iPhone Security Could Improve at NCUA: OIG Audit

The NCUA’s Inspector General recommended ways the agency could improve its security policies and controls regarding agency-issued mobile devices, such as iPhones, to enhance the protection of its data and resources.

Image source: Article

The NCUA had been issuing agency-owned iPhones to employees and contractors since April 2012, which could access the agency’s exchange server.

Do you agree with IG's recommendation that the NCUA supplement or enhance its existing mobile device security policies, controls and configuration settings by addressing the security measures, such as passcode guidance or controls, unauthorized applications, container-based encryption, bluetooth controls and QR codes?

North American bank IT spending climbs as firms invest in external services

Banks in North America are ramping up IT spending on retail banking services and digital channels this year, with total IT spend expected to reach $64.8 billion by 2016. The figures represent a 4.5% increase this year, as financial institutions increasingly turn to external software provider and specialists to bolster their abilities.

Image source: Article

IT security is expected to prove quite a struggle for banks in the coming years, as banks are effectively locked in an endless battle with fraudsters.

Where will your spending be focused in 2015?

Data Breaches Affect Credit Unions More Compared to Large Banks

The breach of data at retailers like Staples, Target and Home Depot have a crippling effect on the member services of the credit unions, namely as the expense of ensuring the privacy of customers post breaches is the responsibility of non-profit financial institutions. As one example, the Desert School Credit Union, in 2013, was forced to reissue about 40,000 credit and ATM cards after a data breach.

Image source: Article

CUNA, which claims to represent almost 90 percent of total US credit unions numbering almost 6,700, has plans to push the issue to the Congress and also seek the legislation to protect the values of members. The Dodd-Frank legislation also impacts the credit unions.

What is your position on this legislation?

Spike in Fake ID Schemes Confounds Banks' Fraud Filters

Identity fraud, especially so-called synthetic schemes that use completely or partly made-up identities, is on the rise and hitting banks hard. Using new techniques, hackers can stitch digital data together and sell it on the black market as a fully emulated debit card that allows an individual to walk up to an ATM, enter the PIN and withdraw cash.

Image source: Article

It is hard to measure the frequency of synthetic ID fraud, in large part because "there’s no self-reporting victim," notes Richard Parry, a consultant and a former security executive at JPMorgan Chase, Citigroup, and Visa.

Credit unions have an obligation to "know their customer". What is your firm doing to identify and combat identity theft and fraud for your members?

'Masquerading': New Wire Fraud Scheme

A new impersonation scheme is taking aim at business executives to perpetuate ACH and wire fraud, says Bank of the West's David Pollino, who explains steps institutions should take now to protect their customers.

Image source: Article

Once inside and posing as company executives, the criminals could send e-mails to the bank to request wire transfers from the business's account to a bogus account.

Is your firm susceptible to this attack?

Heartbleed Alert: Vulnerability Persists

The Heartbleed bug remains present on about 250,000 servers and other systems that connect to the Internet. Multiple security experts say that while they don't have the means to independently verify them, the continuing prevalence of Heartbleed bugs in systems does not surprise them.

Image source: Article

Heartbleed was fixed with OpenSSL version 1.0.1g, which was released on April 7, 2014, after which many enterprises went into furious patching mode, beginning with their OpenSSL-using Apache servers.

Have you addressed the Heartbleed bug yet?

When good security advice...isn't

Have you ever had one of those moments, while discussing security techniques with other clueful individuals, where one of you confesses to disagreeing with a common piece of advice? While it may be completely logical that you must account for context when giving appropriate advice, sometimes we may forget that we must also do this when we’re discussing security.

Image source: Article

Perhaps we should be asking ourselves more specific questions when we give others security decrees.

Is there any piece of common security advice that you find you disagree with?

