# Presentation: 555203

## TOP IT Security IssuesAn Examiner’s Perspective

- Matthew Biliouris, Information Systems Officer – E&I

- Regions I & II - Nashville

## EFS Products & Services

- _TRADITIONAL EFS_

- ATM
- WIRE TRANSFER
- ACH
- Automated Telephone Response Systems

**Notes:**
CU Times Story (12/02/2003): ATM Processor Hacked, Threatened With Extortion
A U.S. based ATM processor has been hacked and is facing extortion from the perpetrators. “Apparently a third-party ATM processor had part of their database hacked into. The individuals who obtained the information are now trying to extort the processor,” said Vince Wagner, risk management specialist in CUNA Mutual’s Protection Division. The perpetrators are threatening to publish consumers’ personal financial information or use it to defraud consumers if the processor doesn’t pay up. “It appears the compromised information is being used offshore,” said Wagner, in countries such as Hong Kong, Italy, Australia, Great Britain and others. Wagner said he was unsure how many credit unions were affected. He said affected CUs will be notified by their card processors if their members’ information was compromised.

Windows ATMs raise security concerns (12/03/2003)
Last week's revelation by Diebold Inc. that its automated teller machines (ATM) operated by two financial services customers were struck by the W32/Nachi worm raises the specter of even wider disruptions from virus and worm outbreaks and highlights a growing security concern that cash machines running Windows XP and interacting with other Windows systems are vulnerable to attack.
The security problems on ATM networks come as many banks worldwide are migrating off of an older generation of machines using IBM's OS/2 operating system to new systems running Windows.
The mass migration is spurred by a number of factors, said Ann All, editor of ATMmarketplace.com, an online publication covering the ATM market. They include IBM's decision to stop supporting OS/2 by 2006, market pressure from creditors such as MasterCard International Inc. and Visa International Inc. to introduce stronger Triple Data Encryption Standard encryption, and pressure from U.S. regulators to introduce new features for disabled users.

## EFS Products & Services

- _TYPICAL INTERNET-BASED EFS_

- A/C History Review
- Account Transfers
- Applications
- Withdrawal Requests

## EFS Products & Services

- _NEWER ON-LINE EFS_

- Bill Payment / Presentment
- Account Aggregation
- Statement & Disclosure Delivery
- Check Imaging
- Credit Card Statement Access
- Downloads to Financial Software

**Notes:**
Downloads: Quicken, Microsoft Money, etc.

## Account Aggregation

**Brokerage**

**CUs/Banks**

**401K**

**taxes**

**Credit Cards**

**Airline Miles**

**Bills**

**Travel**

**E-Mail**

**Shopping**

**Account Aggregation**

## Types of Web Sites

**Informational Sites**
**Marketing Info**
**Interactive Sites**
**Secure Messaging**
**Loan Applications**
**Account Inquiry**
**Fully Transactional Sites**
**Financial Transactions (transfer funds, pay bills, etc.)**

## Credit Union Industry Statistics

## Credit Union Industry Statistics

**Notes:**
The year over year growth rate is about 15%.
Credit unions report almost 15.1 million members using on-line transactional services.  This represents a year over year growth rate of 25%. 

## Credit Union Industry Statistics

## Credit Union Industry Statistics

**Notes:**
This graph shows that the 39% of credit unions with an interactive/transactional type site represent 90% of FICU assets.
The 46% of credit unions without a site represent only 4% of FICU assets.
The 15% of credit unions with an informational site represent 6% of FICU assets.
Not surprisingly, this tells us that it is the smaller credit unions that are lagging in e-Commerce technology implementations.  This is a factor of there relative sophistication and resource levels.  However, we’ve previously seen credit unions with as little as $1 million in assets report a transactional site.  
The barriers to entry for small credit unions is eroding yearly.  Vendors continue to reduce pricing as competition grows.  Most vendors either offer their own solution or have partnered with a third-party to offer e-Commerce services to their members.  

Outlook

25% of those credit unions with out a site are planning to implement one.  Most of those sites will be informational. 
Credit unions with informational sites will continue to migrate to interactive/transactional sites for provide increased services for their members.
Likely to see increased adoption of statement/disclosure delivery and access to share draft images.  Also think that as vendors consolidate for bill payment and account aggregation, we may see increased penetration as well.  One of our larger credit unions is working with Master Card to implement a low cost electronic bill payment service.  If successful, it could make the service more attractive and affordable for credit unions.

## 2004 CSI/FBI Survey

***Security Trends***
_**2004 Computer Security Institute & FBI Survey**_
- 494 Security practitioner responses
- 19% of responders from financial services industry

**Notes:**
With regards to security, We do not have much cu specific data available. 
Credit unions are not required to report such incidents to NCUA.
But we do have some stats from the latest annual CSI & FBI survey. 

