Episode 3: Cybersecurity for Community Banks

The broadcast is now starting. All attendees are in listen-only mode.

Greetings everybody, this is Eric Cook and I'm with WSI Internet Consulting, and I would like to welcome you to the June episode of Bankers Education Series. For those of you that I have not had the pleasure of meeting, I consider myself a recovering banker. I'm doing air quotes with my fingers here. But a recovering banker of 15 years prior to becoming a digital consultant in 2007. And so during my tenure in the world of banking, I had the privilege of doing a lot of things because it was with a community bank. And while cybersecurity certainly was much, much less in the early 2000s, late '90s, it was one of the things that I did do a little bit on as a network administrator and responsible for technology. So I don't think it's a surprise to those of you that are attending or maybe listening to the recording of this session, cybersecurity, cyber fraud, online privacy, whatever you want to call it, has certainly become a very hot topic, not just from a, this is what we should do to protect our customers perspective, but the regulators and examiners and all those folks that are coming in and looking at us on a periodic basis are making it part of their business to know what we're doing as community bankers to, to take care of those things. So I am very excited to be offering this webinar today in partnership with Dr. Kevin Streff over at Secure Banking Solutions. Before I go ahead and formally let him take the helm, I just want to cover a couple of housekeeping items. We do like conversation and questions, so So while the presentation is going on, if you would like to find your questions and answers, your chat feature over in your control panel, if there is a question that you would like to ask Dr. Streff during today's session, feel free to type it in there and I'll keep an eye on that and we'll ask that. We'll periodically take a break just to field any questions that you folks may have. And then also today's webinar is being recorded and is made available, so you may have seen the Powered by WSI/BES link somewhere out there, but at the Bankers Education Series page, that's where we're providing links to all of the previous episodes of the BES. Last month we featured Apple Pay, and the month prior to that, which was our kickoff, we actually talked about the Dot Bank, which went live a couple days ago, actually. So we're doing these on a monthly basis and covering a lot of great topics that I think are relevant and helpful, hopefully, to the banking industry. And this is the third of what I hope will be many more episodes to come. So with that, it gives me great pleasure to introduce Dr. Kevin Struff, who's not only a guest, but a good friend of mine. He and I both serve on the faculty at the Graduate School of Banking. And he was at the Michigan Bankers Annual Convention just last week and pulling rough duty up at the Grand Hotel in Mackinac Island, where we got to enjoy a couple of runs together, and lots of good conversation and talked about cybersecurity. And I think while the bankers, Kevin, were very impressed with your session, if I heard it once, I heard it 100 times, you scared the heck out of me. But I think this stuff to the uneducated or the unaware can be a little intimidating and a little scary, but it's certainly something that we need to be paying attention to. So with that introduction, I would like to formally welcome you to the Beat Yes and allow you to say hello. flow, and we'll get started with your presentation. Thanks for joining me today.

Thanks, Eric, and thanks everyone for attending. Certainly that was a fun trip at Mackinac Island, and my friend Eric is quite the athlete, so don't let his looks deceive you. I don't mean to scare anybody with cybersecurity, but it is pretty scary out there right now. You know, I like to tell the story, you know, that Secure Banking Solutions, my business, we have a hard time keeping up with these bad guys. These bad guys are well armed, they're well funded. I mean, that's just the reality of it. The stakes are so high, everyone, that if they steal data, they can sell it. If they steal and jackpot the cash out of an ATM, they're in great shape. They can steal it from the merchants that are connected to you to do cash management. They can steal it from your vendors. They can steal it from your business partners. Keeping the bad guys out in a community bank is proving to be quite challenging. Really, the first question we have for you is, what can you do? The answer really becomes making sure that you've got a good layered approach. Making sure that all the people that interface with your bank, whether they're corporate customers, individual customers, vendors, tellers, loan officers, management, etc., all the people layer of your link there is strong and fortified. All the processes are tight, they're well documented, they're tested, and they're non-exploitable. And then finally, the layer that everybody focuses on, which is an important layer, but just one of the layers, which is your technology layer. May have firewalls and routers and equipment and somebody managing the perimeter of your network, all of those kinds of technologies, whitelisting softwares and all those things working together in a layered approach. That's got to be the concept because not one thing can stop you from the different threats that are listed here on slide 4. On slide 4, what you have here is what I like to refer to as kind of the top 5, the top 5 threats that we see out there right now. We do a lot of work with the NSA, Department of Homeland Security, the White House, and in a variety of forums. We do work with the national bank regulators. We see kind of what's going on through FSISAC and US-CERT and all the different places that there are to know that there's an email server being compromised in Turkey or whatever it is. We see all the different things that are going on with ransomware and the threat landscape. And to boil it down for us, these are the top 5. And again, this changes all the time, but these right now are the top 5. And let's go into some of these. In a little bit more detail. The first major threat that we have going on, as everybody knows, is hacking, and this is where people are breaking into your computers and networks to try to steal things. You know, you hear all the time that, gosh, I hear that these hackers are organized, and boy, isn't that true. Take a look at some of these hacking tools that are just simply out there with simply a point-and-click on the internet, different network sniffers to understand what you've got attached to your network, different password crackers to be able to break into different devices, different wireless exploits, different packet crafters, different phishing kits, different dirty PDFs, different things that can be sent into your bank, and you don't have to be a computer scientist to write this stuff. You just simply have to point and click and execute it. Hackers are organized. Hackers are organized in that every piece of equipment that's been created over the last 10 years has a default password that comes from the manufacturer. Whether it's a Netgear router that you just bought at Best Buy, there's going to be a default username and password. If you hook that up in your bank, you don't change the default, the hacker doesn't have to break into you. They simply log into you. Once they're into that part of the network, they simply pivot and traverse to another part of your network. So you can see with this website, there's, there's thousands of default user IDs and passwords of all equipment that you have operationalized at your bank. And finally, and the click sometimes works and sometimes doesn't, and just for the sake of this webinar to make sure we don't have any technical difficulties, Eric, I'm not going to click on it. But what that is, is a link to an underground economy where Hackers sell credit card data. They actually sell all kinds of data, but in that market, it's credit card information. And you can see that there would be Capital One cards that you can buy, some Citibank debit cards that you can buy, some Chase credit cards that you can buy, etc., etc. There's literally hundreds of bank cards that are listed in that site that are for sale. Some of them that don't have great information or balances or are set to expire within the next 90 days might be $22 a card. Some of them, you know, might be more like $75 or $100 a card if it expires a couple years from now and those balances are very rich. So again, hackers are very organized. They've got their tools, they've got their defaults, they've got their way to launder the card information. They're just simply very organized. What this is is another market. It's a market where we sell PayPal accounts with good balances, where we sell Bitcoins and prepaid cards and bank store cards and different e-wallets and counterfeit bills and credit cards with free shipping, and all kinds of things are out here on these markets. If you want cards or PayPal accounts or Bitcoins or whatever you want, you want some email addresses, some IP addresses, whatever you're looking for, you can simply just go and buy them, you know, email addresses by the bushel and, you know, cards by the count. So hacking, you know, it's just hacking made easy. You know, the other major threat that you have going on right now isn't the hacker breaking in, it's the insider stealing information out. And sometimes it's accidental, it's like, oops, sent information out, and sometimes it's not so accidental. And you know, here's the deal, bankers, is people misuse equipment, and you can see on this only 17% of folks report that they would never misuse your equipment at your bank. But you know, if I'm going to surf things and look for things that are— that really should be on my personal time that I'm doing on bank time, or maybe I'm just plugging a USB stick I shouldn't into your network, or whatever it is, you know, just misusing equipment. Anytime you visit something you shouldn't, it can be layered with malware, with pornography, and all other kinds of fun stuff, so to speak. And so you just don't want to be doing that, misusing, going out to sites that have keystroke loggers, and next thing you know, you're logging into something and the criminal sees, you know, sees those user ID and password credentials. So there's all kinds of reasons why You want to have good acceptable use policies, well-trained employees, that they're not misusing equipment. You know, back to data leakage here a little bit, we got involved in a case down in Nebraska. There were 2 tellers that were print screening 8 customer records each per day for about 15 months. So again, this is a slow methodical data leakage scam where they were literally print screening these records, putting it in their purse, and then leaving each day. So let me ask you a question: what does a teller make? So you figure if a teller makes $100 a day, they're probably doing pretty good. So what is 8 customer records worth per day? So at a minimum, those 8 customer records would be worth about $300, and last time I checked, the federal government doesn't take taxes out of that chunk. So the point here is that it's very motivating to steal small amounts of data as long as you have an avenue to harvest that treasure trove. Social engineering is another attack that you need to be concerned about. This is where you're using that basic trust element that you've instilled at your bank, you know, again, they're going to use that against your employees. Where they're going to visit parts of their bank— your bank that they shouldn't, or talk to people and get information in ways that they shouldn't. These are typical social engineering methods electronically through phishing, phone calling, going through your dumpsters seeing what's not shredded, going through your trash bins seeing what's not shredded, not just paper but throwing away media, physical impersonation, different email scams, And I mentioned unauthorized equipment being attached to your network like USB sticks. One of the things that we do a lot of at SBS is, you know, we'll drop some USB sticks around your— around the different branches at your bank. You know, we'll start maybe with one at the front door and one at the back door and see if they get plugged in. If they don't get plugged in, then we'll do it again, and this time we'll mark it payroll file, and we'll see if they get plugged in, right? And if they don't get plugged in then, then maybe next time we'll market dirty pictures and see who's plugging it into your bank's network. And the point here, right, is to just, you know, see if your employees are really well trained in on these kinds of techniques because these are the kinds of scams that are going on out there for real. We get an opportunity to go to the annual hacking convention in Las Vegas. It's called DEF CON and Black Hat, and again, they'll go through— the hackers will get on stage. I don't get on stage, and I sit there with you know, DHS and FBI and Secret Service and everybody, and we learn about kind of the latest things that are going on. And definitely these USB stick attacks with malware on them is a big deal because they know people are just plugging those into their home and business networks. Corporate account takeover is an issue, isn't it? This is where you're doing business banking, but here's the dirty little secret: those businesses that you're hooking up to do cash management or remote deposit or whatever you're doing with them Most of them have very insecure environments. In fact, 70% of businesses lack one of the 10 basic security controls like a firewall or a strong password or antivirus, right, those kinds of basic things that you would put on your home network, unique user accounts. When one of these problems happen, as you know, And $70,000 magically disappears, 2/3 of those small businesses just want the money put back. And if you don't put the money back, 29% of them would switch to a different bank. Right, so it may be that your bank has banked with business XYZ for 50 years. Your grandfather started the bank, your father took it over, and now you're you know, in a senior leadership role, you've been banking with X, Y, and Z business for 50 years, but I'll tell you what, we've seen time and time again when one of these ACH issues or wire issues happen, right, they just want the money put back, and if the money's not put back, the finger-pointing starts, and I'll tell you what, that 50-year relationship is gone overnight. You know, I like to tell the story that, you know, I think ACH fraud and wire fraud, these are community bank issues. Because when one of these issues happen and 29% of these folks would switch to another bank, guess who they're switching to? They're not switching to another community bank, they're switching to the big boys where they're perceiving that there's more security and their money is going to be safe. ATM fraud— wow, what a hot topic this one is. What's happened here is that ATMs now run Windows, and many of them Windows XP, which is unsupported, but they run Windows, and hackers love Windows. A lot of those tools that I showed you that are free out there, they're basically Windows hacking tools. So now, it used to be that these NCR Diebold ATM machines, that they would run proprietary operating systems. Now they run Windows. So hackers don't have to learn proprietary operating systems and create vulnerabilities and exploits and all that and write this kind of stuff. It's just all out there for them in the Windows environment. Second thing you've done is you've hooked up those Windows machines, those ATM machines directly on your bank's network, and again it used to be that it was a proprietary closed system of 30 ATM machines. Now those 30 ATM machines are simply nodes on your network. What does that mean is that once somebody gets onto your network and these are just machines that they can see on your network and go after them. So that's the big deal on why your risk assessment should really be screaming ATM fraud right now, and the way this works is typically through a skimmer and a camera. The skimmer gets the cards information, the The camera gets the pins because the pins are encrypted. This is an example of an ATM cyber heist. It was about $2 million worth of stuff using only 12 card numbers, part of a $40 million cyber heist ring. If you want more information on how these things work, you know, just get a hold of me afterwards, right? But here's a couple of the geniuses that were behind it. Alright, so, you know, that's a little bit, Eric. If we could pause and just ask questions, if anybody has any questions about any of those kind of top 5 threats that are out there. And certainly there are many others, and if you have questions on things that I haven't talked about, feel free to ask questions on that as well.

Sure. You had mentioned it being really a community bank issue, and I think There's, uh, I mean, I would agree with you. If somebody gets an issue at a community bank, the slide, the, was it 67%? They, they say it's the bank's fault, even though it could have very well been a vulnerability at the business. But in reality, and I, and I don't want you to throw any big banks under the bus, um, but are big banks really that much more prepared than other banks, um, and, and they obviously— and maybe not obviously, but they probably get hit way more often. So I mean, do they have to go even way, way higher? And, you know, maybe compare that little bank versus big banks. I think there's still some of that, well, I'm just a small little bank, you know, we've only got one office, we're, you know, nobody's really interested in us. Um, and some would argue that, yeah, you're probably more interesting than a big bank because you probably have more holes, or maybe potentially more holes than the big banks do?

Yeah, great question. My typical answer to this question, Eric, is big banks typically— certainly they have fraud detection tools and investments and people and stuff that a community bank just simply won't be able to afford. I mean, there are certainly ways that community banks are plugging in to that level of expertise. I know like we, you know, take a security consultant, Eric, and we'll divide them up to about 15 banks and they'll all share the cost of that. But my experience is like with multi-factor authentication, the big banks were very slow to adopt multi-factor authentication and community banks were actually ahead of the large banks in terms of the adoption curves there. So I think it's kind of a myth that Well, big banks have just better security and I'm safer there. I don't really think that that's necessarily the case. It certainly can be the case, but it's not necessarily the case. But what you can see is there's a lot of advertising going on in the national media, in print and in television, positioning Bank of America, for example, to be a very safe and secure place to put your money. Certainly, marketing can be a part of this too. Is the community bank positioning themselves image-wise as a safe and secure place to put their digital money?

One of the other questions that I think is very timely and comes up was asked, the .bank top-level domain name. June 23rd, finally available for banks that don't have their registration or their trademark. That was available through kind of a sunrise period. Um, I know one of the things when Doug Johnson from the ABA joined us on this show 2 months ago, talked about the, the future idea of the .bank giving consumers an extra layer I don't know if security is necessarily the right word, but an extra layer of assurance that they're, they're actually working with a financial institution.

Yep.

But maybe you can comment a little bit about, you know, the fact that you legitimately have to be a financial institution to get Dot Bank. We're seeing commercials and hearing radio advertisements with regards to the Dot Pharmacy trying to combat You know, unauthorized sale of prescription drugs from shady websites that are selling knockoff drugs that really aren't what they need to be, you know, kind of like biological malware, if you will. But talk a little bit maybe about how the .bank is poised to help with some of this, or is this really not something that's going to be that beneficial?

Yeah, that again, another really good question. These are the kinds of things that we have to do, and we will get a level of security and assurance for a while. The hackers will catch up, and then and then it won't work anymore, Eric. You know that that's just the way that's the way our the hacking community works is it's the it's like should we move from mag stripe to EMV? Yes, and we should we should already be there. But then the hackers will see that you know. 90% of the POS systems are EMV, they'll start putting their energies and investments in R&D and communication and infrastructure into EMV hacks, and now EMV is no longer safe. That's what happened with RSA tokens. It doesn't mean that we shouldn't be using RSA tokens, but it just means that for a while they were never breached, and then they were breached, and now they were changed, and the hackers are looking to That's the horse race that ensues in this hacker community. Certainly the .bank is another example of that where we should move to that, we should adopt that, but then we shouldn't be surprised when the hackers catch up and then we got to do something else.

Right. Yeah, it's almost like you're on a treadmill and the speed keeps getting turned up and it used to be sufficient to walk And you stay on it, and now we're jogging and we stay on it, and the speed of the treadmill is the voraciousness of the hackers, and it's going to be a sprint here before too long. And if you don't, it's going to sling you right off the back. And just go out and Google treadmill fail.

Uh-huh.

You can see what's going to happen if you don't pay attention. A lot of America's Funniest Home Video examples of people that don't respect the treadmill. So it's just like, it's just like that.

So, and you and I ran together, as we were mentioning to your attendees here today. And I am a runner, not very good one, but I'm a runner. And, you know, I was doing a run on the treadmill. I live in South Dakota, everybody. And, you know, we've got about 3 months of good weather in the year. And it was one of those wintry days, and I'm on a treadmill, and I took a little break and forgot the treadmill was running and stepped back on and face-planted, broke my fingers. So I know exactly what you're talking about with those videos. Yeah, with one treadmill. So I was one of those accident victims. Bummer.

Well, let's— yeah, so that I think takes care of the questions, at least at this point. Let's continue on. I know you've got a lot of other stuff here that we want to make sure we get a chance to talk about, and then we'll ask some more questions All right, appreciate that.

So, you know, as Eric was indicating and I was trying to indicate, you know, so this is such a moving target, right? But what, what's not a moving target is you need to have a management system in place, everybody, right? What the decisions that you make, the controls that you implement, the threats of the day that you're concerned about, that stuff all changes. But you need to then have this layered management system that doesn't change. I'm going to show you what that looks like here momentarily. It's just like you have a management system to do loans at your bank. If you have 5 loan officers, they all have to do things a certain way— applications and decisions and management and oversight and ratios and Right, there's a certain way that you do that. Well, guess what? The good news is security now is at a point where it has a management system. I'm going to kind of show you what that looks like, and it's this layered security program where you make decisions based on risk assessment and you test and verify them with effective auditing. And make no mistake, in the center of all that in our world is awareness and education for your customers, your vendors, your employees, for everyone. If you— if we're not helping them understand what to click on and not to click on, what to open and not to open, I mean, you can run all the different technologies you want. The reality is, is that if somebody clicks on a phishing scam, you know, that the technology— not all technologies are going to catch all that stuff. So The good news is no matter what's on the left of this slide, you know, what you're looking to mitigate the risk of, the good news is you can invest in and be confident that a good layered security program that starts with good risk assessment, not spreadsheet-based assessments like many of you are still doing, but good assessments where you can really understand what's going on with informed customers, Informed employees, folks that are, that are just aware, right, that, that if somebody walks into your bank and, and, and you don't know who that is, right, that you politely figure out who that individual is, because if they get access to your wire closet or access to some piece of equipment for a while, then they'll have access to everything on your, on your network if they're good. So What do you do about these different threats? The answer should be, hey, no problem. Our bank has a layered security program. We know where our risks are, and we've informed everybody of them, and an independent party has come in and tested and verified that we're not— hey, we're not bulletproof, but we're doing pretty good here. Let's take those one at a time in terms of a layered security program. You know, this is what a layered security program looks like. These are the components of a layered security program. It starts with risk assessment where you make decisions. You need to have an asset management program. If you can't track your laptops and your USB sticks and backup tapes, you stand no chance to secure them. You stand no chance if you don't— if you can't track them, if you can't deplete them out of inventory carefully so that all the customer and financial information is cleaned off for real before you donate those machines or throw them away, right, then you Then obviously, same like photocopiers. Right now, most photocopiers have a hard drive. Typically, the ones that we buy on eBay or whatever, and we do a lot of this research, we buy a lot of used stuff and see what's on there. Typically, they'll have about 70,000 images. If they're banks, they're bank images. If they're hospitals, if they're law enforcement, we'll get all kinds of information on on different crimes and different things that are going on. So again, degaussing and cleansing appropriately is very valuable. Vendor management, third-party management, penetration testing where you're hiring somebody to break into your bank like a hacker would and once or twice or 3 times a year and you're gonna see that the regulators recently read out that one time a year for penetration tests and vulnerability assessments is typically now insufficient. Things are changing so dynamically in your bank's network that doing it every year, once a year, or once every 18 months, that, you know, that doesn't simulate what a hacker is seeing every day. Vulnerability assessments where you're looking for known vulnerabilities in your environment, not the hacker trying to break in pen testing, but looking for known vulnerabilities. Unpatched systems, default settings, you know, there's just a litany of known vulnerabilities and these scanning tools can help you computer by computer, server by server understand where your weaknesses are. A comprehensive security awareness program, an emergency preparedness program that includes business continuity, incident response, disaster recovery, pandemic preparedness. All part of your emergency preparedness program, and then finally, a testing and verification program that I'll come back to momentarily. So it's supported by documentation and by people, not just Jeff the IT guy, right? No, no longer is security and cybersecurity Jeff the IT guy. At this point, it needs to be a board responsibility, a management responsibility, the IT committee, the audit committee. Everybody's working together. To do their role in safeguarding customer and financial information. What this slide is meant to do is show you how we begin to then operationalize this— these components here that are listed. And what's important here is to try to show is that there's interrelationships between these different silos. So you don't just complete a risk assessment and now you're done. But you use that risk assessment, you use that risk assessment to scope your penetration test over to the right and your vulnerability assessment, use it to scope your IT audit where you're auditing things that are the riskiest to you as identified where? In the risk assessment. You use a risk assessment to come to design your security awareness program. How many of you have a do an annual PowerPoint training with your loan officers and tellers, pull them into a conference room, right, and kind of talk to them for 15-20 minutes. Well, how do you determine what threats you're going to talk to them about, what safeguards you're going to talk about? That should come from your risk assessment. You shouldn't just make it up. If phishing is something that's really concerning in your risk assessment, then that's something you should be talking about in your security awareness program. How do you determine what social engineering tests to run? Should you have somebody go through your dumpsters to see if they're— if you're shredding appropriately? Should you have somebody, you know, drop some USB sticks around your branches or do a phishing scam or a physical impersonation scam or a telephone scam? What are you concerned about? All those things should be rated and ranked in your risk assessment. And your social engineering test then should just follow those risks, okay. So again, I'm not gonna, Eric, go through every interaction here, but the point here is that all these components, they work together. When you hire somebody like SBS or Gladiator to do a pen test for you, right, then your incident response plan should kick in, right. Where if somebody's managing the perimeter of your network, right, they should be like, whoa, somebody's hacking and this is what's going on, and that part of the incident response plan should kick in. Okay, so you can see that this is a comprehensive integrated layered security program. What policies do you need? Again, it should come from the risk assessment. Those assets that are the most risky to you should require the diligence of policies and procedures and configuration standards. In this example, it's mobile banking, remote deposit capture, and internet banking are the systems that you're concerned about, but again, this is, this is meant to be an example. Likewise, what issues and threats are we concerned about? In this example, it's social engineering, physical security, access control, acceptable use and personnel security. These are, again, I could put in phishing or vishing or clickjacking or, you know, all the different things that based on your bank you're concerned about, you're going to write your issue threat-specific policy or your system-specific policy. So you see how this is a management system and this is a program, and you build out over time the depth of it. You build it out, right? Where you lay down the policy, you start laying down some procedures, you start laying down some standards and some plans as necessary based on risk. It's a risk-based program. Then the question becomes, what do you do with it? You know, these are the kinds of things that you can do with it. You can use it. Now you kind of start to measure yourself against a program, and you can see we've got some greens, yellows, and reds. We're doing good in some areas, we're doing okay in some areas, and we're doing poorly in some areas. Now if I'm a board and I get this report, I'm focusing on the reds and I'm figuring out what we can do to mitigate these kinds of exposures further. Again, things change. You can rerun the reports next month. It might be a little bit different or next quarter or next year as the threat landscape changes. These are all automated tools that you can deploy. One of the big things that we've seen recently is that the regulators banded together at an FFIEC level, and they examined 500 banks, so about 8% of the US banking system. They looked at about 8% of the banks that were under $1 billion in size, in asset size, and Through the 500 bank assessment, they've summarized the results of of their findings, and I don't think that these are shocking findings. But what these are is the examination. The examiners are now at the OCC Federal Reserve FDIC level. They're updating their IT examination procedures, and now they're going to be coming out looking for stronger risk management. Programs, more frequent and enhanced vulnerability assessment and penetration testing programs. They're going to be asking questions and looking for evidence from you that you are sharing and collaborating with other financial institutions and other institutions with regard to cybersecurity risks and threat information, that you have indeed enhanced your vendor management program, that you're risk rating each of your vendors, that you're following up to improve improve and understand where your exposures are at the vendor level, that you've enhanced your incident response plan to include cyber events, and that you're testing those in concert with your other events. And now I've got a question for you. What do the last 3 bullets all have in common? So this is the 500 Bank Cybersecurity Assessment where they, they've looked at risk management programs, vendor management or incident response programs, yet the last 3 have something in common. What is that? They're all training, awareness, and education in focus. So training and education on cybersecurity is going to be emphasized. Board participation, board of director participation and education, their credentials and their background And cyber and information security protection is going to be examined and regulated. Wow. And then the summary of the results is boards are not keeping appraised of cybersecurity issues and response activities. So these are at the management, board, and training level. So you follow that? So let's, let's kind of go into this in a little bit more detail, and it's kind of the last section. Before the last Q&A, these are management actions that that the regulators are are saying they'd like to see, right? So there's just a bunch of these very specific bullets. These aren't my bullets; this is their bullets out of their report from going out into these 500 banks. And now again, they're updating their exam procedures. They're going to come out into your bank. One, they want to see an expansion of your network diagram to include. Connections. So your risk assessment right now lists out what systems and what products you've got that have sensitive customer and financial information. What they want is for you to update your risk assessment to include connections and to update your bank's network diagram. So here's where they're going with this. Are you connecting with the Federal Reserve? Are you connecting to the cloud? Are you connecting up your branches with VPNs or some other other way? Are you connecting with merchants? Are you connect connecting with corporate customers? Are you how are you doing all these connections with internet service providers, right? Are there remote connections where some vendors connect in to be able to do remote remote support of different technologies? I mean, all of those connections. Represent risk to your bank. They want them on your risk assessment, on your network diagram, and they want you demonstrating that you understand that risk and that you're mitigating that risk. Okay, so far so good. As a matter of fact, they want you to automate and calculate risk. You're going to see 2 terms here. One is inherent risk. This is your out-of-box risk. We've got a public website. We've got an internet banking system, right? And because we we have those two digital channels, we inherently now have introduced some risk. They want you to be able to understand and calculate that risk. I'm going to show you this momentarily. They also want you to mature your cyber risk program into your enterprise risk program. They want you to be able to compare cyber risk to loan risk, to reputation risk, to operational risk, to financial risk, to, you know, to the different risk elements of your enterprise risk program. What they're seeing is you've got an ERM program and then you've got an IT cyber risk program and they're separate. Again, Jeff the IT guy typically handles the cyber risk program And then bank management handles the ERM program, and they're saying no, no, no, no, no, no. You know, cyber risk needs to be a part of the ERM program. Okay, and again, you might have some questions on that momentarily. Looks like I might be locked up, Eric. Is there a way you could advance the slide? Not sure what happened here.

Let me see. I could pull it back over to my computer and we could go ahead and just run it Let me go ahead and do that here real quick. While I'm switching slides, one question that I have for you, and I just looked at the clock, we've got about 17 minutes left, and I know you've got a bunch more slides, but the question I have with regards to consumer education, at what point do you get to TMI where you're telling your customers too much and you're almost scaring them away from doing anything? Because we certainly don't want to frighten them freak away from doing anything. Yeah, that's a good question. our customers out and have them never want to use online banking or mobile banking. But where is that tipping point? So I'll let you answer that, and then I'll do my magic with the screen here.

Yeah, I appreciate that. You know, that's a, that's a great point. We're, we're actually getting beyond that point, Eric, because there is regulation now that says— and if anybody wants a copy of this, I'd be happy to provide provided to you that says that you have to be working with your corporate customer, especially on the corporate customer side, to help them understand their cyber risks and help to recommend those basic security controls. So for example, and I can't keep up with all this, all these presentations, all this business, you know, I'm being asked and SBS is being asked to go around a lot of different places and do workshops with X Bank down in Kansas City where they invite their corporate customers and we'll have 100, 150 corporate customers in the room and we'll lay out what the threats are and we'll lay out what they, what their responsibilities are and the kinds of controls they should be laying down and the kinds of controls that the bank should be laying down. So you're right, you don't, you definitely don't want to scare your corporate corporate customers, but you certainly have to make them aware of the different risks of kind of what's going on. And if you don't do that, the examiners are coming out right now and saying, what are you doing to work with your corporate customers to help them understand their risks and to help mitigate those risks?

Sure, that's a good point. So, all right, screen should be switched. Are you seeing it on your end?

Not yet.

Okay, maybe if we've got some folks— I don't know if Kevin's computer is locked up, But those of you that are attending live, if you could just do me a favor, I'm going to go ahead and navigate to the next slide. So we should see Section 2, Cybersecurity Preparedness. So if somebody could just type into the chat box that you are seeing Section 2, that would be, that would be excellent. Slide number 29. We'll make sure people are awake. All right, so let's, let's take a look here.

And if it is just my machine, I'm rebooting my machine. I'll have that ready about in 60 seconds, so we'll be ready to go with that.

Okay, perfect.

So, okay, yeah, the, the The 500-bank assessment that we're reading out now, and really, Eric, there's several slides that are left, but this is going to go fairly rapidly.

Okay.

Some of them are just screenshots and stuff, so no worries with time. We're actually right on time.

Good, good.

But if anybody wants a copy of that 500-bank assessment, the observations from the examiners, just— you're going to have my contact information or get a hold of Eric Yeah. Either way, whatever works. It is an absolute wonderful document because now you know over the next 2 to 3 years, again, they have never come out and done a 500-bank cybersecurity assessment before. It's very time-consuming. I mean, if each assessment takes 20 hours, right, to scope it, to do it, to write it, write up the results, and I mean, you're talking about 10,000 hours worth of work. We're talking about 5 FTEs worth of regulator time. You know, so this was a very significant report, a very significant investment, and so make no mistake, the regulators are going to be updating their procedures, their examination procedures, looking for enhanced programs, more awareness and training, enhanced incident response. You know, what are boards doing to get themselves trained in, in this area? How about management? You know, make no mistake, I don't think that this is just one of those things that is just— I mean, this is, this is gonna be— this is the good news, is that they took the time to document this and to share this with you. And if, and if we all understand this, you can get yourself prepared for a successful—

yeah, well, we'd, uh, we got several. Thank you, everybody that chimed into the chat box. We are seeing slides updating, so if you want to just go ahead and move along, I don't know, you maybe even have this memorized given the number of times you've been asked to talk about it, but we're on slide number 29 that talks about cybersecurity preparedness oversight and management actions.

Yeah, so here's the deal. One of the things, one of the biggest things that the 500 banks cybersecurity assessment found, everybody, Was that management is not leading and setting the tone at the top with information protection and cybersecurity. That again, we're letting Jeff the IT person kind of handle this and run this. And at this point moving forward, the examiners are saying no way. This has got to be a bank thing. Now this is very challenging because look at your board of directors. It's made up of. The head of the big automotive dealership in town or the big grocery store or a big rancher or, you know, those kinds of folks. What do they know about cybersecurity? Well, here's the good news. The good news is they don't need to know much, but they need to know something. You know, for example, the FDIC has a director series that's out there that you could send your board through. I've got a program out there, Eric, that it's called Being a Certified Board Member in Cybersecurity. Again, it's not very heavy lifting, no offense, but it's at the basic level for what a board needs to know for cybersecurity and risk assessment and some of those, you know, what's a firewall and how does it work, you know. And it's at an appropriate level that way. So I think that there are options to get management trained in and certified, to get boards trained in and certified, so that people can handle their responsibilities in terms of the oversight of digital banking at a bank. So that's what that slide's all about, and I'm just logging back in. Should be in here shortly. I'm not exactly sure what happened here.