AppSec California Top-Notch Training - Register Today and Save

Held again at the Annenberg Community Beach House on a fantastic stretch of beautiful Santa Monica beachfront property, AppSec California 2015 is sure to be a huge success as it’s bringing together multiple security experts from the likes of Veracode, LinkedIn, Twitter, Cigital, NCR, Qualcomm, Bugcrowd, Salesforce.com, and HackerOne. The speakers are all revved up and ready to getting us all thinking about our own contributions to information security as they engage with us during the West Coast’s leading InfoSec event.

Use the code sean25 and save 25% off training!
Register for the event

Image source: AppSecCali

And, if you sign up for a training, you will get another code for 50% off of the conference!

The breadth and depth of training and content available is sure to draw in huge crowds, likely topping the nearly 300 information security attendees from last year’s event. According to the event’s organizers, we can expect to see even more senior executives, technical experts, and information security practitioners participating this year.

Regardless of your role, you’ll find a plethora of content to be discussed and knowledge to be gained. Want to see more than what I’ve highlighted here? The full agenda can be viewed at https://2015.appseccalifornia.org/schedule/.

If you are interested in attending the event, be sure to register here (http://re4.ms/AppSec15). And, don't forget to use the sean25 savings code.

We hope to see you there!

Protecting Your Agile Data Center: You Can't Fight the New War With Old Tools

Data infrastructure and function has experienced a paradigm shift with the enterprise progressing steadily in the age of cloud, apps and mobility, marking the end of the “perimeter” era for the computing environment.With the proliferation of the cloud, mobile, and Internet of Things (IoT), information continues to be virtualized and mobilized, and blind spots unknowingly created, sitting undetected and vulnerable to new attack vectors.

Image source: Wikipedia

While most security technologies have not evolved over the past decade to meet this need, new cloud-based security technologies designed for the virtual, mobile and automated environments will protect data that old solutions fail to even see.

Is your firm ready for the next frontier?

10 Mobile Predictions For 2015

It’s always interesting to review and compare the concepts and product announcements presented at CES to my predictions. After nearly a week of gadget heaven, I can firmly state that nothing revealed at the show has changed my perspective.

Image source: Article

Prediction No. 1: 2015 will be the year of the enterprise mobile app and enterprise micro apps will grow into richer apps.

Be sure to read the remaining 9 predictions from Maribel Lopez!

Credit Union Deploys First Video Teller in Idaho

Pioneer Federal Credit Union in Mountain Home, Idaho, has deployed video teller technology to its ATMs, presumably the first financial institution in Idaho to deploy the virtual teller technology. Tellers will be able to use interactive video technology to take control of two new ATMs at the credit union's Boise branch, which recently opened. NCR Corporation of Duluth, Ga., will support the terminals.

Image source: Wikipedia

Video collaboration and transaction processing can both reduce operating costs by centralizing tellers across multiple branches, while still connecting customers and tellers in a face to face, highly personal engagement. NCR Interactive Teller helps free branch staff to focus on the service needs of customers visiting the branch.

Do you plan to use remote assisted service to bring a unique and efficient banking experience to their customers – without losing that human touch>

Six More Credit Unions on Apple Pay

Six more credit unions are now live in Apple Pay, bringing the total number in the industry to 15. Newcomers included the $550 million Consumers Credit Union in Kalamazoo, Mich., the $2.6 billion Virginia Credit Union in Richmond, Va., the $672 million Cyprus Credit Union in West Jordan, Utah, the $1.7 billion Fairwinds in Orlando, Fla., the $4 billion Mountain America Credit Union in West Jordan, Utah, and the $1.2 billion Partners Federal Credit Union in Burbank, Calif.

Image source: Wikipedia

Less than two dozen banks are now live in Apple Pay. Among them are Chase, Bank of America, Citi, and Wells Fargo.

Is your firm planning to support Apple Pay?

The Making of a Cybercrime Market

How two underground entities surfaced, battled, aligned, and ultimately extracted billions from some of the world’s largest financial institutions via unsuspecting, everyday banking client victims.

Image source: Article

As the events described unfolded, we begin to see into the business minds of the cybercriminals they described. This article looks at the how the business was formed, how it grew, and captures a list of best practices and lessons learned.

