Cyber-Security Is Center Stage

Sen. Elizabeth Warren (D-Mass.) met with credit union executives following her general session address. The group discussed regulatory burden, cybersecurity and other key issues that concern credit unions.

Image source: Article

Cybersecurity emerged as the most prevalent theme, however, and every general address speaker covered the topic.

Do you share other CU executives' concern about cybersecurity?

Preparing for E-Discovery

One of the critical steps in managing litigation is properly handling electronically stored information, or “ESI.”

Image source: Article

The seismic shift to ESI is a significant challenge for businesses, but it doesn’t have to be overwhelming. Taking steps now to prepare for e-discovery will pay off in the future with significant savings in time and money. You can think about e-discovery in three stages: (1) prior to litigation; (2) anticipating litigation; and (3) during litigation.

Are you waiting until after you've been sued to think about e-discovery?

Hacking Update: Breach of Montana CU's Web Site Provides Vital Lesson

The recent hacking of a Montana credit union provides a stark lesson for CUs across the nation about the security of their web sites — namely that they aren't as secure as executives think.

Image source: Google Images

Last weekend, Southwest Montana Community FCU's web site was hacked by a group claiming to be the Islamic State (ISIS).

Read the full article>

MasterCard to Bring Biometric Security to Silicon Valley Credit Union

MasterCard is diving deeper into biometric security with a new credit union partnership, according to a Credit Union Times article by Roy Urrico. The company has teamed up with Silicon Valley’s First Tech Federal Credit Union.

Image source: Article

How the biometric technology will fit in with the rest of the security program is to be determined but MasterCard has confirmed that they will be exploring a multi-modal system employing face, fingerprint, and voice recognition.

Are you forward-thinking when it comes to biometric technologies?

The Best and Worst Credit Union Apps

Consumers want easy access to their funds and the ability to check balances on the go, make transfers in transit and deposit checks without heading into a local branch.

Image source: Article

Credit unions often get an unjust reputation as being behind the technological curve, but a 2014 analysis by Magnify Money shows 8 of the top 10 mobile banking apps were from credit unions.

Read the article to see which apps stand out from the rest. How do you stack up against the competition?

U.S. credit unions locked in cyber battle with their regulator

For Debbie Matz, the head regulator for 6,350 of the nation's credit unions, it's an easy answer: a cyber hacker sneaking in through a credit union vendor, cracking through to the larger U.S. financial system and wreaking havoc along the way.

Image source: Article

For years, Matz has warned about a general vulnerability of third-party vendors in U.S. financial markets, with little success.

Have you heeded the warnings?

XML Files Used to Distribute Dridex Banking Trojan

Cybercrooks have been leveraging malicious macros hidden inside XML files to distribute the Dridex financial malware, researchers have warned.

Image source: Article

It’s not uncommon for cybercriminals to use specially crafted Microsoft Office files that contain macros for malware distribution. However, attackers usually rely on Microsoft Word and Excel documents, not the XML (Extensible Markup Language) format.

Are you detecting these types of trojans?

Using Smart Phones to Improve Bank and Apple Pay Security

Recently, we've seen a lot of media coverage around Apple Pay being used for fraudulent activities by criminals with stolen identities and credit cards.

Image source: Article

Many of the articles highlight that fraud is stemming from a back door in the activation process called the “yellow path”. The yellow path is the process by which the bank can put the card activation on hold to do additional verifications.

Is your firm prepared to move beyond old fraud prevention technologies?

Post provided by:

How Same-Day ACH Transactions Will Affect Your Fraud Prevention Operations

by Damien Hugoo, Product Manager, Easy Solutions

The implementation of same-day Automated Clearing House (ACH) transactions has been getting a good amount of media attention lately. American Bankers Association (ABA) believes that widespread adoption of same-day ACH transactions represents a fundamental step to promote faster payments across the entire industry.

Image source: Article

Initial reaction has been that same-day settlement will pinpoint fraud more rapidly and as a result, customers will be alerted quicker. While part of this is true, there is major work to be done to pinpoint fraud faster.

