REMINDER - This newsletter is
available for the Android smart phones and tablets. Go to the
Market Store and search for yennik.
- Hackers more aggressive in attacking customer accounts - A survey
of large financial institutions shows they faced more attacks by
hackers to take over customer banking accounts last year than in the
two previous years, and about a third of these attacks succeeded.
- LinkedIn sued over exposure of poorly secured passwords - A
class-action lawsuit has been filed against LinkedIn over the June 6
data breach that resulted in the theft of nearly 6.5 million
- Germany confirms existence of operational cyberwarfare unit -
German authorities confirmed Tuesday in a parliamentary document
that their military possesses a top secret cyberwarfare unit which
is already operational, but gave no details of how big it is or what
kind of attacks it could conduct.
- New Grad Looking For a Job? Pentagon Contractors Post Openings For
Black-Hat Hackers -
- Policy would require agencies to scan for network threats every 72
hours and begin patching holes - The Homeland Security Department
later this month will present to federal computer contractors and
remote cloud suppliers standards for finding and fixing cyber
threats within 72 hours, DHS officials announced on Thursday.
- N.H. insurance firm had no idea it was working with breached
vendor - A now-defunct, third-party vendor for Primex, which
provides insurance to schools and governments in New Hampshire, lost
an external hard drive and backup tape containing the personal
information of thousands of people.
- The real impact of the leaked password attacks - The recent
attacks that leaked millions of passwords from LinkedIn and eHarmony
accounts is almost becoming a daily news event for those of us who
monitor the security field.
- Insider threat: The game has changed - Give me a couple of minutes
and I'll slip through your virtual private network (VPN), bypass
your firewall, blind your intrusion prevention system and negate
your disk encryption.
- Post-hack, companies fire back with their own attacks - According
to a new report, some companies that have fallen victim to hacking
attacks have gone as far as hiring security firms to hack back. U.S.
companies are being targeted by hackers at an alarming rate. And
according to a new report, they're tired of doing nothing in
- SMB cloud security spending to continue growth - Security spending
among small and midsize businesses (SMBs) is expected to grow over
the next four years, especially in the area of cloud
ATTACKS, INTRUSIONS, DATA THEFT & LOSS
- UK LulzSec suspect charged with hacking in US - A British man
suspected of being part of the Lulz Security hacking group has been
formally charged in the US.
- Merchant information may have been stolen from Global Payments -
Hackers might have stolen the personal information of individuals
who applied for a merchant account with card payment processor
- FTC Fines Spokeo $800K for Peddling False Employee Background
Check Info - Spokeo, an online data broker, has agreed to pay an
$800,000 fine to the Federal Communications Commission to settle
charges it peddled inaccurate information about job applicants and
violated consumer protection laws.
- Feds Bust Credit Card Fraud Ring - A Dutch man accused of running
an underground website devoted to the buying and selling of debit
and credit card data appeared in a Seattle federal courtroom Monday,
where he plead not guilty to a 14-count indictment accusing him of
crimes such as access device fraud, bank fraud, and aggravated
- iTunes vulnerability may enable remote code execution -
Researchers have unveiled a flaw in iTunes that could allow cyber
criminals to execute remote code on target machines.
- Laptop with public employee data stolen in New Mexico - The
personal data of members, former members and beneficiaries of the
Public Employees Retirement Association (PERA) in Santa Fe, N.M. may
be at risk after a laptop was stolen from a car.
Return to the top
of the newsletter
WEB SITE COMPLIANCE -
We continue covering
some of the issues discussed in the "Risk Management Principles for
Electronic Banking" published by the Basel Committee on Bank
Principle 5: Banks should ensure that appropriate measures are in
place to protect the data integrity of e-banking transactions,
records and information.
Data integrity refers to the assurance that information that is
in-transit or in storage is not altered without authorization.
Failure to maintain the data integrity of transactions, records and
information can expose banks to financial losses as well as to
substantial legal and reputational risk.
