FFIEC – Page 4 – Compliance Guru

25 Oct 2013

Hot Topics Tom Hinkel 0 comment

Windows XP and Vendor Management

The FFIEC issued a joint statement recently regarding Microsoft’s discontinuation of support for Windows XP. The statement requires financial institutions to identify, assess, and manage the risks of these devices in their institutions after April 8, 2014. After this date Microsoft will no longer provide regular security patches or support for this product, potentially leaving those devices vulnerable to cyber-attack and/or incompatibility with other applications.

Identifying, assessing and managing these devices within your own organization is fairly straightforward. Have your admin or support provider run an OS report and present it to the IT Committee for review and discussion of possible mitigation options. But somewhat lost in the FFIEC guidance is the fact that you are also responsible for identifying and assessing these devices at your third-party service providers as well. While the statement was written as if it was directed at both FI’s and TSP’s separately, the FFIEC makes it clear that:

A financial institution’s use of a TSP to provide needed products and services does not diminish the responsibility of the institution’s board of directors and management to ensure that the activities are conducted in a safe and sound manner and in compliance with applicable laws and regulations, just as if the institution were to perform the activities in-house.

So my interpretation of the expectations resulting from this guidance is that you must reach out to your critical service providers and ask about any XP devices currently in use at their organization. If they aren’t using any, an affidavit from the CIO or similar person should suffice. If they are, a statement about how they plan to mitigate the risk should be made a part of your risk assessment. The fact that the FFIEC mentioned “TSP’s” five times in less than two pages indicates to me that they expect you to be pro-active about this.

One other thing that might have been overlooked in the guidance is this concept of operational risk. Many IT risk assessments focus exclusively on the information security elements in their risk assessments, i.e. access to NPI/PII. They only assess the GLBA elements of privacy and security. Operational risk addresses the risk of failure, or of not performing to management’s expectations. If your risk assessment is limited only to GLBA elements, expand it. Make sure the criticality of the asset, product, or service is assessed as well. And, when indicated by high residual risk, refer to your business continuity plan for further mitigation.

17 Sep 2013

Hot Topics Tom Hinkel 0 comment

Data Classification and the Cloud

UPDATE – In response to the reluctance of financial institutions to adopt cloud storage, vendors such as Microsoft and HP have announced that they are building “hybrid” clouds. These new models are designed to allow institutions to simultaneously store and process certain data in the cloud, while a portion of the processing or storage is done locally on premise. For example, the application may reside in the cloud, but the customer data is stored locally. This may make the decision easier, but only makes classification of data more important, as the decision to utilize a “hybrid” cloud must be justified by your assessment of the privacy and criticality of the data.

I get “should-we-or-shouldn’t-we” questions about the Cloud all the time, and because of the high standards for financial institution data protection, I always advise caution. In fact, I recently outlined 7 cloud deal-breakers for financial institutions. But could financial institutions still justify using a cloud vendor even if they don’t seem to meet all of the regulatory requirements? Yes…if you’ve first classified your data.

The concept of “data classification” is not new, it’s mentioned several times in the FFIEC Information Security Handbook:

“Institutions may^* establish an information data classification program to identify and rank data, systems, and applications in order of importance. Classifying data allows the institution to ensure consistent protection of information and other critical data throughout the system.”

“Data classification is the identification and organization of information according to its criticality and sensitivity. The classification is linked to a protection profile. A protection profile is a description of the protections that should be afforded to data in each classification.”

The term is also mentioned several times in the FFIEC Operations Handbook:

“As part of the information security program, management should^* implement an information classification strategy appropriate to the complexity of its systems. Generally, financial institutions should classify information according to its sensitivity and implement
controls based on the classifications. IT operations staff should know the information classification policy and handle information according to its classification.”

But the most relevant reference for financial institutions looking for guidance about moving data to the Cloud is a single mention in the FFIEC Outsourcing Technology Services Handbook, Tier 1 Examination Procedures section:

“If the institution engages in cloud processing, determine that inherent risks have been comprehensively evaluated, control mechanisms have been clearly identified, and that residual risks are at acceptable levels. Ensure that…(t)he types of data in the cloud have been identified (social security numbers, account numbers, IP addresses, etc.) and have established appropriate data classifications based on the financial institution’s policies.”