In terms of fraud operations, right now most banks processes have a 2-day timeframe to tell the Federal Reserve that they want to return the ACH debit. With Same-Day ACH, banks will be forced to reengineer their entire fraud program and compress all their current processes into the 2-hour window. Subsequently, all ACH fraud prevention processes will have to start to be automated for those transactions.

Is your credit union prepared for these changes?

For information about real-time transaction monitoring download this whitepaper: An Introduction to Transaction Anomaly Detection.

Post provided by:

Apple Pay a haven for 'rampant' credit card fraud, say experts

Apple and its banker pals may have inadvertently lowered the barrier to credit card fraud by adding pay-by-wave technology to iPhones, security experts fear.

Image source: Article

Payment cards can be added to Apple Pay by taking a photo of the card, and allowing a device to run optical character recognition over the image to fill out the long card number, expiry dates and other details. These numbers can be entered manually, so physical access to a card is not needed.

Are you an early adopter putting your members at risk?

Brian Panicko demos CellTrust SecureLine for Good

With the integration of CellTrust SecureLine for Good and Good Work, financial advisors, agents, analysts, brokers and wealth managers can seamlessly and securely access corporate email, make secure phone calls to business contacts, and send secure text messages all from their personal device.

Because the employees’ personal devices are equipped with a second mobile business number, business and personal communications are kept separate and private.

Go to www.celltrust.com/finserv-good-knox/ to learn more about CellTrust SecureLine for Good for financial services organizations. Alternatively, if you're ready, give the app a try.

Mobile Security By The Numbers

As ubiquity of mobility paired with the availability of cloud continues to drive major technological disruptions within just about every type of enterprise transacting business today, CIOs and CISOs are increasingly put on notice to incorporate mobile into their security plans or risk irrelevance.

Image source: Article

Over the past several months, numerous surveys and studies have done a good job offering up some statistical proof points about the scope of the mobile security dilemma.

Read the article to see a collection of salient stats, including:

• Mobile Fraud Estimates: TeleSign
• Mobile Wild West: BlueBox
• Mobile Malware Tipping Point: Alcatel-Lucent
• Different Needs By Form Factor: Good Technology
• Mobile Payment Still Untrusted: Tripwire
• and more...

Secure credit cards: Retailers are on board, banks and credit unions lag

Government and the private sector don't always see eye to eye, but we're working together on an issue of great importance to Californians and all Americans: making credit card purchases safer.

Image source: Wikipedia

One crucial sector of the business community, however, has yet to fully buy in.

Why is it credit unions continue to provide their customers with outdated, riskier technology?

Three questions with a CU CEO on adapting to new technology

In October, the credit union had a soft opening of a new, innovative branch with only one employee. The branch features a computer touch screen table and wall, interactive loan consultation and an interactive teller machine (ITM) that video conferences in a remote representative.

Image source: Article

SEFCU President and CEO Michael Castellana said the credit union did not model the branch after any existing financial institutions.

Read the article to see how SEFCU is adapting to new technologies and read what is next for the credit union.

Windows? NO, Linux and Mac OS X Most Vulnerable Operating System In 2014

Apple’s operating system is considered to be the most secure operating system whether it’s Mac OS X for desktop computers or iOS for iPhones.

Image source: Article

But believe it or not, they are the most vulnerable operating system of year 2014. According to an analysis by the network and security solutions provider GFI, the top three most vulnerable operating system are: Apple’s Mac OS X, Apple iOS, and Linux kernel.

What operating system flavors are you using within your credit union?

Video Communication Isn't Just for Big Banks

The number of routine transactions conducted at community bank and credit union branches has gone down 10% annually over the past four years.

Image source: Article

Conversely, mobile traffic is skyrocketing with 50,000 customers downloading banks’/credit unions’ mobile apps each week and executing anywhere from 250 to 300 million online banking logins each month.

Customers are sending a message: Did you get it?

7 Reasons Millennials Are Turning to Credit Unions Instead of Banks

Reason 4: Mobile banking is the new norm - millennials gravitate toward technology and apps that are on the same level as big banks, and found that credit unions are offering “just as many” online services and apps.

Image source: Article

Some Millennials prefer to do all their banking from their cellphones and some feel that banks are not on par with their offerings. Switching to a credit union two years ago meant that Chris Kummer, 33, an associate account executive in public relations in Seattle, could keep using his favorite three financial apps and maintain the personalized service.

