A recent sentiment survey asked community bank and credit union clients about their biggest worries heading into 2020. The answers clustered around three areas: security in banking, compliance, and technology, ranging from exams and audits to cyber threats, business continuity, and disaster recovery. What follows walks through ten real bank security examples spanning those three areas, along with what institutions are actually doing to address each one.

Security

Security was the biggest source of worry by a wide margin, specifically cybersecurity, information security, and ransomware.

Cybersecurity

NCUA Chairman Rodney Hood has said cybersecurity is the issue that keeps him up at night. That’s not an exaggeration for most institutions. Protecting computer systems, networks, programs, and other resources from hackers who want to access, alter, or destroy sensitive data is a constant, ongoing challenge, and the hackers’ goals are straightforward: extort money, disrupt normal business, or damage a company’s reputation.

The numbers back that up. Financial services firms are 300 times more likely to be hit by a cyber-attack than companies in other industries, according to a Boston Consulting Group report. The industry also carries the highest cost from cybercrime of any sector, averaging $18.3 million per company, according to Accenture’s 2019 Cost of Cybercrime Study. And the attacks keep climbing: the global cybersecurity market is expected to top $300 billion by 2024, according to reporting in the Credit Union Journal.

Building a Strong Cybersecurity Program

With the right program in place, financial institutions can meet regulatory expectations and protect their systems, networks, and electronic data with real confidence. Two tools do a lot of that work: the FFIEC’s Cybersecurity Assessment Tool (CAT) and the NCUA’s Automated Cybersecurity Examination Tool (ACET). Both are voluntary, industry-specific assessments that help institutions identify their risk level and gauge how mature their cybersecurity program is. Using a standardized toolset sharpens an institution’s risk awareness and helps align risks with controls in a way that improves its cybersecurity posture.

Banks and credit unions can also draw on other accepted standards to build their program: the NIST Cybersecurity Framework, COBIT 5.0, and ITIL/ISO 27001, used on their own or together. None of these are built specifically for financial institutions the way the CAT and ACET are, which is worth keeping in mind when deciding how much weight to give them.

Information Security and Data Breaches

Information security and cybersecurity get used interchangeably, but they’re not the same thing. Information security is about the integrity, confidentiality, and availability of information in any form, protecting digital and physical data from unauthorized access, use, disclosure, disruption, modification, or destruction. The most serious threats here are data breaches, malware, and phishing. A data breach means sensitive or protected information gets accessed or disclosed when it shouldn’t be, often through malware that disrupts or damages a computer system. What follows can include lost customer loyalty, reputational damage, and lost revenue that stretches on for years. Some companies never fully recover.

Phishing works differently: attackers use fraudulent emails and websites to get people to hand over credit card numbers, passwords, account data, and other personal information. Financial institutions are frequent targets, engineered specifically to trick people into disclosing what they shouldn’t. Half of all organizations affected by observed phishing domains were in financial services, according to Akamai Technologies’ 2019 State of the Internet/Security Financial Services Attack Economy Report.

Whether the weapon is malware or phishing, data breaches keep growing in frequency and severity, one of the more persistent threats to the banking industry today. U.S. data breaches rose from 1,257 in 2018 to 1,473 in 2019, a 17 percent increase, according to the Identity Theft Resource Center’s End-of-Year Data Breach Report. Banking, credit, and financial industries accounted for 11 percent of those breaches, and more than 25 percent of all malware attacks struck banks and other financial services organizations, more than any other industry.

The financial damage is substantial. The average cost of a breach in the United States has climbed to $8.19 million, according to the IBM Security and Ponemon Institute’s 2019 Cost of a Data Breach Study. And per CU Insight, credit unions that experience a breach lose an average of 12 percent of their members in the aftermath.

Strengthening Information Security

Security threats find their way in through a lot of different vulnerabilities, which is why a layered approach works better than any single measure. Common layers include patch management, asset and configuration management, vulnerability scanning and penetration testing, endpoint security, resilience controls, logging and monitoring, and secure software development, according to the FFIEC IT Handbook’s Information Security booklet.

Still, people are often the first and best line of defense against a cyber-attack, which makes training essential. Teaching staff how to spot a suspicious email, link, or website goes a long way toward strengthening an institution’s security. Navanta has reviewed decades of third-party vulnerability assessments, including penetration and social engineering testing, and found a clear pattern: the more security awareness training an institution provides, the lower its phishing success rate. An institution’s approach to security, in the end, comes down to what it’s protecting, along with its own vulnerabilities, operations, and strategic goals.

Ransomware

Ransomware threatens every type of organization, which is exactly why it ranked as one of the survey’s top worries. It typically spreads when someone downloads an attachment from a phishing email or visits an infected website. From there, it encrypts a victim’s data and demands a fee, sometimes hundreds of dollars, sometimes thousands, before it will decrypt anything. Once the attack starts, it’s nearly impossible to stop, and victims may never get their data back even after paying. What follows is usually a business outage, operational chaos, and sometimes a second round of fraud on top of the first.

Ransomware attacks doubled last year, according to McAfee. It’s become such a costly problem that the FBI issued a public warning about it in October 2019, noting that attacks have grown more targeted, sophisticated, and costly even as the overall volume has leveled off, with broad, indiscriminate campaigns giving way to fewer, more damaging ones.

Defending Against Ransomware

There are effective ways to protect against ransomware, and the most important one is also the most obvious: keep the operating system patched and current. Fewer vulnerabilities means fewer places for hackers to get in, and attacks that do come are easier to stop.

Keeping malware software current is another simple step that helps detect ransomware and other malicious programs before they spread. Whitelisting software can block unauthorized applications from installing or running at all. Backing up files won’t stop ransomware, but it makes recovery possible if an attack does get through. The FBI has said as much directly: a strong system of backups is the single most important defense against ransomware, and the time to invest in that, and in other cyber defenses, is before an attacker strikes, not after.

None of this stops at an institution’s own walls, either. Third-party providers’ physical and data security standards need to hold up too, per guidelines in the FFIEC IT Handbook’s Information Security booklet. A gap in a provider’s security program becomes the institution’s problem the moment it’s exploited.

Compliance

Compliance protects an institution’s integrity, reputation, profitability, and longevity, which is exactly why it weighed so heavily on survey respondents’ minds. Violating compliance laws can mean fines, financial losses, bank failures, even prosecution, all of which put the integrity of the financial system at risk. Banks and credit unions operate differently from one another, but staying compliant with the major banking laws and regulations, including credit union cyber security compliance requirements, is non-negotiable for all of them. The specific worries respondents named most often: keeping up with regulatory trends, managing exams and audits, separating duties correctly, and maintaining business continuity.

Changing Regulatory Trends

The regulatory environment doesn’t hold still, which makes it hard for a lot of institutions to keep up. The financial burden is steep: credit unions spend at least $6.1 billion a year complying with regulations, according to CUNA’s 2016 Regulatory Burden Financial Impact Study, still the most recent research available. Those costs, staff time, third-party expenses, depreciation of capitalized assets, land hardest on smaller institutions. Three-quarters of community banks have had to hire additional staff just to keep up with new regulations, according to the American Bankers Association.

Banks have hired more people just to stay ahead of enforcement actions, fines, and penalties. Banks spend $270 billion a year on compliance industry-wide, according to International Banker, which reported that compliance accounts for 10 percent or more of most banks’ operating costs, with some estimates projecting those costs to double by 2022.

Staying compliant means adapting as trends shift, not just reacting after the fact. Regulators are holding senior management increasingly accountable for their firm’s compliance, professional standards, and culture, according to Deloitte’s Banking Regulatory Outlook 2020. Policymakers and regulators, meanwhile, are dealing with their own challenge: keeping pace with the speed and scale of technological change.

Meeting Regulatory Compliance Head-On

Institutions that stay proactive about compliance get real advantages out of it: better service delivery, lower structural costs, meaningfully less risk. But getting there means working through a long list of laws, rules, and guidelines. The Gramm-Leach-Bliley Act is a good example: it requires any company offering consumers financial products or services, loans, financial or investment advice, insurance, to explain its information-sharing practices and safeguard sensitive data.

Financial institutions also have to comply with the FFIEC’s guidelines and uniform practices, which set expectations across 11 key areas, including operations, business continuity management, information security, IT audit, IT management, electronic banking, and outsourcing technology services. Depending on their charter, institutions also answer to one or more regulatory bodies: the FDIC, the Federal Reserve System, or the Office of the Comptroller of the Currency.

RegTech, the broad category of companies and tools built to address regulatory challenges, has become another option worth considering. Flexible RegTech solutions can automate and simplify compliance processes: combining real-time information with algorithms and analytics, generating reports tailored to examiner expectations, backing up data remotely in the Cloud. Simplifying those processes ends up reducing the effort, cost, and stress of compliance all at once.

Examinations and Audits

Exams and audits are a necessary part of compliance, and they can be genuinely intimidating for financial institutions. The two overlap in some areas but differ in nature and scope. The FDIC conducts bank examinations to protect public confidence in the banking system and safeguard the Deposit Insurance Fund, evaluating an institution’s management, financial statements, and loan risk to confirm operations are both legal and financially stable.

Audits run longer, often several months, and check compliance with federal laws, jurisdictional regulations, and industry standards. Auditors run tests, present findings, and recommend what the bank should fix.

Preparing for Exams and Audits

There’s real preparation banks and credit unions can do to meet examiner expectations. Compliance officers should start by reviewing all the guidance relevant to their institution and staying current on anything that could affect them, recent changes to internal technology infrastructure, updated risk assessments for customer-facing electronic banking. Previous exam reports deserve another look too, so officers can speak to any comments or matters that needed attention, and to what’s changed since. Institutions should also be ready to show examiners exactly how they identify, track, and respond to compliance issues.

Pairing a managed services provider with compliance applications built for financial institutions can automate a lot of the documenting, reporting, and exam prep. These tools keep up with regulatory changes, send reminders when items are due, and centralize everything for easier collaboration and reporting. A third-party expert who already understands the specific challenges financial institutions face can help interpret results, analyze gaps, and define an action plan. None of this guarantees an institution walks away with zero findings, but it lowers both the likelihood and the severity of the ones that do turn up.

Separation of Duties

Separation of duties is one of the more important internal controls in banking, designed specifically to reduce fraud and error. A lot of institutions have IT personnel double as the information security officer (ISO), but regulations require separation here. The ISO should sit independent of IT operations, acting as an enterprise-wide risk manager rather than a production resource inside IT. The core concern: the ISO is supposed to oversee the network administrator, and that oversight breaks down the moment the ISO also holds administrative responsibilities, which happens often at smaller institutions.

Getting Separation of Duties Right

The FFIEC IT Handbook’s Information Security Controls booklet lays out the standard here: ISOs should report directly to the board or senior management, with the authority, standing, and independence to do the job properly, and they should be independent of IT operations staff rather than reporting up through IT operations management.

Banks and credit unions that don’t have the internal resources to oversee IT administration staff can outsource the ISO role instead, per FFIEC guidance. A third-party virtual ISO strengthens IT capabilities while keeping the separation between IT roles that compliance requires. That decision should fit the institution’s broader strategic plan, not stand apart from it.

Business Continuity

Business continuity planning keeps a disaster, pandemic, or unplanned incident from taking down an organization’s core operations. For banks and credit unions, that planning carries even more weight. A cyber-attack, natural disaster, or human error doesn’t just disrupt one institution. It can ripple out across the financial sector.

