customer training – Compliance Guru

04 Sep 2012

Hot Topics Tom Hinkel 0 comment

Customer Awareness Education – 3 reasons it should now be a top priority (and how to address it)

By now everyone has at the very least completed their electronic banking risk assessment, and most institutions have probably gotten feedback from their primary examiner on their progress. So what’s next? Where should you focus your time and resources now? Or should you just wait to see where the regulators go next? Here are 3 reasons why I think customer education is the next logical step…and why you shouldn’t wait to address it.

The updated guidance expects you to enhance the customer awareness program you already have in place. This is the first challenge, because many institutions I speak to don’t have a formal customer awareness program in place to enhance. They may have done some one-off training here and there, but nothing formal. Make training your customers in information security best practices just as important as training your employees. Make it a part of your policies, require annual participation, and document those that participate (and those that don’t).
Customers are largely acknowledged as the least secure element in the electronic banking process. No amount of layered technical controls will prevent this risk. Using sophisticated anomaly detection may allow you to quickly detect and respond to an incident, but prevention is far better, and there are no fool-proof ways to stop someone from clicking, opening or downloading something they shouldn’t. Additionally, because your customers are probably from outside the financial industry, they have never been, and will never be, exposed to the same high level of constant security awareness as you and your employees are. Besides, doesn’t it just make sense to focus your resources on controls that have the lowest cost and highest degree of success? Awareness is the best preventive control.
Future “commercially reasonable” legal interpretation may favor those institutions that go beyond bare minimum requirements. According to the judges opinion in a recent court case involving an account takeover, if and when the security procedures are deemed commercially reasonable, the burden then shifts to the customer (merchant) “…to supervise its employees to assure compliance with the security procedure and to safeguard confidential security information and access to transmitting facilities so that the security procedure cannot be breached.” So beyond simply addressing regulatory expectations, a formal customer awareness program may just be that little something extra that establishes “reasonableness” in the eyes of the court.

So what should your customer awareness program include? Here is a quick summary of minimum requirements based on the FFIEC guidance:

Target both commercial and consumer customers. Focus on high-risk customers first, but then expand to everyone.
Are Reg E protections applicable on their account? What are the implications if so, and if not?
Under what, if any, conditions you might contact the customer and request their e-banking credentials. (Should be “never ever”, right?)
Strongly suggest that they conduct their own risk assessment. Consider providing a simple checklist to get them started. The PCI Security Standards Council has some self-assessment checklists that you may find useful. Modify as needed.
Unless you want the customer using you as their outsourced IT department, you should let them know where else to turn for support. Consider a partnership with a trusted local IT vendor.
A list of your employees names, email addresses and phone numbers that they can use if they suspect suspicious activity. Many security events happen off-hours. Can they reach you 24/7 if needed? And make sure emails are sent to multiple employees simultaneously so they won’t go unnoticed.

Additional Resources:

Microsoft has a very basic 10 question quiz:

http://go.microsoft.com/?linkid=9745641

The U.S. Chamber of Commerce also has resources to assist you:

http://www.uschamber.com/issues/technology/internet-security-essentials-business

Gladiator Technology has a service that addresses the customer awareness requirement, and provides an audit trail: http://www.profitstars.com/ProductBriefs/PSS_Gladiator_eCommercialSAT.pdf

16 Jul 2012

Hot Topics Tom Hinkel 0 comment

Commercially UNreasonable Security

So an appellate court has just reversed the PATCO court ruling, essentially deciding against the financial institution. They ruled that the banks’ security procedures were commercially UN-reasonable.

To summarize, a commercial e-banking customer (PATCO Construction) experienced a financial loss due to an account take-over. They sued the bank to recover the loss, claiming the bank used poor security. The original ruling was in favor of the bank. This ruling was in favor of the customer, and has major implications for all financial institutions as they navigate their way through the increasing risk and increased regulatory requirements of Internet banking.

The entire ruling is worth a read, but here are a few of the highlights from my perspective:

In the end, it wasn’t just a single control failure, but a series of failures on the part of the Bank that led to the ruling. One example is that the Bank lowered the alert trigger for challenge questions from $100,000 to $1, effectively requiring all transactions to require an additional authentication step. The Bank undoubtedly felt they were increasing the safety of all transactions by taking this step, but it actually had the opposite effect. By requiring challenge questions for all transactions they substantially increased the number of chances the criminals had to intercept the correct challenge responses.
The on-line banking product (NetTeller Premium) and provider (Jack Henry & Associates) offered adequate options for on-line transaction security, but not all options were enabled by the Bank. And…
…of those security options offered by the Bank, not all were accepted by the customer. And…
…of those offered and accepted, some were ignored. For example the anomaly detection capabilities worked properly, and automated risk profiling correctly generated abnormally high risk scores for the fraudulent transactions, but no action was taken by the Bank to block them.
The definition of “commercially reasonable” has evolved from the initial ruling favoring the customer, to the most recent one. Both rulings make several references to Article 4A of the UCC (Uniform Commercial Code). The initial ruling stated that because the customer signed the agreement, they implicitly agreed to the security measures, effectively rendering them commercially reasonable. However the most recent ruling quotes from UCC 4A and states “[t]he standard is not whether the security procedure is the best available. Rather it is whether the procedure is reasonable for the particular customer and the particular bank.” Therefore…
…a “one-size-fits-all” approach will not work, institutions MUST tailor their controls to the risks of the transaction.

But here is the most significant take-away for me, and the one with the biggest implication for financial institutions. The judge ruled that based on the UCC 4A official comments on Section (1)(b), if and when the security procedures are deemed commercially reasonable, the burden then shifts to the customer…

“…to supervise its employees to assure compliance with the security procedure and to safeguard confidential security information and access to transmitting facilities so that the security procedure cannot be breached.”

So, all you have to do is risk assess the customer and transactions and employ layered security suitable to the risk, and then the legal and financial liability shifts to the customer, right? Maybe not. According to the FFIEC Internet Authentication update, one of the controls an institution may include (translated from ‘FFIEC-speak’ as SHOULD include) in its layered security program is a “Customer Awareness and Education” program. Which means you are still on the hook unless you can document that you also maintain a customer awareness program AND your customers are actually being trained. (As I mentioned here, you may also want to add a summary of your customer awareness program to your annual report to the Board of Directors).

I’m certain we’ll see more lawsuits on this matter and future rulings may go either way, but the risk is real and immediate so don’t wait for the courts to sort things out. Here is what you need to do:

Complete the risk assessment if you haven’t already. Define high risk transactions, and identity high risk customers.
Implement a layered security program. Make sure you know and understand all of the controls available from your e-banking product vendor. Vendors are adding controls all the time to address the evolving threat environment.
Make sure your customers know and understand all of the controls you’ve made available to them. If they resist or refuse a particular control that you’ve recommended, have them sign-off that they understand and accept the increased risk.
Educate your customers, initially and periodically throughout the relationship, and regardless of whether they resist. Regardless of the quantity and sophistication of your technical controls, the customer is, and will always remain, the weakest link in the security chain.

16 Feb 2012

From the Field Tom Hinkel 0 comment

FDIC changing annual IT report to Board?

Based on recent examination findings, it would appear that the FDIC is changing what they expect to see in the annual information security report to the Board of Directors. The requirement for the report is established in the FFIEC Information Security Handbook where it states that a written report to the board should describe the overall status of the information security program, and that at a minimum, the report should address:

The results of the risk assessment process
Risk management and control decisions
Service provider arrangements
Results of security monitoring and testing
Security breaches or violations, and management’s responses
Recommendations for changes to the information security program

However in a recent examination the institution was written up because the FDIC did not believe the report contained enough detail. They stated that “Board reporting should be expanded and include detail at a minimum for the following areas:

The information security risk assessment
Service provider agreements
Results of testing, audits, examinations or other reviews of the program
Any security breaches, violations, or other incidents since the previous report and management responses
A summary of information security training provided to employees since the last report
Status of the patch management program
Status of the Business Continuity Plan and testing results
Customer Awareness Program efforts and plans
Any recommendations for changes to the information security program”

I’ve highlighted the changes between the original guidance and the examination finding. I’m not surprised at the training findings, as I have previously identified both employee and customer training as likely 2012 trends. Nor am I particularly surprised by the inclusion of the status of the BCP and testing results. This has been a requirement and an area of increased regulatory focus for a couple of years. However it would appear that examiners may now prefer the BCP status update to be a part of the information security update report to the Board.

The inclusion of a patch management status report was a bit surprising though, as in the past this was not reported separately but simply included as one of your many risk management controls. Perhaps they are looking for more control detail now? (I plan to address patch management in a future post.)

I was also a bit baffled by the exclusion of “Risk management and control decisions” from the list of findings. I had also identified the “Management” element as a probable area of increased regulatory scrutiny in 2012, so I’ll keep an eye on future examination findings to see if this actually represents a shift in focus or simply an oversight by the examiners this time. (Of course a third possibility is that the examiner felt that the “risk management and control decisions” were present and properly documented, but given the other findings I doubt that was the case.)