Is your credit union keeping up with the millennials needs and desires? Be sure to read the whole article for the other 6 reasons.

Hiring Hackers to Find Software Bugs

When it comes to finding and fixing software bugs, companies have a variety of priorities.

Image source: Article

But whether it’s protecting credit card data or personally identifiable information, securing intellectual property, or preventing online gamers from cheating, one fact remains: finding and fixing security bugs is difficult and labor intensive.

This article looks at the risks and rewards of offering software bug bounties to hackers.

IT's top 3 cloud migration errors

The good news is that most companies are now moving to the cloud; the bad news is that many are doing it poorly

Image source: Flickr

Despite all the best-practice information out there, huge mistakes are still widely made.

Have you migrated to the cloud? Did you do so successfully?

An updated list of the merchants, cards and apps that accept Apple Pay

Nineteen new banks and credit unions now support Apple Pay.

Image source: Article

These include: Affinity Federal Credit Union, Cabela’s CLUB, Central Bank, Credit Union of Southern California, Farmers & Merchants Bank of Long Beach, First National Bank of Omaha, First Sentry Bank, FirstBank, Grow Financial Federal Credit Union, Ideal Credit Union, Morgan Stanley, Redwood Credit Union, State Department Federal Credit Union, Teachers Credit Union, Technology Credit Union, The Northern Trust Company, TIB-The Independent BankersBank, United Federal Credit Union, and Utah First Federal Credit Union.

Read the article to see some of the businesses already using Apple Pay.

Morgan Stanley leads 20 new bank and credit union additions for Apple Pay

Apple continues to expand the reach of its popular mobile payment system, with the Cupertino company rolling out support for cards from nearly two dozen additional financial institutions — including major investment bank Morgan Stanley — on Wednesday.

Image source: Article

The addition of Morgan Stanley may seem odd, given that the firm offers no retail banking services, but that is not the case. Investment banks like Morgan Stanley often offer exclusive credit cards to customers who use the bank's wealth management services.

Read the article to see some of the more than 700 banks and credit unions that have signed up to integrate Apple Pay.

Cloud security certifications: How important are they?

More and more certifications are being created around cloud security. Expert Sean Martin looks at some of the more prominent certifications and examines their value.

Image source: Article

If you are a CSO working for a company that leverages cloud technologies to run its business, what should you look for in a candidate to add to your staff?

Read the article to of see what some of the top certifications are for cloud security.

Credit unions set to take on banks with launch of debit cards

Eleven of the largest credit unions in Ireland are set to launch debit card services, allowing them to compete head-on with banks by offering full current accounts.

Image source: Article

The move is set to transform the services offered by credit unions, which have been concentrated on small loans and savings facilities up to now.

How does your CU stack up to those in Ireland?

SMBs Prep for EMV Shift: How Ready is Your Business?

There is a lot of work involved in implementing [EMV], and some banks have decided to go with a simpler more expedient roll-out, and are still meeting the minimum requirements of the card association while avoiding the time and overhead costs of issuing pins.

Image source: Article

Long Island City, NY-based UNFCU was an early adopter of EMV and one of the only credit card companies that issues chip cards.

Are you EMV ready?

Bank Hackers Steal Millions via Malware

In late 2013, an A.T.M. in Kiev started dispensing cash at seemingly random times of day. No one had put in a card or touched a button. However, the errant machine appears to be the least of the bank’s problems.

Image source: Article

The scope of this attack on more than 100 banks and other financial institutions in 30 nations could make it one of the largest bank thefts ever — and one conducted without the usual signs of robbery.

No bank has come forward acknowledging the theft. Is your firm one of them?

Banking Trojan Dyreza sends 30,000 malicious emails in one day

A massive spam wave is installing banking Trojan Dyreza on tens of thousands of computers to steal sensitive financial data from unsuspecting customers.

Image source: Flickr

30,000 malicious emails were sent in just one day from spam servers in the UK, France, Turkey, US and Russia.

Read the article to learn more about server-side polymorphism.

App Economy Demands "Security-First"

Protection is still the main driver for security, but organizations understand the application economy demands a new view and approach to security.