For financial institutions, business continuity management means overseeing and implementing resilience, continuity, and response capabilities that protect employees, customers, and the products and services they rely on. It’s more than a recovery plan for after an event. The FFIEC IT Handbook’s Business Continuity Management booklet is clear that it also means maintaining the systems and controls that keep operations resilient day to day, with proactive measures built in to reduce disruption and strengthen a bank’s ability to recover in the first place.

Building Business Continuity That Holds Up

A business continuity management program should align with an institution’s operational and strategic objectives, not sit apart from them. The strongest approach is enterprise-wide and process-oriented, weighing technology, business operations, testing, and communication strategies together rather than as separate checklists. Business continuity belongs inside the institution’s risk management life cycle, not bolted onto it.

Business continuity planning is a continuous cycle, not a document to finish once. Institutions typically work through ten steps to build the plan, starting with overseeing and implementing resilience, continuity, and response capabilities, and ending with monitoring and reporting on those same activities. Running exercises and tests along the way is what confirms the procedures actually support the objectives they were built for.

The FFIEC released guidance in November 2019 that changed how pandemic planning fits into this picture. Institutions no longer need a separate pandemic plan. Instead, they’re expected to assess pandemic risk alongside every other disaster scenario, which means an institution’s BCM plan doubles as its pandemic plan. That plan needs to analyze how a pandemic would affect the organization, set recovery time objectives, build out a recovery plan, and define the specific triggers that activate it.

Automation is worth building into this process too, so the plan updates as guidance and regulations change instead of going stale. A business continuity program that works does both things at once: meets today’s requirements and stays ready for whatever compliance regulations do next.

Technology

Keeping up with technology takes constant effort, which is exactly why it topped the list of technology concerns in the survey. Disaster recovery and the Cloud weren’t far behind.

Keeping up with Changes in Technology

Institutions that fall behind on technology don’t just fall behind. They risk losing customers, reputation, profits, and eventually the ability to survive. Institutions that make good use of their technology see the opposite: better products, more efficient operations, real cost savings.

Institutions of every size depend on their IT network infrastructure for nearly every function they run, which is exactly why every piece of it needs to work well. Community banks and credit unions have been using bank security technology for a long time now, and many still struggle with network security, connectivity, patch management, cloud infrastructure, and training staff on all of it. Customers, meanwhile, keep raising the bar: biometric authentication, mobile wallets, and online, mobile, and voice banking are now expectations, not extras.

Keeping Pace With Technology

Technology changes fast enough that no single person can keep up with all of it alone. That’s the case for a managed services provider who understands the technical requirements of banking technology solutions, starting with the core platform. So many applications have to integrate with the core platform that designing an efficient network is nearly impossible without understanding it first. Because a managed services provider works closely with an institution’s staff every day, it matters that they bring real industry experience and technical knowledge, enough to act as a genuine extension of the bank or credit union, not just a vendor.

Training personnel matters just as much. Every employee, not just IT staff, should build technical skills that fit their specific role. The FFIEC requires institutions to train personnel on the technologies they use and the rules that govern them, and that training carries extra weight for anyone overseeing key controls like firewalls, intrusion detection, and device configuration, according to the FFIEC IT Handbook’s Information Security Controls booklet.

Industry associations, peer groups, and third-party providers are usually solid resources for continuing education and added technical or compliance expertise. User conferences add another layer, giving financial services professionals a chance to work directly with their technology providers and peer institutions while building their own knowledge.

Disaster Recovery

Disaster recovery is what gets an organization back up and running after a hardware failure, power outage, cyberattack, fire, flood, or natural disaster. Financial institutions need real provisions in place for restoring their IT infrastructure, data, and systems once a disaster hits.

