About Us | Contact Us
View Cart

Your Next Assignment: Customer Awareness

By Vigilize | Wednesday, August 20, 2014 - Leave a Comment

78% of Consumers Think CyberSecurity is Not Their Problem


Now that our perimeters are hardened, now that our information security programs are fine-tuned and working, and now that our users practice basic information security habits thanks to the hard work and efforts of the past decade . . . . we need to focus where the rest of the residual risk remains: our customers.

The good news is that other industries are onto this fact.   For example, an article in the on-line magazine, “Retail Customer Experience,” is what inspired this Dan’s New Leaf post.  According to a study conducted by Kaspersky, 78% of us don’t think we need to worry about cyber attacks. We simply don’t believe that we’re on the “bad guys'” radar.

This highlights one of the most important, and difficult, tasks that financial institutions face: Customer Education. While the FFIEC finally started calling for this in the June 2011 Supplement to the 2005 Guidance on Authentication in an Internet Banking Environment (we just love typing all that out), much more work needs to be done than the five bullet points called for in the Supplement.

As a refresher, the supplement requires that we provide the following information to our customers:

1) An explanation of protections provided, and not provided, to account
holders relative to electronic funds transfers under Regulation E, and a
related explanation of the applicability of Regulation E to the types of
accounts with Internet access;

2) An explanation of under what, if any, circumstances and through what
means the institution may contact a customer on an unsolicited basis and
request the customer’s provision of electronic banking credentials;

3) A suggestion that commercial online banking customers perform a related
risk assessment and controls evaluation periodically;

4) A listing of alternative risk control mechanisms that customers may
consider implementing to mitigate their own risk, or alternatively, a listing
of available resources where such information can be found; and,

5) A listing of institutional contacts for customers’ discretionary use in the
event they notice suspicious account activity or experience customer
information security-related events.

We believe that Customer Education can be leveraged to increase our reputation, mitigate legal risk (and put us in a better position when we have to settle), and reduce our fraud losses.  Why?  Besides “we have to do it anyway, let’s do it right,” a better answer is . . . . “we’ve seen user education substantially reduce risk in our institutions, just think what it can do outside our institutions.”

Branchless banking is here to stay.  Our “user base” is no longer just our employees.  And thus, if we were to add three additional bullet points to the FFIEC requirements listed above, they would be:

1) Create a multi-disciplinary approach to tackling Customer Education.  Your marketing, e-banking, and information security personnel need to band together.

2) You’re not going to accomplish it all in a day.  Utilize multiple channels of communication to “trickle” awareness messages to your Customers . . . . social media, your website, alert banners on your website, statement stuffers, flyers in your branches, ACH contracts, focused training for ACH/Wire Transfer Originators, and (most importantly) your front-line employees (who are now trained to provide such messaging.)  Posters and signs are also effective.  Be careful to distinguish between awareness messages and awareness alerts.  Be lavish with the prior and reserved with the latter.  (You don’t want to be seen as the boy that cried wolf!)

3) Start identifying resources of information and content that can be used to feed your message trickle.   We sure hope you’re already aware of our user awareness blog, but other resources abound.  Some of our better competitors in this realm include bankershub.net, bankinfosecurity.com.  Meanwhile, I have fallen in love with Mindful Security.

(Notice how I’ll link out to them but not my competitors!)

Like board, management, technical, and user awareness training . . . Customer Education is not going to be an easy task if you want to do it right.  But I believe the rewards . . . . not only in risk mitigation, but also in improved reputation . . . . will be as great, if not greater.

Let’s get out in front of the “amateurs” from the retail industry.  We bankers can take the bull by the horn and train our customers.

Good luck!

Dan


Written by Dan Hadaway CISA
Founder and Managing Partner, infotex

The article about the Kaspersky study is here.


Dan’s New Leaf” is a “fun blog to inspire thought in the area of IT Governance.”

Latest News
    How Do We Know What We Know? Making Sure You Can Understand What Happened in an Incident. Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . Until I reclined on my front yard, looking at the sky, following the instructions on how not to look […]
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape)   You are welcome to print out and distribute this around your office. Interested in one of ours […]
    President Biden recently signed a bill tasking the agency with evaluating the unique risks that schools face… An article review. Taking note of the unique challenges educational institutions face in securing their networks, President Biden has signed a bill into law directing the Cybersecurity and Infrastructure Security Agency (CISA) to look into ways that they can […]
    Thanks for being interested in our Technology Planning Webinars! This year‘s annual update to our annual Technology Planning webinar will include a panel discussion, a review of the previous years’ movies that are already available, and a discussion about alternative tactics that have arisen from recent conferences as well as the impact of the AIO […]
    Welcome Cybersecurity Conference Attendees! Thanks for joining us for the Cybersecurity Conference today! We have created this page for you to have access to the deliverables from Dan’s talk.  
    What you need to know for compliance coast-to-coast. Back in 2020 we posted an article containing links to data breach laws from each state, and it has proven to be one of our more popular posts.  Because laws surrounding the use (and abuse) of technology are always evolving, we thought it was worth taking another […]
    Why It Rhymes With SEEM (And its Not the I Before E Rule) Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . It’s the Gestalt. The idea that the whole is greater than the sum of it’s parts. That’s not something that is often brought […]
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape)   You are welcome to print out and distribute this around your office. Interested in one of ours […]
    Questions about China’s new disclosure laws only highlight the uncertainty about disclosure in general… An article review. China recently made waves in the security world by announcing a new set of data security laws, one of which has added new fuel to a long running debate: how and when should security vulnerabilities be disclosed…and to […]