulatory requirements.
Records to be maintained by the service provider.
Adequacy of insurance coverage, notification if insurance changes/lapses.
Performance standards issues include:
Minimal service level requirements
Remedies for failure to meet standards.

## OutsourcingContracts

*As a minimum, contracts should address:*
*Indemnification*
*Limitation of liability*
*Dispute resolution*
*Termination and assignment*
*Reporting*

**Notes:**
Indemnification issues include:
The credit union is not liable for negligence on the part of the service provider.
Reciprocal hold harmless agreements for liability for negligence are common.
Limitation of liability issues include:
Clauses limiting the amount of liability incurred by the service provider.
Review for reasonableness given potential losses credit union might experience.
Dispute resolution issues include:
Credit union provisions that attempt to:
Resolve problems quickly 
Provide for continuation of services during dispute resolution.
Termination rights issues include the following:
Change in control of vendor (i.e. acquisitions and mergers) 
Convenience and flexibility for credit union 
Substantial increases in charges 
Repeated failure to meet service levels 
Failure to provide critical services 
Bankruptcy, loss of insurance, company closure, and insolvency.
Assignment issues include the following:
Prohibit assignment of contract to a third party without credit union’s consent – can includes changes to subcontractors.
Required reporting issues include:
Service level metrics 
Financial statements 
Insurance policies 
Incident response program and test results 
Business contingency plans and test results 
Audit and consulting reports and vendor’s corrective actions
Internal Audit 
SAS 70 
Security assessments.

## OutsourcingOversight

*Implement an on-going oversight program to monitor each service provider’s controls, conditions and performance*
*Monitor key indicators:*
*Financial condition and operations *
*Quality of service and support *

**Notes:**
On-going oversight program:
Clear assignment of responsibility for the administration of vendor relationship. 
Level of effort to monitor service provider (# of personnel, functional responsibilities and amount of time needed) that correlates to the criticality of services provided.
Maintenance of documentation to be used for future contract negotiations, termination issues, and contingency planning.
Methodology to track when required due diligence is required (e.g., follow-up on financial reporting, obtain latest SAS70, review of existing contract for possible cancellation or revision prior to automatic multi-year renewal, etc.)
Financial condition and operations:
Evaluating financial condition periodically.
Reviewing audit and consulting services reports as well as regulatory examination reports and evaluating the adequacy of system and controls.
Following-up on deficiencies noted in these reports.
Reviewing service provider’s policies relating to internal controls, security, systems development and maintenance and backup and contingency planning periodically.
Monitoring changes to key service personnel assigned to credit union.
Reviewing and monitoring the provider’s insurance policies for effective coverage.
Performing or engaging third party to perform on-site inspections. 
Sponsoring coordinated audits and reviews with other clients.
Quality of service and support:
Reviewing reports documenting service provider’s performance regularly.
Documenting and following-up on any service problem in a timely manner.
Reviewing system update procedures to ensure appropriate change controls are in place.
Evaluating provider’s ability to support and enhance credit union’s strategic direction.
Assessing adequacy of training provided to credit union employees.
Meeting with service provider to discuss performance and operational issues periodically.

## OutsourcingOversight

*Monitor key indicators:*
*Contract compliance and required revisions *
*Access to credit union’s systems *
*Business contingency plans*

**Notes:**
Contract compliance and required revisions:
Reviewing invoices thoroughly to assure proper charges. 
Evaluating performance and determine whether service/monetary credits are due to credit union because of poor performance. 
Maintaining documents and records regarding contract compliance, revision and dispute resolution.
Access to credit union’s systems:
Denying full, unrestricted access to credit union’s systems. 
Granting access only upon request and with explanation. 
Monitoring the service provider’s activity when system access is requested and granted. 
Ensuring, if possible, fixes and updates to applications are applied to a test environment and tested by credit union personnel before being migrated to production.
Business contingency plans:
Reviewing service provider’s contingency plan to ensure any mission critical services provided to credit union can be restored within an acceptable timeframe. 
Considering participating in service provider’s contingency testing procedures for reassurance. 
Ensuring service provider dependence on other third parties is considered for mission critical services and applications.

## OutsourcingService Level Agreements

*Clearly outline any service level agreements (SLAs) based on defined standards*
*Formal SLAs help to ensure outsourced vendor provides an appropriate level of service to credit union*
*SLAs should be confirmed by all parties involved and kept current*

**Notes:**
Goals of SLAs might include:
Clear definition of functional service requirements 
Fair cost allocation to users or third parties 
Efficiency and effectiveness improvements 
Justification of budgets, investments, etc.
Examples of SLAs:
Network availability 
System response time 
Turnaround time for problem resolution, including completion of ad hoc reporting requests 
Agreed communication channels 
Responsibilities to resolve grievances 
Types of corrective action taken to resolve service level deficiencies, including service/monetary credits and termination

## Other Issues

*Security*
*Privacy*
*Business Continuity*
*Regulation (Federal & State)*
*etc...*

## e-Commerce: Do You Dare?

*?*