Image source: Article

Key findings include the following: mobility matters, the desire to innovate quickly, new attitudes adopted, and increase in security investment.

Read the article to access additional details uncovered by the research.

A Credit Union Cyberattack Defense Manual

With the ever increasing risks that are associated with cyberattacks, companies across industries are realizing the importance of having a cybersecurity team.

Image source: Article

Cyber criminals are becoming more sophisticated, and they are able to hack into the biggest financial institutions across the globe, like JP Morgan Chase and HSBC. Any small dropping of the guard can result in catastrophic theft of customer financial records, business data and syphoning of a large amount of funds.

Have you dropped your guard?

The Day Memory Scraping Malware Lost

Every organization today is, or should be, concerned about the spread of dangerous malware being launched in targeted attacks. An example of a recent trend is the aggressive use of memory scraping malware by cyber-criminals against any organization that accepts credit cards – this incudes retail, healthcare, financial services, governmental entities and others. The headlines reflect the scale of the issue – every week there are new headlines of record setting data loss and credit card data theft in organizations of all sizes.

Image source: Wikipedia

The issue that causes the most concern about these damaging attacks is that each of these breached organizations had invested a great deal of money and effort to put in place and support a multi-layered in-depth security solution. In addition, they were in certified compliance with standards like PCI DSS, HIPAA, GLBA and other regulations. Doubt has surfaced for many organizations who are now wondering “If these large sophisticated companies that take security seriously were breached, how can I be safe?”

Networking Your Way to a Datacenter in the Cloud

As the dream of the fully virtualized data center comes closer to reality, the race is on to integrate SDN into the cloud stack.

Image source: Wikipedia

According to U.K. researcher Companies and Markets, an expanding cloud is expected to spur the growth of network fabric topologies as top organizations look to build key functions like continuous data availability, application flexibility and rapid architecture deployment.

What is your firm's place in the SDN cloud race?

Study: Cloud, Mobile Computing to Drive Financial Services Security Market Growth

Research and Markets has forecast the global market for cybersecurity offerings within the banking, financial services and insurance sector to yield a 13.14 percent compound annual growth rate through 2019.

Image source: Article

The increasing use of cloud security and mobile platforms is projected to drive the BFSI cybersecurity market’s growth over the next four years, the research firm said.

Does your firm use any of the firms profiled in the report? (BAE Systems, Booz Allen Hamilton, Computer Sciences Corp., FireEye, IBM and Symantec)

Mobile fraud hits enterprises in the pocket to tune of $240m, report finds

New survey data from mobile identity provider TeleSign has found that enterprises have lost up to $240m (£157.3m) a year because of mobile e-commerce fraud.

Image source: Article

The study, conducted by J. Gold Associates and sponsored by TeleSign and RSA, EMC’s security division, found average revenue loss due to mobile fraud was $92.3m per year (£60.54m).

Is your firm one of the many companies not prepared – or just not bothered – about potential repercussions with respect to the state of mobile security?

Cuba Fertile Ground for Credit Unions

If Dan Mica had his way, he would be on a flight to Cuba tomorrow to help establish the nation’s first credit unions and boost the financial wellbeing of the country’s 11 million citizens. But Mica, a former U.S. Congressman from Florida, former president/CEO of CUNA and current president of consulting firm The DMA Group, knows that such a process isn’t simple.

Image source: Article

A business-to-business connection between the U.S. and Cuba of any kind will have been a long time coming.

Is there a way to partner with another Credit Union based in Cuba?

iPhone Security Could Improve at NCUA: OIG Audit

The NCUA’s Inspector General recommended ways the agency could improve its security policies and controls regarding agency-issued mobile devices, such as iPhones, to enhance the protection of its data and resources.

Image source: Article

The NCUA had been issuing agency-owned iPhones to employees and contractors since April 2012, which could access the agency’s exchange server.

Do you agree with IG's recommendation that the NCUA supplement or enhance its existing mobile device security policies, controls and configuration settings by addressing the security measures, such as passcode guidance or controls, unauthorized applications, container-based encryption, bluetooth controls and QR codes?

North American bank IT spending climbs as firms invest in external services

Banks in North America are ramping up IT spending on retail banking services and digital channels this year, with total IT spend expected to reach $64.8 billion by 2016. The figures represent a 4.5% increase this year, as financial institutions increasingly turn to external software provider and specialists to bolster their abilities.

Image source: Article

IT security is expected to prove quite a struggle for banks in the coming years, as banks are effectively locked in an endless battle with fraudsters.

Where will your spending be focused in 2015?

Data Breaches Affect Credit Unions More Compared to Large Banks

The breach of data at retailers like Staples, Target and Home Depot have a crippling effect on the member services of the credit unions, namely as the expense of ensuring the privacy of customers post breaches is the responsibility of non-profit financial institutions. As one example, the Desert School Credit Union, in 2013, was forced to reissue about 40,000 credit and ATM cards after a data breach.

Image source: Article

CUNA, which claims to represent almost 90 percent of total US credit unions numbering almost 6,700, has plans to push the issue to the Congress and also seek the legislation to protect the values of members. The Dodd-Frank legislation also impacts the credit unions.

What is your position on this legislation?

Spike in Fake ID Schemes Confounds Banks' Fraud Filters

Identity fraud, especially so-called synthetic schemes that use completely or partly made-up identities, is on the rise and hitting banks hard. Using new techniques, hackers can stitch digital data together and sell it on the black market as a fully emulated debit card that allows an individual to walk up to an ATM, enter the PIN and withdraw cash.

Image source: Article

It is hard to measure the frequency of synthetic ID fraud, in large part because "there’s no self-reporting victim," notes Richard Parry, a consultant and a former security executive at JPMorgan Chase, Citigroup, and Visa.

Credit unions have an obligation to "know their customer". What is your firm doing to identify and combat identity theft and fraud for your members?

'Masquerading': New Wire Fraud Scheme

A new impersonation scheme is taking aim at business executives to perpetuate ACH and wire fraud, says Bank of the West's David Pollino, who explains steps institutions should take now to protect their customers.

Image source: Article

Once inside and posing as company executives, the criminals could send e-mails to the bank to request wire transfers from the business's account to a bogus account.

Is your firm susceptible to this attack?

Heartbleed Alert: Vulnerability Persists

The Heartbleed bug remains present on about 250,000 servers and other systems that connect to the Internet. Multiple security experts say that while they don't have the means to independently verify them, the continuing prevalence of Heartbleed bugs in systems does not surprise them.

Image source: Article

Heartbleed was fixed with OpenSSL version 1.0.1g, which was released on April 7, 2014, after which many enterprises went into furious patching mode, beginning with their OpenSSL-using Apache servers.

Have you addressed the Heartbleed bug yet?

When good security advice...isn't

Have you ever had one of those moments, while discussing security techniques with other clueful individuals, where one of you confesses to disagreeing with a common piece of advice? While it may be completely logical that you must account for context when giving appropriate advice, sometimes we may forget that we must also do this when we’re discussing security.

Image source: Article

Perhaps we should be asking ourselves more specific questions when we give others security decrees.

Is there any piece of common security advice that you find you disagree with?

AppSec California Top-Notch Training - Register Today and Save

Held again at the Annenberg Community Beach House on a fantastic stretch of beautiful Santa Monica beachfront property, AppSec California 2015 is sure to be a huge success as it’s bringing together multiple security experts from the likes of Veracode, LinkedIn, Twitter, Cigital, NCR, Qualcomm, Bugcrowd, Salesforce.com, and HackerOne. The speakers are all revved up and ready to getting us all thinking about our own contributions to information security as they engage with us during the West Coast’s leading InfoSec event.

Use the code sean25 and save 25% off training!
Register for the event

Image source: AppSecCali

And, if you sign up for a training, you will get another code for 50% off of the conference!

The breadth and depth of training and content available is sure to draw in huge crowds, likely topping the nearly 300 information security attendees from last year’s event. According to the event’s organizers, we can expect to see even more senior executives, technical experts, and information security practitioners participating this year.

Regardless of your role, you’ll find a plethora of content to be discussed and knowledge to be gained. Want to see more than what I’ve highlighted here? The full agenda can be viewed at https://2015.appseccalifornia.org/schedule/.

