What data do you need to protect? How can you make data security systems easier for your users and harder for hackers to infiltrate?听
These are two of the most important questions bank leadership should ask when working with IT teams on enterprise-wide security solutions. According to IBM鈥檚 2022 Cost of a Data Breach report, the average cost of a data breach in the U.S. is $9.4 million, largely due to successful phishing attacks, business email compromise and stolen or compromised credentials.听
Users have to create a password for every online account or system access point and it鈥檚 cumbersome to keep track of them all. For convenience, they may write the information down on a piece of paper kept in a desk drawer, reuse the same password over and over or store the details in an unencrypted text file on their computer. Any of these scenarios is a security red flag that opens the door to data compromise.听听
A passwordless future is on the horizon; passwords may be replaced with a combination of biometrics, such as fingerprint or facial scans, and web security protocols like an authenticator app for mobile devices. Until that technology can be introduced to your organization, consider other options.听
Password Vault, Manager or Locker encrypts and securely stores usernames and passwords. Users access the 鈥渧ault鈥 using a master password. The vault generates and stores a long, random, and complex password to log in to a specific account or application which users do not need to remember. The upside is users only need to remember one 鈥渕aster鈥 password so it鈥檚 likely to be more complex and harder to guess or steal. Users should secure their vaults with multi-factor authentication (MFA) and passphrases at least 20 characters long. Many vaults alert users to phishing attempts (that try to convince users to reveal credentials) so they avoid clicking on suspicious links or downloading malicious attachments. The downside is that if a cybercriminal gets the master password, for example, if it鈥檚 stored on a computer inadequately protected against keyloggers and other malware, they can gain access to multiple accounts, data sources and systems.听听
Passphrases are longer passwords, usually at least 20 characters, comprised of three to five random words without any special characters, numbers or other complexity, that don鈥檛 need to be grammatically correct. An example of a passphrase is 鈥渘ow jump Cat here t0o鈥 It鈥檚 unique and easy for the user to remember and more difficult for the attacker to break. In other words, the more entropy 鈥 lack of order or predictability 鈥 the better.听听
Multi-factor Authentication (MFA) is a way of confirming someone attempting to login by combining two or more 鈥渇actors鈥 such as something you have (a hard token or device), something you know (a password), somewhere you are (sitting in your offices), and/or something you are (a fingerprint or retinal scan), according to the Cybersecurity and Infrastructure Security Agency (CISA). While MFA offers a higher level of security, it can still be circumvented by a skilled attacker. For example, despite using MFA with push notifications to an app, Uber experienced a significant phishing attack in November 2022 during which a cybercriminal impersonated an Uber IT professional and contacted an Uber employee telling them to log in to the app. The attacker used 鈥渂rute force鈥 to repeatedly spam the log in attempts, causing multiple push notifications, and sent a 鈥漨essage from IT鈥 that there was an ongoing system issue and the user needed to accept the notification. The attacker then added their device to the user鈥檚 account, scanned Uber鈥檚 intranet and discovered a text file with an administrator account鈥檚 username and password. From there, it is believed (though unconfirmed) they were able to compromise many of Uber鈥檚 systems.听
Takeaway Tips听
Work with your in-house or outsourced IT experts to proactively establish protocols that protect the integrity of your data and systems:听听
- Implement password vaults听
- Implement passphrases when a long, random and complex password cannot be generated by a password vault听
- Assume phishing attacks will persuade users to divulge information and design and implement controls to prevent them听
- Configure MFA to prevent brute force attacks like the Uber experience听
- Move away from so-called 鈥淢an in the Middle鈥 vulnerabilities by discontinuing the use of one-time passwords and push notifications, and moving toward hardware tokens听
- Train, train and train some more, ideally three to four times per year听
- Test, test and test some more (organizations that tested their cybersecurity plans saved an average of $2.6 million per data breach compared to those that didn鈥檛 test, according to the IBM report)听
Contact your 熊猫视频 advisor or email us at [email protected] for a detailed review of your financial institution鈥檚 needs. We鈥檒l design a customized suite of managed security, managed IT and cloud and network solutions that ensure compliance and give you the confidence that your organization鈥檚 data, and your customer鈥檚 confidential information, are protected.听
Continue the discovery:
