IP Cameras: What’s Holding You Back?

If you are responsible for your credit union’s video surveillance system and are still using analog video cameras, you’ve probably been pushed at least once or twice to make the leap to IP video surveillance – or risk getting left behind in the ‘dark ages’.

Image source: Article

And it’s just as likely that you’ve already looked at the general benefits of an IP camera, weighed them against the increased system cost, and concluded that it wasn’t quite the right fit for your credit union just yet.

You wouldn’t be alone. There are several factors that can deter an organization from moving to IP video. Read a two-part blog from March Networks – America’s #1 provider of video surveillance solutions to banks and credit unions – to learn more about the pros and cons of IP video cameras.

Is now the right time for your credit union to adopt high-definition IP video surveillance?

'Remarkably Naive' as DDoS Threat Grows

Third-party experts and credit union executives—primarily speaking anonymously on the subject—said most credit unions have done nothing to protect themselves against the takedown threat, which has been increasingly linked with theft of funds at financial institutions.

Image source: Article

Two things have happened in the past year that may change how credit union executives view DDoS.

A vice president at a large Northwestern credit union said his institution relies on its online banking provider to handle DDoS mitigation. The results, so far, have been acceptable. Relying on vendors to secure critical systems may not be a cure-all, however.

What is your Credit Union's defense against DDoS?

Millions stolen from US banks after 'wire payment switch' targeted

Criminals have recently hijacked the wire payment switch at several US banks to steal millions from accounts, a security analyst says.

Image source: Article

The loses “added up to millions [lost] across the three banks".

The attack against the wire payment switch -- a system that manages and executes wire transfers at banks -- could have resulted in even far greater loses.

Have you followed the advice to "slow down" wire transfers?

Banks face jump in technology spending: report

Banks which have patched up their information technology (IT) systems too often in recent years face big increases in spending to modernize their operations for the digital age.

Image source: Article

But digital innovation should help offset the outlays by cutting the costs of new branches, which are likely to be 25 percent smaller and have a fifth fewer staff.

IT costs are likely to rise by about 10 percent over the next 10 years, broadly offset by a possible 5 percent fall in branch costs, analysts predicted.

What does your IT budget look like?

Advance Suggests Banking Encryption (RSA) Could Fall Within 5 Years

The encryption systems used to secure online bank accounts and keep critical communications private could be undone in just a few years, security researchers warned at the Black Hat conference.

Image source: Article

Breakthroughs in math research made in the past six months could underpin practical, fast ways to decode encrypted data that’s considered unbreakable today.

The sophisticated Flame malware discovered last year featured a completely new mathematical technique to defeat an encryption method used to verify some software updates as originating with Microsoft, allowing Flame to masquerade as legitimate software.

Are you concerned for the protection of your data?

Stolen credit cards... keep 'em. It's all about banking logins now

Crimeware-As-A-Service is a thing. Really.

Image source: Article

Stolen bank login information attracts an even higher price than credit card numbers on underground cybercrime bazaars.

The technical barrier to getting involved in cybercrime has been lowered thanks to various Cybercrime-As-A-Service offerings - including cybercrime-infrastructure-as-a-service, bulletproof hosting, password cracking and DDoS for hire offers.

What are your members' logins worth?

Don’t Get Caught! Schedule a Surveillance System Spring Clean

You don’t have to go far these days to hear stories in which video surveillance plays a critical role in catching the bad guys.

Image source: Article

Unfortunately, we’ve also seen how an organization can end up with a huge — and costly — headache when its video surveillance system isn’t working properly.

To avoid getting caught in an embarrassing and potentially serious situation, I recommend a little spring cleaning of your video surveillance system.

Has your CU done its spring cleaning yet?

FBI says more cooperation with banks key to probe of cyber attacks

Bank security officers and others were brought to more than 40 field offices around the country to join a classified video conference on "who was behind the keyboards."

Image source: Article

The extraordinary clearances, from an agency famed for being close-mouthed even among other law enforcement agencies, reflect some action after years of talk about the need for increased cooperation between the public and private sectors on cybersecurity.

How has your CU been affected?

CU InfoSecurity Conference 2013 in Las Vegas

The Credit Union InfoSecurity Conference, the original and premier conference dedicated solely to credit union security, is holding its next summit on June 5-7, 2013 at the Platinum Hotel and Spa in Las Vegas.

Register for the event

Image source: imsmartin

The conference, which features industry leaders in their respective fields sharing their firsthand knowledge and practical advice on securing credit unions, is an incredible opportunity to gain new insight, network with credit union peers, and browse the Security Vendor Reception.

Possible topics to be covered at the upcoming summit include mobile security, data forensics, insider threats, incident response, social engineering, secure cloud storage, virtual desktop security, and fighting banking fraud.

If you are interested in attending the event, be sure to register here (https://www.cunews.com/infosecurity-conference.html).

Gartner: Tablet shipments to outstrip PCs by 72% in 3 years

Three years from now, tablet computers will outsell traditional Windows PCs, and do so by a whopping 72%.

Image source: Article

Some of that decline will be made up by the faster growth in "ultramobiles," the new breed of Windows 8 devices such as Microsoft Surface Pro.

But the PC decline is permanent, reflecting a "long-term change in user behavior," according to the Gartner statement.

Where is your CU making your investment?

New malware goes directly to US ATMs and cash registers for card info

While many consumers already take precautions when shopping online, they may need to start being even more careful - as a new report shows malware is focusing on physical registers and ATMs compromised by attackers looking to harvest card data.

Image source: Article

The malicious code is evidently being installed directly into point-of-sale (POS) hardware (meaning registers or kiosks) and ATMs, and transmitting the harvested information straight out of the magnetic stripes on credit and debit cards - which includes everything from account numbers, to first and last names and expiration dates.

Are your CU's ATMs secure?

Google Chrome: Best security tips for safer browsing

There's a lot to like about Google Chrome's built-in security features.

Image source: Article

The browser offers unique sandboxing functions and privilege restrictions, and even updates itself in the background to help better protect you from hackers and malware.

But like all browsers, Chrome is imperfect, and there are steps you can take to protect it from attack.

Read the full article to see how to get the most from Chrome's built-in security features, and work around its security shortcomings.

Wells Fargo bank site attack disrupts service

Wells Fargo's online banking site was experiencing problems Tuesday, with a denial-of-service attack.

Image source: Article

This attack likely the reason behind the slowdowns for some customers trying to access the site.

This isn't the first time the bank site has been under a denial-of-service attack, where hackers inundate a website with traffic to delay or disrupt it.

Think your CU is safe? Think again.

Risk management becoming focus of bank boards

The majority of the boards of directors for large banks are spending significantly more time on risk management, according to a new survey.

Image source: Article

The survey, which was conducted in January using risk officers and directors at banks with more than $5 billion in assets, said 91 percent of those surveyed reported an increase in time devoted to risk management issues within board meetings over the last three years.

Seventy-two percent of risk officers and 63 percent of directors report that this time has doubled or tripled.

What is your board's position on risk management?

Hackers Set Time Bomb to Damage Targeted Banks and Broadcasters

The AhnLab Security Emergency Response Center (ASEC) and US headquarters of South Korea-based AhnLab confirmed a large series of cyber attacks that targeted banks and broadcasters in South Korea.

Image source: chaitanyak.deviantART

AhnLab said that attackers used stolen user IDs and passwords to launch some of the attacks.

The credentials were used to gain access to individual patch management systems located on the affected networks.

Does your CU have control over your patch management system?

Mobile location data 'present anonymity risk'

Scientists say it is remarkably easy to identify a mobile phone user from just a few pieces of location information.

Image source: Article

But a study in Scientific Reports warns that human mobility patterns are so predictable it is possible to identify a user from only four data points.

Recent work has increasingly shown that humans' patterns of movement, however random and unpredictable they seem to be, are actually very limited in scope and can in fact act as a kind of fingerprint for who is doing the moving.

Does your CU let its employees use location features on their smartphones?

Internet Explorer 8 Exploit Found in Watering Hole Campaign Targeting Chinese Dissidents

On March 16th, FireEye discovered a premeditated waterhole campaign that hosts exploits and malware on websites frequented by a specific target group.

Image source: Article

The attack exploits a fresh vulnerability (CVE-2013-1288, MS13-021) in Internet Explorer 8—just four days after Microsoft released a patch.

Why did attackers use a fresh vulnerability? Cost could be a factor. Zero-days tend to be expensive to either research or purchase on black markets.

Has your CU applied this patch?

Free Android malware analysis tool

Bluebox Labs announced Dexter, a free tool to help researchers and enterprise security teams analyze applications for malware and vulnerabilities.

Image source: Article

The increasing popularity of the Android platform has resulted in an explosion of applications, but with shortened development cycles, many are released without proper security analysis.

This often leads to undetected malware making it to market along with the app.

Does your CU worry about mobile malware?

Increased spy access to Americans' banking data raises privacy concerns

Spy agencies like the CIA and NSA would have access to a database used to fight domestic financial crime under a proposal being drafted by the Obama Administration.

Image source: Article

The database, among other things, catalogs bank deposits of $10,000 or more made by American citizens and anyone else doing business with a U.S. bank.

Opening up the federal database, known as the Financial Crimes Enforcement Network (FinCEN), to more government eyes would be a mistake, said J . Bradley Jansen, director of the Center for Financial Privacy and Human Rights (CFPHR) in Washington, D.C.

What is your CU's position on this topic?

3G and 4G USB modems are a security threat, researcher says

The vast majority of 3G and 4G USB modems handed out by mobile operators to their customers are manufactured by a handful of companies and run insecure software, according to two security researchers from Russia.

Image source: Wikimedia

Researchers showed how to attack the 3G and 4G USB modems at Black Hat Europe.

The researchers tested the software preloaded on the modems and found multiple ways to attack it or to use it in attacks.

How many USB modems does your CU use?

House Oversight Committee floats FISMA update

The leadership of the House Oversight and Government Reform Committee introduced a bill on March 14 to update federal information security regulations.

Image source: Article

The updated regulations are likely to include continuous monitoring of cybersecurity threats and regular threat assessments.

This update to FISMA will incorporate the last decade of technological innovation, while also addressing FISMA shortcomings realized over the past years.

Does your CU have to follow these rules?

The Dingo and the Baby

FireEye has been tracking an APT campaign for a while and we have noticed that this attack is currently active and targeting companies.

Image source: Article

In this case, the campaign uses the name of the company it targets in the CnC domain name.

What does this have to do with dingoes and babies? The title comes from a string that we saw in all of the malware, called LetsGo/Merong, and its variants.

Do you know where the dingo is?

Big Data Raises Authenticity Concerns

Big data is literally everywhere. It’s in the cloud and under the cloud, at rest and on the move, and growing at a mind-boggling rate.

Image source: Guardtime

IBM, a leader in big data analytics, has estimated that organizations create 2.5 quintillion bytes of data each day — and that 90 percent of the data in the world has been created in the last two years alone.

Thanks to cloud computing, petabytes of unstructured data are created daily online and much of this information has an intrinsic business value if it can be captured and analyzed.

Does your CU have big data security issues?

RSA 2013 The Age Of Security Commercialism

Walking on the RSA 2013 show floor, it was a chaotic, noisy, and energetic place, pulsing with excitement.

Image source: Article

The week heading to the conference was interesting to say the least; with Java 0-days wreaking havoc on the Internet and the Mandiant report taking every major newspaper headline, RSA could not have had a better set-up.

After the dust (and the smoke) settled, the Forrester security team came away with a number of unique impressions and takeaways.

Read the full article to learn more.

SharePoint 2013 Challenges and Questions for CIOs

SharePoint 2013 arrives with a new user interface and new collaboration, search, storage and task management features.

Image source: Article

But gaps remain in areas like social and mobile, and upgrading and governing SharePoint is still rife with challenges.

Good Technology's GoodShare is part of a comprehensive mobile collaboration solution which brings SharePoint & NAS to the financial industry.

Does your CU want SharePoint on mobile?

Security tracker displays cyber attacks in real time

Around 200,000 new varieties of viruses, trojans and worms are developed each day worldwide.

Image source: Article

That makes preventive cyber security even more important and having transparency when it comes to current risk potential is decisive.

To help, Telekom has launched its online portal, www.sicherheitstacho.eu.

Would your CU benefit from this information?

DDoS Attacks on Banks Resume

Izz ad-Din al-Qassam Cyber Fighters has launched a new wave of distributed-denial-of-service attacks against U.S. banks and credit unions, and experts say institutions can expect more incidents in the coming days.

