NCUA IT Exam Focus By Tom Schauer, Principal CliftonLarsonAllen
My Background and Experience Computer Science Degree - Puget Sound Information Security Professional for 30 years Consultant: Ernst & Young, Deloitte, Guardent (Verisign) Started TrustCC in 2000 - IT Security and Compliance Grew to about 20 people Technically superior, devoted, trusted! Joined CliftonLarsonAllen in September of 2015 2
My personal security philosophy When you and a friend are being chased by a bear, it is not necessary to out run the bear, it is only necessary to out run your friend. Effective security May Be nothing more than being more secure than the target down the road? Absolute security is unattainable. 3
In the world of networked computers every sociopath is your neighbor.
Opportunistic vs Targeted
Example:
11
Attack Sophistication 13
4PM 4:01PM HACKER Notates Total Debits Notates Total Credits Notates Total # Batches ACH CORE Banking System Windows File Share In-house ACH Originations are most susceptible to this attack vector. Outsourced ACH could also be susceptible. 4:05 to 5:00PM FedLine ACH Upload File to The FED Confirms Total Debits Confirms Total Credits Confirms Total # Batches The FED
Why is ACH Susceptible? ACH File Format created in 1970s and does not include ANY modern security mechanisms. Typical ACH process utilizes Windows File Share as temporary file location. With Windows having 92% of the market share, hackers are most proficient hacking Windows. 65% to 100% success.
1 Secure Computer? The only secure computer is one surrounded by concrete and in the bottom of the ocean. We are not seeking absolute security, we are seeking enough security and enough is a moving target! Password length was 4, then 8, now 14+ Passwords were reused, now unique per use
In Response NCUA has declared Cybersecurity as the number one priority for 2015 and 2016 FFIEC issues Cybersecurity Assessment Tool in 2015 Starting June 2016, Exams will have new Cybersecurity procedures 17
Historical Guidance 2001 GLBA inspired 12CFR Part 748 2005 12CFR Part 748 Appendix B 2006 FFIEC Information Security Guide Miscellaneous Letters to Credit Unions 2015 FFIEC Cybersecurity (CAT)
FFIEC CAT Tool 2015 Guidance, originally notated as voluntary. Voluntary removed Aug 2015 Starting June 2016, examers expect some form of cybersecurity risk assessment that is similarly capable as FFIEC Tool Inherent Risk Component Controls Maturity Component
FFIEC CAT Tool Inherent risk model must scale to financial institutions of all sizes
FFIEC CAT Tool Maturity model is based upon self reporting and does not have a validation component. Just a risk assessment.
FFIEC CAT Tool
FSISAC CAT Tool
Polling Question How many have completed the FFIEC CAT using some form of the guidance? a) Completed b) Not Completed
A Risk Assessment a Day Keeps the Examiner at Bay
Risk Assessments Convenient method of documenting regular risk management analysis and decisions. Differentiate between required and risk assessment as a management tool. Have a simple form Topic Characterization of Inherent Risk Risk Mitigation and Controls Characterization of Residual Risks Conclusion and Plans for Action
Polling Question How many use a risk assessment form/process of some kind to regularly document risk management analysis and decisions? a) Use Documented Form/Process b) Do Not Used Documented Form/Process
Risk Assess: Attack Targets NCUA Aires File Other Core extracts Marketing extracts Wire Transfers ACH Originations
Risk Assess: Ransomware Ransomware and other common attack vectors delivered through social engineering.
Breach Detection Indicators of Compromise The creation or modification of an administrator account Any activity which seems to disable antivirus, logging or firewall controls Outbound data transfers Unknown Hosts attached to the network Unauthorized or Unknown Software installed on a known host Consecutive invalid password attempts on multiple user IDs from the same IP Consecutive access denied events on a single account on multiple hosts from the same IP Attempts to access disabled accounts
Polling Question How many believe their process will detect and alert to these indicators of compromise? a) All, and our testing proves it! b) All, but we ve not validated/tested. c) Some, testing shows gaps. d) Some, but testing needed. e) Oh boy, we are in trouble.
Breach Preparedness and Testing Cybersecurity Insurance Who is covered, when are they covered, how? Incident Response Plan Notice Obligations (12CFR Part 748 Appendix B) Plan Testing Covert Pen Testing (True Breach Simulation) Table Top Scenario Testing
Using Standards Engage a large, nationwide IT auditing firm with extensive experience performing IT governance audits for a range of industries to perform an ISO Based Information Security Assessment leveraging a methodology rooted in industry standards and best practices (ISO 27002, 27015)."
Examiner Skills RISOs generally very well qualified, full time SMEs less experienced, part time Skilled Understand role, operationally savvy Over Achiever Expectations beyond authority Under Achiever Checklist reviews
Polling Question What was the skill of your most recent IT examiner? a) Skilled b) Over Achiever c) Under Achiever
Standards to consider Great tools for measuring progress towards goal In addition to the FFIEC CAT SANS / CIS Twenty Critical Security Controls ISO 27001/27001 NIST 800-53A and others COBIT
Polling Question Are you measuring your security program against a specific standard? a) No b) Yes, SANS/CIS Twenty Critical c) Yes, NIST d) Yes, ISO e) Yes, Other or Several of the Above
Covert Breach Testing Security Assessments performed with IT knowledge and collaboration can be the most thorough and effective tests but they fail to evaluate breach detection and response capabilities.
Vulnerability Management Supplement / Support Patch Management Credentialed Vulnerability Scans Remediation and Reconciliation Reporting
Frequency of Testing Risk Assessment Penetration Testing Vulnerability Assessment General Controls Review Social Engineering True Breach Simulation
Password Management Passwords are clearly the weakest link in the security chain. Equip users to select strong passwords. Length increasing 14 Stronger requirements for Admins Distinct Admin/User accounts w unique PWs Password Wallets?
Board Reporting Regular consider monthly, quarterly All elements: Information Security Program and status - IT and InfoSec Policies - Security Breaches or attempted breaches - IT Strategic Plan - Information Security Risk Assessment - Business Continuity Plan and Testing Results - Incident Response Plan - Results from Vendor Management Reviews - Insurance coverage for IT risks
The threat has reached the point that, given enough time, motivation, and funding, a determined adversary will likely be able to penetrate any system accessible from the Internet. Joseph M Demarest, Assistant Director, Cyber Division FBI, before the Senate Judiciary Committee, May 8, 2013 43
This is your security program! Time Motivation Funding Profit Time Motivation Funding Profit 44
And Business Continuity Planning Vendor Management Information Security Policies
Any Questions? tom.schauer@claconnect.com 253-468-9750 CliftonLarsonAllen