About Us | Contact Us
View Cart

Your Next Assignment: Customer Awareness

By Vigilize | Wednesday, August 20, 2014 - Leave a Comment

78% of Consumers Think CyberSecurity is Not Their Problem


Now that our perimeters are hardened, now that our information security programs are fine-tuned and working, and now that our users practice basic information security habits thanks to the hard work and efforts of the past decade . . . . we need to focus where the rest of the residual risk remains: our customers.

The good news is that other industries are onto this fact.   For example, an article in the on-line magazine, “Retail Customer Experience,” is what inspired this Dan’s New Leaf post.  According to a study conducted by Kaspersky, 78% of us don’t think we need to worry about cyber attacks. We simply don’t believe that we’re on the “bad guys'” radar.

This highlights one of the most important, and difficult, tasks that financial institutions face: Customer Education. While the FFIEC finally started calling for this in the June 2011 Supplement to the 2005 Guidance on Authentication in an Internet Banking Environment (we just love typing all that out), much more work needs to be done than the five bullet points called for in the Supplement.

As a refresher, the supplement requires that we provide the following information to our customers:

1) An explanation of protections provided, and not provided, to account
holders relative to electronic funds transfers under Regulation E, and a
related explanation of the applicability of Regulation E to the types of
accounts with Internet access;

2) An explanation of under what, if any, circumstances and through what
means the institution may contact a customer on an unsolicited basis and
request the customer’s provision of electronic banking credentials;

3) A suggestion that commercial online banking customers perform a related
risk assessment and controls evaluation periodically;

4) A listing of alternative risk control mechanisms that customers may
consider implementing to mitigate their own risk, or alternatively, a listing
of available resources where such information can be found; and,

5) A listing of institutional contacts for customers’ discretionary use in the
event they notice suspicious account activity or experience customer
information security-related events.

We believe that Customer Education can be leveraged to increase our reputation, mitigate legal risk (and put us in a better position when we have to settle), and reduce our fraud losses.  Why?  Besides “we have to do it anyway, let’s do it right,” a better answer is . . . . “we’ve seen user education substantially reduce risk in our institutions, just think what it can do outside our institutions.”

Branchless banking is here to stay.  Our “user base” is no longer just our employees.  And thus, if we were to add three additional bullet points to the FFIEC requirements listed above, they would be:

1) Create a multi-disciplinary approach to tackling Customer Education.  Your marketing, e-banking, and information security personnel need to band together.

2) You’re not going to accomplish it all in a day.  Utilize multiple channels of communication to “trickle” awareness messages to your Customers . . . . social media, your website, alert banners on your website, statement stuffers, flyers in your branches, ACH contracts, focused training for ACH/Wire Transfer Originators, and (most importantly) your front-line employees (who are now trained to provide such messaging.)  Posters and signs are also effective.  Be careful to distinguish between awareness messages and awareness alerts.  Be lavish with the prior and reserved with the latter.  (You don’t want to be seen as the boy that cried wolf!)

3) Start identifying resources of information and content that can be used to feed your message trickle.   We sure hope you’re already aware of our user awareness blog, but other resources abound.  Some of our better competitors in this realm include bankershub.net, bankinfosecurity.com.  Meanwhile, I have fallen in love with Mindful Security.

(Notice how I’ll link out to them but not my competitors!)

Like board, management, technical, and user awareness training . . . Customer Education is not going to be an easy task if you want to do it right.  But I believe the rewards . . . . not only in risk mitigation, but also in improved reputation . . . . will be as great, if not greater.

Let’s get out in front of the “amateurs” from the retail industry.  We bankers can take the bull by the horn and train our customers.

Good luck!

Dan


Written by Dan Hadaway CISA
Founder and Managing Partner, infotex

The article about the Kaspersky study is here.


Dan’s New Leaf” is a “fun blog to inspire thought in the area of IT Governance.”

Latest News
    Reasons why we should be considered! infotex provides a number of services that can be checked out if you click over to offerings.infotex.com! We even made a movie with all the reasons why infotex should be your next MSOC!  
    infotex and GoTo To all infotex managed security service Clients: As recently reported by major news outlets there was a data breach affecting GoTo (formerly LogMeIn) wherein attackers stole encrypted backups containing customer information in November 2022.  Based on the advisory from GoTo the products they offer that are affected include LogMeIn Pro, LogMeIn Central, […]
    An option for increasing security for ALL organizations. . . The threat landscape is evolving daily, and it is becoming increasingly difficult for even large organizations providing cyber defense services to keep up. As Brandao (2021) notes, it is important for organizations to adapt holistic technologies that can correlate all attack events. Therefore, developing XDR […]
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Check out posters.infotex.com for the whole collection! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape) You are welcome to print out and distribute this around your […]
    A relic of the internet’s less secure past, many small firms struggle to secure their email systems… An article review. With a great deal of cybersecurity related news focused on new threats and similarly new techniques aimed at combating them, it can be easy to forget some of the older threats that have never gone […]
    Seven Trends . . . …that small bank Information Security Officers face in 2023 Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . Welcome to the Magnificent Seven, my annual predictive article about the seven trends in technology that will impact the Information Security Officers of […]
    System Security and Cybersecurity are not the same thing. . . Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . Regarding “information security,” the last thirty years have seen an evolution of frameworks, laws, and assessment approaches which intimidate the management team with their complexity.  […]
    The cryptographic algorithm is vulnerable to attack and is no longer considered secure… An article review. NIST has announced that it plans to retire the SHA-1 cryptographic algorithm by the end of 2030, citing multiple vulnerabilities in the standard, effectively ending its use after nearly 30 years.  Introduced in 1995, SHA-1 used a 160-bit hash […]
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Check out posters.infotex.com for the whole collection! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape) You are welcome to print out and distribute this around your […]
    Trending: Awareness Posters Meet Infographics Here are the top seven posters as of the last twelve months! As always, our Awareness Posters were a hit in 2022! So we decided to run some reports to see what our most popular posters were since November 2021. As everybody loves top ten lists and contests, we thought […]