Image source: Article

Hacktivists confirmed the attacks in a Feb. 26 post on the open forum Pastebin, claiming strikes against Bank of America, PNC Financial Services Group, Capital One, Zions Bank, Fifth Third, Union Bank, Comerica Bank, RBS Citizens Financial Group Inc. [dba Citizens Bank], People's United Bank, University Federal Credit Union, Patelco Credit Union and others.

Was your CU a target?

DDoS Becoming an Expensive Fact of Life

The ceasefire is over. Last week, on Feb. 25, the Cyber Fighters of Izz ad-Din al-Qassam renewed their Distributed Denial of Service attacks against U.S. financial institutions.

Image source: Flickr

That included again taking down the websites of two credit unions: the $1.5 billion University FCU in Austin, Texas, and Patelco, the $3.8 billion Pleasanton, Calif., institution.

What is new is that the conversation about how to respond to the industrial-grade DDoS unleashed by the Cyber Fighters is beginning to shift.

Is your CU ready to handle a DDoS?

FTC Endorses New Privacy Guidelines, Do Not Track for Mobile Apps, Devices

Hoping to ramp up privacy on mobile devices such as smartphones and tablets, the Federal Trade Commission (FTC) has released a series of suggestions to help app developers, advertising networks and device companies better protect their users online.

Image source: Article

The FTC is looking to get companies, particularly those that work in the facilitation of users’ personal information, to clamp down.

Ideally, users should also be able to review the types of information each application on their device can access in a one-stop dashboard.

What are your thoughts on this FTC report?

Big Bank Mules Target Small Bank Businesses

A $170,000 cyberheist last month against an Illinois nursing home provider starkly illustrates how large financial institutions are being leveraged to target security weaknesses at small to regional banks and credit unions.

Image source: Article

The attack on Niles Nursing Inc. provides a textbook example. On Monday, Dec. 17, 2012, computer crooks logged into the company’s online banking accounts using the controller’s credentials and tunneling their connection through his hacked PC.

At the beginning of the heist, the miscreants added 11 money mules to Niles’ payroll, sending them automated clearing house (ACH) payments totaling more than $58,000, asking each mule to withdraw their transfers in cash and wire the money to individuals in Ukraine and Russia.

In total, the attackers appear to have recruited at least two dozen money mules to help haul the stolen loot. Read the article to learn more.

Zeus hit five major banks in Japan

Zeus malware is considered the most popular and prolific malicious code for banking, it is one of the privilege agent by cybercrime the use to sell various customized version in the underground to conduct sophisticated fraud.

Image source: Article

Cyber criminals continue to use Zeus, it is considered one of the most dynamic cyber threats due the numerous variants and customization detected.

The malware is used to steal banking credentials, the attackers used a classic phishing schemes to spread the link to compromised web site, as usual they used drive-by downloads to trick victims.

Has your CU members been tricks?

Crooks Net Millions in Coordinated ATM Heists

Organized cyber criminals stole almost $11 million in two highly coordinated ATM heists in the final days of 2012.

Image source: Article

The events prompted Visa to warn U.S. payment card issuers to be on high-alert for additional ATM cash-out fraud schemes in the New Year.

Using a small number of re-loadable prepaid debit cards tied to accounts that they controlled, scammers began pulling cash out of ATMs in at least a dozen countries. Within hours, the perpetrators had stolen approximately $9 million.

What does your CU do to protect against ATM theft?

DDoS Attack on Bank Hid $900,000 Cyberheist

A Christmas Eve cyberattack against the Web site of a regional California financial institution helped to distract bank officials from an online account takeover against one of its clients, netting thieves more than $900,000.

Image source: Article

At approximately midday on December 24, 2012, organized cyber crooks began moving money out of corporate accounts belonging to Ascent Builders, a construction firm based in Sacramento, Calif.

In short order, the company’s financial institution – San Francisco-based Bank of the West — came under a large distributed denial of service (DDoS) attack.

Are you prepared for a DDoS attack? Or will you get a visit from the FBI?

Hacking The Laptop Docking Station

You know that docking station you snap your laptop into at the office? It can be hacked, too.

Image source: Article

A British researcher next month at Black Hat Europe will show just how valuable those seemingly benign devices can be to a determined attacker targeting an organization or group of users.