The inherent nature of straight-through processes for e-banking may
make programming errors or fraudulent activities more difficult to
detect at an early stage. Therefore, it is important that banks
implement straight-through processing in a manner that ensures
safety and soundness and data integrity.
As e-banking is transacted over public networks, transactions are
exposed to the added threat of data corruption, fraud and the
tampering of records. Accordingly, banks should ensure that
appropriate measures are in place to ascertain the accuracy,
completeness and reliability of e-banking transactions, records and
information that is either transmitted over Internet, resident on
internal bank databases, or transmitted/stored by third-party
service providers on behalf of the bank. Common practices used to
maintain data integrity within an e-banking environment include the
1) E-banking transactions should be conducted in a manner that
makes them highly resistant to tampering throughout the entire
2) E-banking records should be stored, accessed and modified in a
manner that makes them highly resistant to tampering.
3) E-banking transaction and record-keeping processes should be
designed in a manner as to make it virtually impossible to
circumvent detection of unauthorized changes.
4) Adequate change control policies, including monitoring and
testing procedures, should be in place to protect against any
e-banking system changes that may erroneously or unintentionally
compromise controls or data reliability.
5) Any tampering with e-banking transactions or records should be
detected by transaction processing, monitoring and record keeping
the top of the newsletter
INFORMATION TECHNOLOGY SECURITY -
We continue our series on the
FFIEC interagency Information Security Booklet.
INTRUSION DETECTION AND RESPONSE
INTRUSION RESPONSE (Part 1 of 2)
Intrusion detection by itself does not mitigate risks of an
intrusion. Risk mitigation only occurs through an effective and
timely response. The goal of the response is to minimize damage to
the institution and its customers through containment of the
intrusion, and restoration of systems.
The response primarily involves people rather then technologies. The
quality of intrusion response is a function of the institution's
culture, policies and procedures, and training.
Preparation determines the success of any intrusion response.
Preparation involves defining the policies and procedures that guide
the response, assigning responsibilities to individuals and
providing appropriate training, formalizing information flows, and
selecting, installing, and understanding the tools used in the
response effort. Key considerations that directly affect the
institution's policies and procedures include the following:
! How to balance concerns regarding availability, confidentiality,
and integrity, for devices and data of different sensitivities. This
consideration is a key driver for a containment strategy and may
involve legal and liability considerations. An institution may
decide that some systems must be disconnected or shut down at the
first sign of intrusion, while others must be left on line.
! When and under what circumstances to invoke the intrusion response
activities, and how to ensure the proper personnel are available and
! How to control the frequently powerful intrusion identification
and response tools.
! When to involve outside experts and how to ensure the proper
expertise will be available when needed. This consideration
addresses both the containment and the restoration strategy.
! When and under what circumstances to involve regulators,
customers, and law enforcement. This consideration drives certain
monitoring decisions, decisions regarding evidence-gathering and
preservation, and communications considerations.
! Which personnel have authority to perform what actions in
containment of the intrusion and restoration of the systems. This
consideration affects the internal communications strategy, the
commitment of personnel, and procedures that escalate involvement
and decisionswithin the organization.
! How and what to communicate outside the organization, whether to
law enforcement, customers, service providers, potential victims,
and others. This consideration drives the communication strategy,
and is a key component in mitigating reputation risk.
! How to document and maintain the evidence, decisions, and actions
! What criteria must be met before compromised services, equipment
and software are returned to the network.
! How to learn from the intrusion and use those lessons to improve
the institution's security.
! How and when to prepare and file a Suspicious Activities Report
Return to the top of
INTERNET PRIVACY - We continue
our series listing the regulatory-privacy examination questions.
When you answer the question each week, you will help ensure
compliance with the privacy regulations.
20. Does the opt out notice
a. that the institution discloses or reserves the right to disclose
nonpublic personal information about the consumer to a nonaffiliated
third party; [§7(a)(1)(i)]
b. that the consumer has the right to opt out of that disclosure;
c. a reasonable means by which the consumer may opt out?