So if you just want to pull up your PowerPoint locally and just follow along and not worry about it. Yeah, we're just— I'm at slide 30. We can just keep watching. This one is talking about calculating residual risk metrics and measuring the program.

So the second term that is important here. We talked about inherent risk, and now we're talking about residual risk. So residual risk is, boy, you know, we've gotten that inherent risk, that out-of-box risk, and now we've done some things about it. You've done some things to mitigate that risk at your bank, haven't you? Right? And so that's the residual risk. That's the leftover residual risk. And what they're What they're looking for you to do is to use those terms, inherent risk, residual risk. I've calculated my inherent risk, I've done some things, and now I've recalculated residual risk. That's what they're looking for. Let me just give you a quick overview of kind of how this— just so you can sort of visually see this. This is my tool called TRACK, and what I want to get to is inherent residual risk. This is like envision your manual risk assessment spreadsheet where you've got all the different assets listed, right, and you can see over on the left we've got the ATM network, the call reporting system, right, printers and FinCEN and internet banking systems, every— the typical systems and assets that you'd have at your bank, and it comes preloaded with the typical threats that we're seeing at the time. So if we page to the next slide, then slide 32, right, these are the typical threats that I've got predefined for you. Data leakage, unauthorized system access, which is hacking, outsourcing risk, right. You can see the different threats that are there, including impacts and probabilities on a scale of 1 to 5. Then the question becomes for the Jack Henry system, the next slide 33, given those being the threats we're concerned about, right, what can we do about it? Well, these are the things that you can do about it, right, and I won't go into any of the detail of any of these threats or controls, but where I will go into a little bit of detail is on slide 34 then. Now you've done this for all the different assets, and in this example we've got about 30 of them. I know typically you'll have about 50, 60, 70 assets, right, but this is just for illustration purposes. You can see now we've calculated inherent risk, and now we've got residual risk. Perfect. That's exactly what examiners are looking for. Now, if Jeff the IT guy comes to you and says, "Man, we need to do more to mitigate our mobile banking risk," what do you think? Is that where you're going to spend your next security dollar? Looks to me like we've done a great job already mitigating mobile banking risk from the inherent level of 2010 down to. 399, if we've got one more security dollar to spend in our community bank, it isn't going to be on mobile banking risk. We're going to be taking a look at our debit card systems, our internet banking system, and certainly working with Jack Henry, our vendor, to do more to bring that residual risk down.

I think it's important to note here that Jack Henry is being used for demonstration purposes only. We're not suggesting that Jack Henry is an insecure—

Not at all.

Yeah.

Simply an example.

I don't want Monat calling me.

Exactly. Right, this is simply for example. We could push on to slide 35. You know, they also want you to, you know, lay your things out on a schedule, lay your audits out on a schedule. That's not really new news, but boy, we get so many calls in November that they haven't done any of their social engineering tests or any of your audits. Can we get them done by the end of the year? And that's not a well-managed bank, the M in the CAMEL rating. So slide 35 gets to laying some things out on schedules, and I'm going to show you a little bit more detail about that momentarily. Slide 36 is threat intelligence sharing. The finding was that you're not sharing information, you're being very reactive to headlines in the newspaper. So what they'd like you to do on slide 36 is Join FS-ISAC and look at InfraGuard. And if you want more information on Financial Services ISAC or InfraGuard, just get a hold of me after this. Slide 37 gets to cybersecurity controls, right, some of those controls we were looking at just momentarily, just before. What they're saying is you've done a nice job with preventative controls, but they're looking for you to implement more detective and corrective controls. Corrective controls. How do we know that somebody got in and what do we do if they do? So, and then more frequent vulnerability assessments and pen tests. Again, you know, once a year, what does that do? Think if antivirus ran once a year, right? I mean, it runs all the time. So you make so many changes, you need to be probing your network from the inside and outside commensurate with that. One of the other big readings or findings that they had was you're being told of different vulnerabilities in your environment through your vulnerability assessments, pen tests, ACH tests, IT audits, so you know all these different audits that you do and there's about a dozen of them that you do, BSA and all that stuff on the cyber side. But you're not following up and remediating many of those findings. So one of the things that I'd offer as a part of this session today, if you're interested, here's a free system that I'd offer to you. It's called Action Tracking where you can literally take the 15 recommendations from your IT audit, the 4 recommendations from your pen test, the 37 recommendations from your vulnerability assessment, Get them out of the report, get them out of the PDF, and get them into something that you can— and this is a database that you can load up your staff. You're going to assign these to Jeff and these to Karen and these to Emily, and you're going to track the results of the IT audit and make sure things are getting managed and followed up on. The M in the CAMEL rating. The next section is vendor management. And really what they'd like to see is just again even more documentation, risk rating vendors, getting that documented, making sure roles and responsibilities of third parties are clear if there is a cyber attack. Slide 40 is very related, it's incident management, and again they want you to join FS-ISAC, and bullet 2, make sure your cyber incidents are incorporated into your traditional You know, BCPDR kinds of incidents and focus on communication. You know, lastly, what I want to try to show you is laying things out into schedules. It was a big theme of that document, right? So this is an example on slide 41 and 42. Let's be on 41 if we could. Slide 41, you know, the the audit committee is going to hire the pen tester and plan it out. Next month they're going to conduct that pen test, get the report back and see, ah, SBS was able to get in 3 ways and this is what you need to do. That then gets kicked over next month to your IT committee so they can update the risk assessment and say, whoo, you know, somebody got in. And then the results of that get kicked over then in April in this example. Again, this is just example stuff, right, where it gets kicked over to the board of directors. So now the board understands, you know, did somebody get in or not and And what are we doing to make sure the next person can't get in? And you can see there's a variety of vulnerability assessments, ACH, that gets planned, completed, reviewed at the committee level, IT audit committee level, gets kicked over to the IT committee, and then to the board of directors. A very well-managed environment, the M in the CAMEL rating. You can apply that concept on slide 42, Eric. Not just to audit, but to your assets at your risk assessment, or the policies that you need to review. Lay them out on schedules and make sure that your committees and board are involved. Lastly, slide 43. U.S. Treasury brought a bunch of regulators to San Antonio late last year, December, and this was the top 10 hit list that they identified on the IT exam side. Risk management frameworks and vendor risk ratings, cyber insurance which we haven't talked about, information sharing, senior leaders' roles and responsibilities, incident response, very similar. So you can be confident that these are the things that you really want to invest into. I think that slide 44 indicates change is only as strong as its weakest link. And you know you've got to get real about this. If something breaks, you've got to fortify it. You can't you can't just duct tape this stuff together. And lastly, slide forty-five layered security, layered security. No one thing. Not we've got a firewall and we've got the best firewall. Well, that's one thing. Then somebody will fish you and your firewall has nothing to do with that, right? Or they'll go through your dumpsters and get. stuff, and your firewall has nothing to do with that. So don't think, you know, that there's no such thing as being secure. There's just a journey, right, to work towards good security in a community bank. You know, with that, Eric, that's all I have.