Andy Davis, research director for U.K.-based NCC Group, built a prototype hardware device that can easily be placed inside a laptop docking station to sniff traffic and, ultimately, steal sensitive corporate communications information from the laptop.

Where does your CU source its docking stations?

PCI Council Releases Guidelines for Cloud Compliance

A new set of guidelines from the PCI Security Standards Council is intended to help merchants and cloud services providers comply with the PCI DSS when handling payment card data on the web.

Image source: Westerfield

Since 2004, the PCI Security Standards Council (PCI SSC) has maintained the Payment Card Industry Data Security Standard (PCI DSS), a proprietary information security standard for the handling of payment card data.

Increasingly, organizations have taken the PCI standard as a guide for implementing security, even if they don't have responsibility for customer payment card data.

What is your CU's position on PCI and cardholder privacy?

Ex-Employees Say It's OK To Take Corporate Data With Them

New survey finds nearly 70 percent of employees who recently left or were fired from their job say their organizations don't prevent them from using confidential info.

Image source: Flickr

Half of employees say they took corporate data with them when they left their jobs or were fired, and 40 percent plan to use that data in their new positions at other organizations, according to a new report.

Sixty-two percent don't think this practice is wrong, either: They say it's OK to take corporate data with them via their PCs, tablets, smartphones, or cloud file-sharing applications.

Does your CU have data loss policies being enforced for mobile, cloud, and other extrusion channels?

Mobile Deposit Combines Best of Both Banking Worlds for Credit Unions

Remote deposit capture, long tied to the PC and desktop scanner, has arrived at its ultimate destination – anywhere, anytime check deposits through popular mobile banking capabilities and smartphones.

Image source: Flikr

Mobile deposit is attractive to consumers and millions of small businesses, a longtime staple of credit union membership.

New technologies have always been the answer to that challenge, and during the last few years, mobile RDC has been in the spotlight.

Does your CU take advantage of this technology?

Anonymous posts over 4000 U.S. bank executive credentials

Anonymous appears to have published login and private information from over 4000 American bank executive credentials its Operation Last Resort, demanding US computer crime law reform.

Image source: Article

A spreadsheet has been published on a .gov website allegedly containing login information and credentials, IP addresses, and contact information of American bank executives.

If true, it could be that Anonymous has released banker information that could be connected to Federal Reserve computers, including contact information and cell phone numbers for U.S. bank Presidents, Vice Presidents, COO's Branch Managers, VP's and more.

Did your CU executives make the list?

War on terabytes

Ever since the 2001 attacks on the World Trade Centre, banks like Santander have invested billions in safeguarding and duplicating their data centres to protect them from terrorist attacks and natural disasters.

Image source: Blogpost

The threat against banks has, however, evolved. Although the physical infrastructure of the world’s financial system is largely secure, the software that runs on it is not.

Bank bosses and regulators are becoming more concerned by the threat posed to financial stability by networks of hackers that have launched a series of attacks on banks over the past few months.

Read more about the threat trends.

Cases Where Google Gives User Data To Government Don't Involve A Warrant

It may be easier than you think for government entities to demand the private data you’ve stored on Google’s servers.

Image source: Article

Most of the time, it doesn’t even require a judge’s signature.

On Wednesday Google released its semi-annual Transparency Report, its voluntary admission of how many times it removed data from its services or quietly handed users’ information to government agencies in the last six months.

Does your CU allow sensitive information to reside in Google services?

Microsoft pushes subscription model for Office 2013

Available for download now, Office 2013 comes in a wide variety of versions. But Microsoft is hoping that you'll skip the one-time fee for a subscription model that delivers lots of updates to come.

Image source: Article

After existing in preview form since last summer, Office 2013, the next version of Microsoft's productivity software, is now available for download.

Yes, it's a lot more money, and Microsoft accomplishes its goal of keeping you as a customer.

Is your CU sticking with Office 2013?

Five Security Trends for 2013

While one of the biggest challenges remains getting the C-suite interested in security, CISOs are increasingly explaining to the front office the business reasons for security.

Image source: Article

From compliance, fines, and data loss, to the irreparable harm that could come to the company’s reputation. But there are other important topics in the field, including these five InfoSec trends for 2013.

It’s typical for IT to be heads-down, focused on the many threats coming from many directions.