The financial toll can be steep. An unplanned data center outage costs nearly $9,000 per minute on average, according to the Ponemon Institute. Smaller organizations feel it hardest: 90 percent of smaller companies fail within a year if they can’t resume operations within five days of a disaster, according to FEMA, and roughly 40 to 60 percent of small businesses never reopen at all.

Preparing for Disaster Recovery

Effective planning lets banks and credit unions respond to a disaster or emergency deliberately instead of scrambling, which limits the effect on both information systems and overall operations. That planning generally covers analyzing potential threats, assessing the technology needed, managing access controls and security, and running regular data recovery tests. It should also spell out how operations return to normal with as little disruption as possible, according to the FFIEC IT Handbook’s Business Continuity Management booklet.

There are also proactive steps that reduce the most common risks before they materialize: multiple redundant services to guard against a telecommunications outage, emergency generators at the institution and any alternative work locations, tested regularly, and more than one telecommunications provider spread across different locations.

A disaster recovery plan that’s solid and regularly tested, before anything happens, gets critical processes back up far more efficiently and cost-effectively than any improvised response ever could. Adequate insurance matters here too. It won’t control risk or stop a catastrophe from happening, but it can reimburse an institution for some or all of the financial losses that follow one.

Managed recovery services are another option worth considering. Partnering with a cloud-based provider for recovery services means data stays available because systems can be accessed and restored quickly from any location. It also removes the need for duplicate data centers and backup locations, and it lets an institution expand services as its systems grow instead of rebuilding from scratch.

The Cloud

The Cloud lets users reach software, services, files, and data online from any internet-capable device. It’s a vast, interconnected network of remote servers, and it gives financial institutions real benefits: flexible capacity at a lower capital cost, portability, network resilience, better availability, and stronger business continuity. Moving applications to the Cloud does mean a different set of security risks than running a local data center. But providers like Microsoft Azure and Amazon Web Services bring security expertise and some of the best data centers in the world to the table, which can strengthen an institution’s overall security posture rather than weaken it.

Cloud adoption keeps growing as more institutions look to move applications there, drawn by fewer time-consuming IT tasks, faster infrastructure growth, and lower disaster recovery costs. That trend isn’t slowing down. Gartner projects the cloud services industry to grow at nearly three times the rate of overall IT services through 2022.

Moving to the Cloud Well

Moving to the Cloud well starts with due diligence, according to Carnegie Mellon University’s Software Engineering Institute. Institutions need a full understanding of their networks and applications before they can build a Cloud strategy that aligns with corporate strategic goals, and before they can work out how to deliver functionality, resilience, and security for whatever gets deployed there.

Managing access matters just as much: identifying and authenticating users, assigning access rights, and enforcing access control policies for every resource. Because the Cloud runs on consumption-based pricing, institutions need to review usage reports regularly instead of getting surprised by a bill. Safeguarding data is its own essential area, protecting it from unauthorized access, keeping critical data available through errors and failures, and making sure data that’s supposedly deleted doesn’t resurface by accident.

Monitoring infrastructure and services is a shared responsibility. The cloud service provider monitors the infrastructure and services it provides, but not the systems and applications customers build on top of them. That leaves institutions responsible for making sure their provider’s physical and data security standards meet or exceed their own, per guidelines in the FFIEC IT Handbook’s Information Security booklet. A reliable managed services provider makes staying on top of all of this considerably easier.

Conclusion

Every concern in this survey is serious, and every one of them can be addressed with the right processes, strategies, and resources in place. Community banks and credit unions that don’t have the internal resources to manage all of it on their own can bring in a qualified, industry-specific third-party provider. Navanta believes every financial institution, regardless of size, should have access to the technology it needs to serve its community well. That includes:

• IT support and managed services
• Internal network and cloud design and installation
• Secure hosted email
• Business continuity and disaster recovery
• Virtual ISO
• Security services
• Next-generation firewall
• Rogue actor detection
• Endpoint protection

The goal behind all of it is simple: less time worrying about the network, more time banking.