You nailed it right on the money. I'm impressed, not that I should be surprised.

Appreciate it, man.

Yeah, so Well, that's great. I know we're right at the top of the hour, and we've asked everybody to reserve an hour for this. But if you have a question or you've got something that you would like to get clarification on, maybe we can stick around for a couple of minutes and give folks an opportunity. But while we're waiting for those to populate, I just want to thank you again for taking the time. I know this is just barely scratching the surface. If this were a scratch-and-sniff sticker, we probably wouldn't even smell anything yet because there's so many different layers that you can go into in all of this. But, you know, certainly some great things to think about. And obviously your contact information is here, and that's accessible to everybody as well. So we'll give it a couple more minutes to see if we've got any other questions, but maybe if you want to just offer some closing thoughts. And if there's no questions, we'll go ahead and wrap it up. The session is again being recorded. We'll make it available at the BES slide. If you registered obviously for this session, you'll get a notification when that video is available. And if you'd like to replay this within your office or maybe invite some other folks to be able to watch it, you're certainly welcome to do that. And I guess one last little thing I'll mention there is, is at the BES I don't know if you just registered for this individual session, but there is a link on that page where you can sign up for email updates. And as future shows are announced, if you're on that email distribution list, you'll be able to get those notifications as well and can join us every month. So with that, Kevin, any closing thoughts on your part?

Yeah, you know, if I could implore you into a couple investments. I mean, the cybersecurity training and education, just going to your state convention and hearing somebody talk about cybersecurity for an hour, that's not what the regulators are looking for anymore. They need folks trained in based on the role that they're performing at the bank. So if you're a board member, you know, you've got to know security to a certain level. If you're a president, it's at a little bit more of a level. If you're a head of operations, it's at a little different level. If you're the head of IT, it's at a much different level. If you're the ISO, it's at a different— right, so role-based training right now is kind of the hot thing, and don't confuse that with, yeah, we heard somebody speak at our local convention. That's not training, that's just awareness kinds of things, where we're going to be talking about the latest things that are going on. We're now talking about if I'm responsible for the ATM network, how do I get trained and certified in that network? If I'm responsible for incident response or I'm on our IRT, our incident response team, how do I make sure that I'm trained in for that job? Right, you wouldn't hire a loan officer and not train them in, but yet we've hired technology folks Right, and just different folks that are quote unquote responsible for cybersecurity and we haven't trained them in. And the regulators have said, you know, we've let that slide long enough. So Eric, thanks for that last remark. I just want to implore you, you know, to go and figure out how you get that kind of role-based training as efficiently as possible as you can because I know examiners are going to come out and look for it. Cool.

Well, good. Well, again, this This has been the 3rd in what I hope is going to be a recurring series of banker education series webinars, and we'll be back again in July. So keep an eye on the BES page, promoting it through social media and LinkedIn and all those other fun places. But one last time, thanks, Kevin, for joining us. It's good to connect with you. I'll be seeing you at future events as well.

Thank you.

And look forward to reconnecting. I'm gonna bring my running shoes, and as long as you promise to take it easy on me, because you're a runner and I'm a trotter, so there's a big difference between those.

Fun stuff, man.

So good. Well, thanks everybody for joining live, and if you've listened to the recording, thanks for taking the time to listen to it. We'll look forward to seeing you in July for our 4th episode of Banker Education Series. Until then, have a great month, and we'll talk to you soon. See you later. Bye.