If you are interested in attending the event, be sure to register here (http://re4.ms/AppSec15). And, don't forget to use the sean25 savings code.

We hope to see you there!

Protecting Your Agile Data Center: You Can't Fight the New War With Old Tools

Data infrastructure and function has experienced a paradigm shift with the enterprise progressing steadily in the age of cloud, apps and mobility, marking the end of the “perimeter” era for the computing environment.With the proliferation of the cloud, mobile, and Internet of Things (IoT), information continues to be virtualized and mobilized, and blind spots unknowingly created, sitting undetected and vulnerable to new attack vectors.

Image source: Wikipedia

While most security technologies have not evolved over the past decade to meet this need, new cloud-based security technologies designed for the virtual, mobile and automated environments will protect data that old solutions fail to even see.

Is your firm ready for the next frontier?

10 Mobile Predictions For 2015

It’s always interesting to review and compare the concepts and product announcements presented at CES to my predictions. After nearly a week of gadget heaven, I can firmly state that nothing revealed at the show has changed my perspective.

Image source: Article

Prediction No. 1: 2015 will be the year of the enterprise mobile app and enterprise micro apps will grow into richer apps.

Be sure to read the remaining 9 predictions from Maribel Lopez!

Credit Union Deploys First Video Teller in Idaho

Pioneer Federal Credit Union in Mountain Home, Idaho, has deployed video teller technology to its ATMs, presumably the first financial institution in Idaho to deploy the virtual teller technology. Tellers will be able to use interactive video technology to take control of two new ATMs at the credit union's Boise branch, which recently opened. NCR Corporation of Duluth, Ga., will support the terminals.

Image source: Wikipedia

Video collaboration and transaction processing can both reduce operating costs by centralizing tellers across multiple branches, while still connecting customers and tellers in a face to face, highly personal engagement. NCR Interactive Teller helps free branch staff to focus on the service needs of customers visiting the branch.

Do you plan to use remote assisted service to bring a unique and efficient banking experience to their customers – without losing that human touch>

Six More Credit Unions on Apple Pay

Six more credit unions are now live in Apple Pay, bringing the total number in the industry to 15. Newcomers included the $550 million Consumers Credit Union in Kalamazoo, Mich., the $2.6 billion Virginia Credit Union in Richmond, Va., the $672 million Cyprus Credit Union in West Jordan, Utah, the $1.7 billion Fairwinds in Orlando, Fla., the $4 billion Mountain America Credit Union in West Jordan, Utah, and the $1.2 billion Partners Federal Credit Union in Burbank, Calif.

Image source: Wikipedia

Less than two dozen banks are now live in Apple Pay. Among them are Chase, Bank of America, Citi, and Wells Fargo.

Is your firm planning to support Apple Pay?

The Making of a Cybercrime Market

How two underground entities surfaced, battled, aligned, and ultimately extracted billions from some of the world’s largest financial institutions via unsuspecting, everyday banking client victims.

Image source: Article

As the events described unfolded, we begin to see into the business minds of the cybercriminals they described. This article looks at the how the business was formed, how it grew, and captures a list of best practices and lessons learned.

Don't miss this script-worthy story that is rooted in reality.

Bank Fraud Toolkit Circumvents 2FA & Device Identification

Another user-friendly attack toolkit is on the market, and it's perfect for the budding Brazilian banking fraudster. It's got an attractive, user-friendly interface that includes a "start phishing" button. And it effectively circumvents both two-factor authentication and device identification protections.

Image source: Article

The toolkit is distributed by being embedded in other malware. It comes preloaded with a list of targeted banking URLs. When the infected user visits one of those sites, the malware operator gets an alert and can then decide whether or not to proceed with an attack.

If the toolkit surfaces in English, is your firm prepared to detect the toolkit that leverages a malware infection, the use remote access tools, abnormal browser patterns, or other abnormal transactions?

Credit Union Watchdog Shoots Down Data Encryption Rule

Even after suffering a data breach, the organization in charge of overseeing the needs of credit unions has cast off the idea of implementing a rule mandating the use of encryption for data transfers.

Image source: Article

It’s expected the NCUA will make further decisions regarding shoring up its security as soon as its Inspector General concludes his look at the incident.

What is your firm's position on this topic?