Does your CU have its head down? Or are you on top of these 5 trends?

iPhone and Android in the office yield higher profits, happier employees

A new survey finds that companies embracing consumer tech are more likely to report increased sales.

Image source: Article

The survey finds that organizations that have adopted consumer tech were 73 percent more likely to report improved sales and new customer acquisitions than BYOD holdouts.

What's more, companies are enjoying intangible benefits from embracing consumer tech, including happier workers.

Are your CU employees happy?

For Fun: Old people icons that don't make sense anymore

What happens when all the things we based our icons on don't exist anymore? Do they just become, ahem, iconic glyphs whose origins are shrouded in mystery?

Image source: Article

For example, the Floppy Disk Icon means "save" for a whole generation of people who have never seen one.

And why are they called Radio Buttons? Because my car radio used to have buttons where only one could be pressed at any time. I miss my 8-track.

What icons don't make sense to you?

Gartner: Mobile Applications, BYOD to Affect Sourcing Strategies

The rising impact of consumerization means that user demand will increase for new and updated IT services.

Image source: Article

Revised mobile strategies, such as bring your own device (BYOD) and mobile applications availability, will expand IT service sourcing requirements as users demand new services.

Sourcing managers should consider these factors when re-evaluating sourcing options, delivery models and vendors, include strong service integration capabilities for IT organizations adopting public cloud models.

What is your CU's sourcing approach for 2013?

BYOD is a misnomer, MDM is stop-gap

BYOD is a misnomer, while current MDM solutions are "stop-gap technologies" preceding full understanding of mobile data management.

Image source: Article

People want access now to data and applications anywhere on any device.

The fact that it happens to be their device, or a different device, or someone else's device, who owns it and who paid for it is kind of what some people think they want to get hung up on. In reality, the real challenge is delivering data and applications to any device anywhere.

Does your CU handle BYOD workflows securely?

Mastermind Behind Gozi Bank Malware Charged

The mastermind who designed and distributed the Gozi malware — infecting more than a million computers worldwide in order to steal banking and other credentials from tens of thousands of victims — has been charged in New York along with two co-conspirators, according to documents unsealed Wednesday.

Image source: Article

Authorities say the virus infected at least 40,000 computers in the U.S., including more than 160 computers belonging to NASA, and cost victims tens of millions of dollars in losses.

According to court documents, one command-and-control server for the Gozi virus stored more than 3,000 usernames of banking victims. In one case in Feb. 2012, a victim lost more than $200,000 siphoned from his bank account.

What's next? Read the full story to find out.

The cloud will impact the way security is consumed

Increased adoption of cloud-based computing is expected to impact the way security is consumed as well as how key government agencies will prioritize security of public cloud infrastructures, according to Gartner.

Image source: Article

The growing importance of public clouds, along with the ever-persistent threat on private and public sectors' infrastructures, is expected to result in the U.S. government declaring them a critical national infrastructure.

Growth rates for cloud-based security services are set to overtake those of traditional on-premises. Is your CU part of this statistic?

Android malware spreads through compromised legitimate Web sites

Over the past 24 hours, our sensor networks picked up an interesting website infection affecting a popular Bulgarian website for branded watches, which ultimately redirects and downloads premium rate SMS Android malware on the visiting user devices.

Image source: Article

The affected Bulgarian website is only the tip of the iceberg, based on the diversified portfolio of malicious domains known to have been launched by the same party that launched the original campaign.

The first variation of the campaign attempts to trick Russian-speaking users into installing a fake version of Adobe’s Flash Player, followed by a second campaign using a fake Android browser as a social engineering theme, and a third campaign which is attempting to trick mobile users into thinking that it’s a new version of Google Play.

Read more about this attack.

Good Technology’s 2nd Annual State of BYOD Report

Last year, BYOD was on the rise, this year, it’s in full force. Since the release of Good’s first BYOD report in December 2011, we have seen an substantial increase of companies around the globe are embracing BYOD programs to help reduce costs and bolster employee productivity.

Image source: Article

For the 2012 State of BYOD Report, Good Technology surveyed the same set of customers to see how BYOD perceptions and program support practices may have shifted in the last year.

Good’s report specially targets its most organizationally complex, multi-national, and highly-regulated customers in order to better understand how these types of companies were adopting BYOD and to share their best practices.

Where does your CU sit with respect to BYOD?