So although data classification is a best practice even before you move to the cloud, the truth is that most institutions aren’t doing it (more on that in a moment). However examiners are expected to ensure (i.e. to verify) that you’ve properly classified your data afterwards…and that regardless of where data is located, you’ve protected it consistent with your existing policies. (To date I have not seen widespread indications that examiners are asking for data classification yet, but I expect as cloud utilization increases, they will. After all, it is required in their examination procedures.)

Most institutions don’t bother to classify data that is processed and stored internally because they treat all data the same, i.e. they have a single protection profile that treats all data at the highest level of sensitivity. And indeed the guidance states that:

“Systems that store or transmit data of different sensitivities should be classified as if all data were at the highest sensitivity.”

But once that data leaves your protected infrastructure everything changes…and nothing changes. Your policies still require (and regulators still expect) complete data security, privacy, availability, etc., but since your level of control drops considerably, so should your level of confidence. And you likely have sensitive data combined with non-sensitive, critical combined with non-critical. This would suggest that unless the cloud vendor meets the highest standard for your most critical data, they can’t be approved for any data. Unless…

You’ve clearly defined data sensitivity and criticality categories, and…
You’re able to segregate one data group from another, and…
You’ve established and applied appropriate protection profiles to each one.

Classification categories are generally defined in terms of criticality and sensitivity, but the guidance is not prescriptive on how you should label each category. I’ve seen “High”, “Medium”, and “Low”, as well as “Tier 1”, “Tier 2” and “Tier 3”, and even a scale of 1 to 5,…whatever works best for your organization is fine. Once that is complete, the biggest challenge is making sure you don’t mix data classifications. This is easier for data like financials or Board reports, but particularly challenging for data like email, which could contain anything from customer information to yesterdays lunch plans. Remember, if any part of the data is highly sensitive or critical, all data must be treated as such.

So back to my original question…can you justify utilizing the cloud even if the vendor is less than fully compliant? Yes, if data is properly classified and segregated, and if cloud vendors are selected based on their ability to adhere to your policies (or protection profiles) for each category of data.

^*In “FFIEC-speak”, ‘may’ means “should’, and ‘should’ means ‘must’.

05 Aug 2013

Hot Topics Tom Hinkel 0 comment

Critical Controls for Effective Cyber Defense – Converging Standards?

Earlier this year the SANS Institute issued a document titled “Critical Controls for Effective Cyber Defense“. Although not specific to financial institutions, it provides a useful prescriptive framework for any institution looking to defend their networks and systems from internal and external threats. The document lists the top 20 controls institutions should use to prevent and detect cyber attacks.

This document actually preceded the announcement by the FFIEC in June that they were forming a working group to “promote coordination across the federal and state banking regulatory agencies on critical infrastructure and cybersecurity issues”. I mentioned this announcement here in relation to its possible effect on future regulatory guidance. So I was particularly interested in any overlap, any common thread, between the this initiative and the SANS document. If there was any overlap between the organizations contributing to the SANS list and the FFIEC Cybersecurity working group, we might have the basis for a common, consistent set of prescriptive guidance. Could a single “check-list” type information security standard be in the works?

For example, the Information Security Handbook requires financial institutions to have “…numerous controls to safeguard and limits access to key information system assets at all layers in the network stack.” They then go on to suggest general best practices in various categories for achieving that goal, leaving the specifics up to the institution.

Contrast that to the much more specific SANS Critical Control list. Here are the first 5:

Critical Control 1: Inventory of Authorized and Unauthorized Devices
Critical Control 2: Inventory of Authorized and Unauthorized Software
Critical Control 3: Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers
Critical Control 4: Continuous Vulnerability Assessment and Remediation
Critical Control 5: Malware Defenses

As you can see, although the goal of protecting information assets is the same in each case, the SANS list is much more specific. Could we possibly see a converging of the general guidance of the FFIEC with the more specific control requirements of SANS, with cybersecurity as the common goal? Again, a look at the common contributors to each group might provide a clue.

