When acquiring another company, it is common to perform due diligence to ensure that there are no surprises. For a financial institution, this due diligence usually focuses on auditing financials...
Recent Posts
One common situation that we see occurring in financial institutions is that IT departments apply patches diligently, but that vulnerability management systems still show some patches are missing....
Every financial institution should have a data classification policy that defines classes of data based on risk. The policy should also define how each class of data is handled throughout its life,...
Yesterday MS-ISAC released a document summarizing the capabilities of the TrickBot malware. TrickBot focuses on obtaining consumer financial credentials, so should be a concern for all financial...
The number of passwords that each person needs to remember grows exponentially each year. The password manager industry has emerged to help people securely keep track of their passwords, and many...
Most institutions have been in the situation of having end-of-life hardware or software systems present in their environments. These systems quickly become the focus of compliance staff,...
Since 2015, banks have had the ability to obtain Internet domains that end in .BANK instead of the more common .COM or .NET domains. As the popularity of the new .BANK top level domain increases,...
Determining what level of employee remote access is appropriate for your institution is an important decision. If you provide no remote access to employees, you risk lower productivity and less...
The IT department of a financial institution usually monitors threat indicators from many different systems. It is best practice to provide reporting of the most important metrics from this...
The National Cybersecurity and Communications Integration Center (NCCIC) recently issued an alert that they were aware of a Domain Name System (“DNS”) hijacking campaign. The possibility of these...