## Key Findings

- Unauthorized use and financial losses declined
- Virus and denial of service top cost
- Law enforcement reporting declined
- Security audits used
- Security outsourcing low
- Sarbanes-Oxley impact
- Security training needed

**Notes:**
2004 Findings:
Unauthorized use of computer systems is on the decline, as is the reported dollar amount of annual financial losses resulting from security breaches.
Both virus attacks and denial of service outpaced the former top cost, theft of proprietary information. Virus costs jumped to $55 million.
The percentage of organizations reporting computer intrusions to law enforcement over the last year is on the decline. The key reason cited for not reporting intrusions to law enforcement is the concern for negative publicity.
Over 80 percent of the organizations conduct security audits.
The majority of organizations do not outsource computer security activities. Among those organizations that do outsource some computer security activities, the percentage of security activities outsourced is quite low.
The Sarbanes-Oxley Act is beginning to have an impact on information security in some industries.
The vast majority of the organizations view security awareness training as important, although (on average) respondents from all sectors do not believe their organization invests enough in this area

## Respondents

**Notes:**
Respondents:
Respondents: 494 Security Practitioners (U.S. Corporations and Government).
Responses were anonymous.
Security Officer/Manager/Director 53%; System Administrator 9%; CIO 8%; CSO 6%; CEO 4%; Other 19%.
Types of organizations surveyed included:
corporations;
financial institutions;
government agencies; 
medical institutions; and
universities.

## Percentage of IT Budget Spent on Security

*2004: 481 Respondents/97%*

**Notes:**
46% of respondents spent between 1% and 5% of their IT budget on security.
16% of respondents spent less than 1% of their IT budget on security.
Only 7% of the respondents indicated that they outsourced 40% or more of the security function.

## Unauthorized Use

**Notes:**
Positive Trend-Decline in Yes’s and increase in No’s.
Concerns:
Over 50% with unauthorized use.
Over 10% still don’t know.

## Breach Frequency

## Website Incidents

**Notes:**
Seems to indicate that once compromised, companies are implementing patches quicker to prevent additional incidents.

## Types of Losses

**Notes:**
Total losses reported declined.
Respondents generally either unable or unwilling to estimate the dollar losses.

## Computer Intrusions Actions Taken

**Notes:**
High patch rate.
Low reporting (law enforcement and legal counsel).

## Computer Intrusions Not Reported

**Notes:**
Suspicious Activity Report Filing:
 Insider abuse involving any amount.
Violations aggregating $5,000 or more where a suspect can be identified.
Violations aggregating $25,000 or more regardless of a potential suspect.
Transactions aggregating $5,000 or more that involve potential money laundering or violations of the Bank Secrecy Act.
Computer Intrusion:
For purposes of the SAR, computer intrusion is defined as gaining access to a computer system of a financial institution to:
a. Remove, steal, procure or otherwise affect funds of the institution or the institution’s customers;
b. Remove, steal, procure or otherwise affect critical information of the institution including customer account information; or
c. Damage, disable or otherwise affect critical systems of the institution.

## NCUA Strategic Plan 2003-2008

-   Goal #2:
- Facilitate the ability of credit unions to safely integrate financial services and emerging technology in order to meet the changing expectations of their members.

**Notes:**
2.2: Provide a regulatory environment, which encourages credit unions to safely integrate, operate and effectively manage existing and emerging financial service technology.

##    Frequent Question

-     Does NCUA expect all credit unions to develop and implement e-Commerce services?

**NO!**

-  NCUA encourages credit unions to _consider_ offering e-Commerce services.

**Notes:**
Staffing:
Safety & Soundness Examiners
Focus: Credit union examinations.
Training: Regional Conferences, 2000
IS&T Subject Matter Examiners
Focus: Credit union examinations, credit union IS&T reviews, credit union vendor reviews (participants).
Training: 2 classes in 2001, 1 class in 2002
Conferences: 2002, 2003, 2004 being planned.
Web Based: Tier I converted, 2 classes held (one for SSAs), Tier II to be converted in 2004. Focus: New IS&T SMEs, DEs who wish a deeper understanding of IS&T issues/concerns.
Information Systems Officers
Focus: Credit union examinations, credit union IS&T reviews, credit union vendor reviews (lead), FFIEC ISV examinations.

**Notes:**
Audits:
Types: Financial, Security, SAS70s, Penetration Testing, etc.
Frequency of audits.

## Risk Assessment Process

## Electronic Financial Services

- _Areas of Risk_
- Transaction/Operational
- Compliance
- Reputation
- Strategic

## IS&T Exam Procedures

- Before implementing product/service:
- Seek education as to the benefits & risks.
- Determine if risks are acceptable.
- Determine regulatory compliance requirements.
- Ensure a legal review of contracts.
- Assess the adequacy of staff expertise (technical, managerial, member service).