The SANS group credits input from multiple agencies of the U.S. government; the Department of Defense, Homeland Security, NIST, FBI, NSA, Department of Energy, and others. The FFIEC working group coordinates with groups such as the FFIEC’s Information Technology Subcommittee of the Task Force on Supervision, the Financial and Banking Information Infrastructure Committee, the Financial Services Sector Coordinating Council, and the Financial Services Information Sharing and Analysis Center (FS-ISAC). SO no direct common thread there, unfortunately. However the FS-ISAC group does share many partners with the SANS group, including the Departments of Defense, Energy, and Homeland Security, so we may yet see the FFIEC Information Security guidance evolve. Particularly since the Handbook was published back in 2006, and is overdue for a major update. In the meantime, financial institutions would be well advised to use the SANS Critical Controls as a de-facto checklist to measure their own security posture.*

By the way, the document also lists 5 critical tenets of an effective cyber defense system, 2 of which are ‘Continuous Monitoring’ and ‘Automation’. More on those in a future post (although I already addressed the advantages of automation here).

* There is nothing in the SANS list that is inconsistent with FFIEC requirements, in fact we’ve already seen at least one company servicing the Credit Union industry adopt this list as their framework. However, keep in mind that although the controls listed are necessary for cyber defense, they are not sufficient. A fully compliant information security program must also address management and oversight…an area conspicuously absent on the SANS list.

24 Apr 2013

Hot Topics Tom Hinkel 0 comment

The Financial Institutions Examination Fairness and Reform Act – Redux

This new bill (H.R. 1553) introduced on April 15th is actually a word-for-word duplicate of H.R. 3461 which I wrote about here. The previous bill died in committee, but H.R. 1553 has a few more sponsors. Now, I know what you are thinking…that there is no such thing as “good” regulation. But bear with me, because this bill actually is good for the industry, banks and credit unions alike.

The full text of the bill is here, and I encourage everyone to read it and consider throwing your support behind it, but in summary it…

…requires that examiners issue their final examination reports in a timely manner, no later than 60 days following the exit interview. This is important for FI’s because all examination findings must be reported to the Board, and assigned to responsible parties for remediation. I have heard stories of institutions waiting 6+ months for a final report, and this just isn’t fair. Since most institutions are on a 12 month examination cycle, this only leaves a few months for remediation in order to avoid repeat findings.
…requires that the examiner make available all factual information relied upon by the examiner in support of their findings. This levels the playing field, allowing institutions to see exactly why findings occurred and better prepare you to push back if you think the finding is incorrect.
…changes the treatment of commercial loans. Currently, if the value of the underlying collateral declines, the loan may be forced into non-accrual status regardless of the repayment capacity of the borrower. The bill would prevent that from happening. It would also prevent a new appraisal on a performing loan unless new funds were involved. It stands to reason that if non-accrual status is tied to non-performing status, it should result in higher asset quality assessments, resulting in fairer reserve requirements, fewer enforcement actions, and fewer CAMELS score downgrades.
…requires a standard definition of “non-accrual” along with consistent reporting requirements. The less institutions are subject to examiner interpretation, the more predictable the examination experience will be. Lack of consistency resulting in unpredictable results is the single biggest complaint of the examination process. I don’t know of a single institutions that wants to “get away” with anything during an exam, they only want to know what to expect.
…establishes an “examination ombudsman” in the office of the FFIEC, independent of any regulatory agency. In addition to being a more impartial forum for presentation of grievances regarding the examination process, they would also be responsible for assuring that all examinations adhere to the same standards of consistency. In the survey conducted with my previous post on this topic, 60% of respondents said that they would be more likely to appeal an exam finding if the appeal process was with the FFIEC as opposed to the regulator that conducted the exam.
…would prohibit retaliation against the FI for exercising their rights under the appeals process, and delay any further agency action until the appeals process was complete.

Of course it’s a long road from a bill to a law, but I think you would agree that all these things are good for the industry. At the very least, any regulation that gives bankers more control and less uncertainty is a welcome change from recent events! You can track it here. A companion Senate bill was also just introduced, S. 727. Track it here.