Don't miss this script-worthy story that is rooted in reality.

Bank Fraud Toolkit Circumvents 2FA & Device Identification

Another user-friendly attack toolkit is on the market, and it's perfect for the budding Brazilian banking fraudster. It's got an attractive, user-friendly interface that includes a "start phishing" button. And it effectively circumvents both two-factor authentication and device identification protections.

Image source: Article

The toolkit is distributed by being embedded in other malware. It comes preloaded with a list of targeted banking URLs. When the infected user visits one of those sites, the malware operator gets an alert and can then decide whether or not to proceed with an attack.

If the toolkit surfaces in English, is your firm prepared to detect the toolkit that leverages a malware infection, the use remote access tools, abnormal browser patterns, or other abnormal transactions?

Credit Union Watchdog Shoots Down Data Encryption Rule

Even after suffering a data breach, the organization in charge of overseeing the needs of credit unions has cast off the idea of implementing a rule mandating the use of encryption for data transfers.

Image source: Article

It’s expected the NCUA will make further decisions regarding shoring up its security as soon as its Inspector General concludes his look at the incident.

What is your firm's position on this topic?

IP Cameras: What’s Holding You Back?

If you are responsible for your credit union’s video surveillance system and are still using analog video cameras, you’ve probably been pushed at least once or twice to make the leap to IP video surveillance – or risk getting left behind in the ‘dark ages’.

Image source: Article

And it’s just as likely that you’ve already looked at the general benefits of an IP camera, weighed them against the increased system cost, and concluded that it wasn’t quite the right fit for your credit union just yet.

You wouldn’t be alone. There are several factors that can deter an organization from moving to IP video. Read a two-part blog from March Networks – America’s #1 provider of video surveillance solutions to banks and credit unions – to learn more about the pros and cons of IP video cameras.

Is now the right time for your credit union to adopt high-definition IP video surveillance?

'Remarkably Naive' as DDoS Threat Grows

Third-party experts and credit union executives—primarily speaking anonymously on the subject—said most credit unions have done nothing to protect themselves against the takedown threat, which has been increasingly linked with theft of funds at financial institutions.

Image source: Article

Two things have happened in the past year that may change how credit union executives view DDoS.

A vice president at a large Northwestern credit union said his institution relies on its online banking provider to handle DDoS mitigation. The results, so far, have been acceptable. Relying on vendors to secure critical systems may not be a cure-all, however.

What is your Credit Union's defense against DDoS?

Millions stolen from US banks after 'wire payment switch' targeted

Criminals have recently hijacked the wire payment switch at several US banks to steal millions from accounts, a security analyst says.

Image source: Article

The loses “added up to millions [lost] across the three banks".

The attack against the wire payment switch -- a system that manages and executes wire transfers at banks -- could have resulted in even far greater loses.

Have you followed the advice to "slow down" wire transfers?

Banks face jump in technology spending: report

Banks which have patched up their information technology (IT) systems too often in recent years face big increases in spending to modernize their operations for the digital age.

Image source: Article

But digital innovation should help offset the outlays by cutting the costs of new branches, which are likely to be 25 percent smaller and have a fifth fewer staff.

IT costs are likely to rise by about 10 percent over the next 10 years, broadly offset by a possible 5 percent fall in branch costs, analysts predicted.

What does your IT budget look like?

Advance Suggests Banking Encryption (RSA) Could Fall Within 5 Years

The encryption systems used to secure online bank accounts and keep critical communications private could be undone in just a few years, security researchers warned at the Black Hat conference.

Image source: Article

Breakthroughs in math research made in the past six months could underpin practical, fast ways to decode encrypted data that’s considered unbreakable today.

The sophisticated Flame malware discovered last year featured a completely new mathematical technique to defeat an encryption method used to verify some software updates as originating with Microsoft, allowing Flame to masquerade as legitimate software.

Are you concerned for the protection of your data?