About Us | Contact Us
View Cart

Your Next Assignment: Customer Awareness

By Vigilize | Wednesday, August 20, 2014 - Leave a Comment

78% of Consumers Think CyberSecurity is Not Their Problem

Now that our perimeters are hardened, now that our information security programs are fine-tuned and working, and now that our users practice basic information security habits thanks to the hard work and efforts of the past decade . . . . we need to focus where the rest of the residual risk remains: our customers.

The good news is that other industries are onto this fact.   For example, an article in the on-line magazine, “Retail Customer Experience,” is what inspired this Dan’s New Leaf post.  According to a study conducted by Kaspersky, 78% of us don’t think we need to worry about cyber attacks. We simply don’t believe that we’re on the “bad guys'” radar.

This highlights one of the most important, and difficult, tasks that financial institutions face: Customer Education. While the FFIEC finally started calling for this in the June 2011 Supplement to the 2005 Guidance on Authentication in an Internet Banking Environment (we just love typing all that out), much more work needs to be done than the five bullet points called for in the Supplement.

As a refresher, the supplement requires that we provide the following information to our customers:

1) An explanation of protections provided, and not provided, to account
holders relative to electronic funds transfers under Regulation E, and a
related explanation of the applicability of Regulation E to the types of
accounts with Internet access;

2) An explanation of under what, if any, circumstances and through what
means the institution may contact a customer on an unsolicited basis and
request the customer’s provision of electronic banking credentials;

3) A suggestion that commercial online banking customers perform a related
risk assessment and controls evaluation periodically;

4) A listing of alternative risk control mechanisms that customers may
consider implementing to mitigate their own risk, or alternatively, a listing
of available resources where such information can be found; and,

5) A listing of institutional contacts for customers’ discretionary use in the
event they notice suspicious account activity or experience customer
information security-related events.

We believe that Customer Education can be leveraged to increase our reputation, mitigate legal risk (and put us in a better position when we have to settle), and reduce our fraud losses.  Why?  Besides “we have to do it anyway, let’s do it right,” a better answer is . . . . “we’ve seen user education substantially reduce risk in our institutions, just think what it can do outside our institutions.”

Branchless banking is here to stay.  Our “user base” is no longer just our employees.  And thus, if we were to add three additional bullet points to the FFIEC requirements listed above, they would be:

1) Create a multi-disciplinary approach to tackling Customer Education.  Your marketing, e-banking, and information security personnel need to band together.

2) You’re not going to accomplish it all in a day.  Utilize multiple channels of communication to “trickle” awareness messages to your Customers . . . . social media, your website, alert banners on your website, statement stuffers, flyers in your branches, ACH contracts, focused training for ACH/Wire Transfer Originators, and (most importantly) your front-line employees (who are now trained to provide such messaging.)  Posters and signs are also effective.  Be careful to distinguish between awareness messages and awareness alerts.  Be lavish with the prior and reserved with the latter.  (You don’t want to be seen as the boy that cried wolf!)

3) Start identifying resources of information and content that can be used to feed your message trickle.   We sure hope you’re already aware of our user awareness blog, but other resources abound.  Some of our better competitors in this realm include bankershub.net, bankinfosecurity.com.  Meanwhile, I have fallen in love with Mindful Security.

(Notice how I’ll link out to them but not my competitors!)

Like board, management, technical, and user awareness training . . . Customer Education is not going to be an easy task if you want to do it right.  But I believe the rewards . . . . not only in risk mitigation, but also in improved reputation . . . . will be as great, if not greater.

Let’s get out in front of the “amateurs” from the retail industry.  We bankers can take the bull by the horn and train our customers.

Good luck!


Written by Dan Hadaway CISA
Founder and Managing Partner, infotex

The article about the Kaspersky study is here.

Dan’s New Leaf” is a “fun blog to inspire thought in the area of IT Governance.”

Latest News
    Artificial intelligence carries risk, but so does organic ignorance … Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . At a recent conference, I noticed two camps emerging in the debate over artificial intelligence. Some people embrace AI as a tool, while others support Elon […]
    PRESS RELEASE – FOR IMMEDIATE RELEASE BUSINESS NEWS NEW EMPLOYEE FOR INFOTEX We are pleased to announce the appointment of Nathan Taylor as our new Network Administrator at infotex.  “We are very excited to have Nathan join our team as a Network Administrator and look forward to his contributions to maintaining and improving our infrastructure!” […]
    about artificial intelligence . . . And who will protect us from it . . .  Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . Just watched some press on the the Senate hearings over regulating AI. The normal senator faces, Sam Altman of OpenAI, […]
    The Evolution of an Inside Term Used in our Vendor Risk Report Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . Those who audit infotex know that our vendor risk report refers to a couple of our providers as “ransomware companies.” This reference started evolving […]
    Another awareness poster for YOUR customers (and users). Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Check out posters.infotex.com for the whole collection! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape) You are welcome to print out and distribute this around your […]
    New tools could allow unskilled attackers to launch increasingly sophisticated attacks… An article review. Imagine a world where you receive a call from your boss asking you to assist them with something… only it’s not your boss, but an AI being used by an attacker.  This isn’t science fiction, it’s an actual attack that has […]
    Unavailability Strikes Where it doesn’t matter anyway Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . So, I’m writing today’s article from a resort in the middle of Wisconsin.  I want to make sure I’m staying on top of my New Leaf, which is to […]
    . . . and the importance of segregated response. The latest edition of Executive Vice President, Michael Hartke’s article series! In 2007 when I first joined infotex, coming from small to medium sized business general IT support into the world of cybersecurity, the one thing that was very hard for me to internally rectify was […]
    How concerts can help us understand APTs . . . Especially if you use your imagination! Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . My daughter reminded me of a concert Stacey and I attended way back in 2013, in Chicago.  It was one […]
    Mutiny! The Malicious Insider Threat Webinar Registration A Webinar-Video It is often awkward to bring up the one attack vector most of us have not addressed. The malicious insider threat. Even if we can flaunt all statistics and claim that the likelihood of an insider attack is low in our bank, the impact is still […]