## IS&T Exam Procedures

- Before implementing product/service (cont’d):
- Assess the adequacy of staff expertise (technical, managerial, member service).
- Determine best in-house/outsourcing solution.
- Evaluate necessary security measures.
- Research available bond coverage.
- Seek expert assistance when necessary.

## IS&T Exam Procedures

- Before implementing product/service (cont’d):
- Complete due diligence of vendors.
- Involve all interested operational & audit functions in planning & implementation.
- Develop audit & performance mechanisms.
- Create or revise related policies and procedures.

## Gramm-Leach-Bliley Act – 501(b)
Outlines Specific Objectives
Requires NCUA establish standards for safeguarding member records

**Security Programs**

- Gramm-Leach-Bliley Act – 501(b)
- Outlines Specific Objectives
- Requires NCUA establish standards for safeguarding member records

## Security Programs

- Credit Unions Must Have Process in Place to:
- Ensure Security & Confidentiality of Member Records
- Protect Against Anticipated Threats or Hazards
- Protect Against Unauthorized Access
- Specifically Stated in §748.0(b)(2)

## Slide 32

## Security Programs

- Appendix A – Guidelines for Safeguarding Member Information
- Involvement of Board of Directors
- Assess Risk
- Manage & Control Risk
- Oversee Service Providers
- Adjust the Program
- Report to the Board

## Security Programs

- Response Program Guidance
- Increasing Number of Security Events
- Congressional Inquiries
- GLBA Interpretation
- FFIEC Working Group
- Revise Part 748-Add New Appendix B

## Security Programs

- Credit Unions Must Have Process in Place to:
- Ensure Security & Confidentiality of Member Records
- Protect Against Anticipated Threats or Hazards
- Protect Against Unauthorized Access
**Respond to Incidents of Unauthorized Access to Member Information**

## Slide 36

## Security Programs

- Appendix B – Guidance on Response Programs
- Components of a Response Program
- Assessing Incident
- Notifying NCUA/SSA
- Notifying Law Enforcement Agencies
- Containing/Controlling Incident
- Notifying Affected Members

## Security Programs

- Appendix B – Guidance on Response Programs
- Content of Member Notice
- Account/Statement Review
- Fraud Alerts
- Credit Reports
- FTC Guidance

## PART 748 APPENDIX B

- Conflict with State Law – e.g., California Notice of Security Breach statute
- Requires notice to California residents when unencrypted member information is or may have been acquired by unauthorized person
- Gramm Leach Bliley Preemption Standards:  no intent to preempt where state law provides greater consumer protections

## NCUA Expectations

- Potential Questionnaire:
- Incorporated into Overall Security Program
- Escalation Process / Incident Response
- Review of Notices – Attorney Review?
- Enterprise Wide Approach
- Reporting to Senior Management
- Member Outreach / Awareness Programs
- Employee Training Programs

## “Phishing”

## “...The use of digital media also can lend fraudulent material an air of credibility. Someone with a home computer and knowledge of computer graphics can create an attractive, professional-looking Web site, rivaling that of a Fortune 500 company...”

*Arthur Levitt*
*Former Chairman of the SEC*

**Quotes**

## Quotes

- “Bogus e-mails that try to trick customers into giving out personal information are the hottest, and most troubling, new scam on the Internet.”
* **Jana Monroe*
* **Assistant Director*
*Cyber Division of FBI*

## Phishing 101

- Phishing uses e-mail to lure recipients to bogus websites designed to fool them into divulging personal data.

## Phishing 101

- E-mail
- Spoofed address
- Convincing
- Sense of urgency
- Embedded link (but not always)

## Phishing Trends

_**Anti-Phishing Working Group**_**Industry association focused on eliminating the identity theft and fraud that result from the growing problem of phishing and email spoofing. **_**APWG Members**_**- Over 400 members****- Over 250 companies****- 8 of the top 10 US banks****- 4 of the top 5 US ISPs****- Over 100 technology vendors****- Law enforcement from Australia, CA, UK, USA**_** **_

## Phishing Trends

- Source: Anti-Phishing Working Group Phishing Attach Trends Report s- March 2004 & May 2004

## Phishing Trends

**Phishing Trends**

## Examples (June 2004)

**Examples (June 2004)**

## Examples (June 2004)

**Examples (June 2004)**

## Examples (June 2004)

**Examples (June 2004)**

## Examples (June 2004)

**Examples (June 2004)**

## Examples (March 2004)

- Source: Anti-Phishing Working Group Phishing Archive

## Examples (March 2004)

- Source: Anti-Phishing Working Group Phishing Archive

## Examples (May 2004)

- Source: Anti-Phishing Working Group Phishing Archive

## Training / Policy Development
Awareness
Handling complaints & reports of suspicious e-mails/sites 
Protect on-line identity of credit union
Response Plan

- Awareness
- Handling complaints & reports of suspicious e-mails/sites
- Protect on-line identity of credit union
- Response Plan

**Phishing Action Plans – Employee Education**

## Communication Methods
Internet Banking Agreements
Newsletters 
Statement Stuffers 
Recordings when on “hold”
Website (FAQs / Advisories / Links)

- Internet Banking Agreements
- Newsletters
- Statement Stuffers
- Recordings when on “hold”
- Website (FAQs / Advisories / Links)

**Phishing Action Plans – Member Education**

## Action Plan Ideas - Education

## Action Plan Ideas - Education

## Action Plan Ideas - Education

## Content
We will never ask for xxx via e-mail
We will never alert you of xxx via e-mail
Always feel free to call us at # on statement
Always type in our site URL (see statement / newsletter / previous bookmark)

- We will never ask for xxx via e-mail
- We will never alert you of xxx via e-mail
- Always feel free to call us at # on statement
- Always type in our site URL (see statement / newsletter / previous bookmark)

**Phishing Action Plan Ideas – Member Education**

## Content (cont’d)
Sites can be convincingly copied
Report suspicious e-mails & sites 
Where to get more advice on phishing
Importance of patching
How to validate site (via cert or seal)
Where to go for ID theft help

- Sites can be convincingly copied
- Report suspicious e-mails & sites
- Where to get more advice on phishing
- Importance of patching
- How to validate site (via cert or seal)
- Where to go for ID theft help

**Phishing Action Plan Ideas – Member Education**

## Considerations:
Keep certificates up-to-date
Practice good domain name controls
Don’t let URLs lapse
Purchase similar URLs / Search for similar URLs

- Keep certificates up-to-date
- Practice good domain name controls
- Don’t let URLs lapse
- Purchase similar URLs / Search for similar URLs

**Phishing Action Plan Ideas – ****Protection of CU’s Online Identity**

## NCUA

(8/03) LTR 03-CU-12 Fraudulent Newspaper Advertisements, and Websites by Entities Claiming to be Credit Unions

(04/04) LTR 04-CU-05 Fraudulent E-Mail Schemes

(05/04) LTR 04-CU-06 E-Mail & Internet Related Fraudulent Schemes Guidance

FFIEC Agency Brochure

- (8/03) LTR 03-CU-12 Fraudulent Newspaper Advertisements, and Websites by Entities Claiming to be Credit Unions
- (04/04) LTR 04-CU-05 Fraudulent E-Mail Schemes
- (05/04) LTR 04-CU-06 E-Mail & Internet Related Fraudulent Schemes Guidance
- FFIEC Agency Brochure

**Phishing Resources**

## Action Plan Ideas - Education

## Action Plan Ideas - Education

## NCUA

Related guidance:
(12/02) LTR 02-CU-16 Protection of CU Internet Addresses
(7/02) LTR 02-FCU-11 Tips to Safely Conduct Financial Transactions Over the Internet
(09/01) LTR 01-CU-09 Identity Theft & Pretext Calling

Working with External Sources

Article in NCUA News

- Related guidance:
- (12/02) LTR 02-CU-16 Protection of CU Internet Addresses
- (7/02) LTR 02-FCU-11 Tips to Safely Conduct Financial Transactions Over the Internet
- (09/01) LTR 01-CU-09 Identity Theft & Pretext Calling
- Working with External Sources
- Article in NCUA News

**Phishing Resources**

## Inside the Examiner’s Playbook

- Think Globally
- Vendor Management
- Security Program (Part 748)
- Employee Remote Access
- Risk Assessment

- Patch Management
- IDS/Incident Response
- Virus Definition Updates
- BCP
- Formal Policies

## Slide 69

## Slide 70

## Slide 71

## Slide 72

## Slide 73

## Slide 74

## Slide 75

## Slide 76

## Slide 77

## FFIEC IT Handbook

## FFIEC IT Examination Handbook

- Development & Acquisition
- Management
- Operations
- Outsourcing
- Retail Payment Systems
- Wholesale Payment Systems

- Issued:
- BCP
- Information Security
- Supervision of TSPs
- Audit
- E-Banking
- Fedline

## Slide 80

## Slide 81

## Slide 82

## Slide 83

## Slide 84

## Slide 85

## Slide 86

## Contact Information:

- Matthew Biliouris
- 703-518-6394
- _[matthewb@ncua.gov](mailto:matthewb@ncua.gov)_

**Questions??**