25 Feb 2013

From the Field Tom Hinkel 0 comment

Examination Downgrades Correlated with Poor Vendor Management

According to Donald Saxinger (senior examination specialist in FDIC’s Technology Supervision Branch) in a telephone briefing given to the ABA in December of last year, almost half of all CAMELS score downgrades in 2012 were related to poor vendor management. The briefing was titled “Vendor Management: Unlocking the Value beyond Regulatory Compliance“, and in it Mr. Saxinger noted that in 46% of the FDIC IT examinations in which bank ratings were downgraded, inadequate vendor management was cited as a causal factor. He went on to say that although poor vendor management may not have been the prime cause, it was frequently cited as a factor in the downgrade.

Mr. Saxinger recommends that banks request, receive, and review not just financials and third-party audits such as SOC reports and validation of disaster recovery capabilities, but also any examination reports on the provider. Federal examiners have an obligation and a responsibility to monitor financial institution service providers using the same set of standards required of the institutions themselves, and they are doing so with increasing frequency.

In addition, consider that all of the FFIEC regulatory updates and releases issued last year were either directly or indirectly related to vendor management:

Changes to the Outsourcing Handbook to add references to cloud computing vendors, and managed security service providers.
Updates to the Information Security Handbook to accommodate the recently released Internet Authentication Guidance (with its strong reliance on third-parties).
Changes to all Handbooks to accommodate the phase-out of the SAS 70, and replace with the term “third-party review”.
Updated guidance on the URSIT programs for the supervision and scoring of Technology Service Providers.
Completely revised and updated Supervision of Technology Service Providers Handbook.

So regulators see inadequate vendor management as a contributing factor in examination downgrades, and virtually all new regulations issued by the FFIEC are related to it as well. As a service provider to financial institutions we are prepared for, and expecting, added scrutiny. As a financial institution looking to optimize examination results and stay ahead of the regulators, you should be too.

Here is a link to all vendor management related blog posts.

24 Jan 2013

Hot Topics Tom Hinkel 0 comment

FFIEC Issues Proposed Social Media Guidance

(UPDATED – Added link to public comments)

Just out, this document is really a request for comments on the proposed guidance, but final guidance is likely to follow this very closely…and very quickly. As many financial institutions are probably getting their social media policies together now (or updating existing policies), this is a must read. Here is an executive summary (and please respond to the poll at the bottom):

First of all, the guidance does not impose additional obligations on financial institutions. The responsibility to properly manage the potential risks associated with social media usage and access is no different than that which is required for any new product, service or process.
The FFIEC defines social media as the “…a form of interactive online communication in which users can generate and share content through text, images, audio, and/or video”. Also, “Social media can be distinguished from other online media in that the communication tends to be more interactive.”
Institutions are expected to have a risk management program in place that allows it to identify, measure, monitor, and control the risks related to social media…again, an expectation that exists for every other risk an institution faces.
It should be designed with participation and involvement from specialists in compliance, technology, information security, legal, human resources, and marketing.
Components of the program should include:
- Board and senior management approval and involvement, including strategic justification of a social media strategy.
- Policies and procedures (either stand-alone, or incorporated into other existing policies) addressing the proper use and management of social media.
- Proper vendor management of social media providers.
- Employee training, including both proper and improper activities.
- A process to monitor all social media activity, whether initiated by the institution, or a contracted third-party.
- Audit oversight.
- Periodic reporting to the Board and senior management as to whether or not social media activities are meeting strategic goals.
Policies and procedures must address the following risks:
- Consumer Compliance & Legal/Regulatory Risks, including:
  - Truth in Savings Act/Regulation DD and Part 707
  - Fair Lending Laws: Equal Credit Opportunity Act/Regulation B3 and Fair Housing Act
  - Truth in Lending Act/Regulation Z
  - Real Estate Settlement Procedures Act
  - Fair Debt Collection Practices Act
  - Unfair, Deceptive, or Abusive Acts or Practices (UDAAP)
  - Deposit Insurance (FDIC) or Share Insurance (NCUA)
  - Electronic Fund Transfer Act/Regulation E
  - Bank Secrecy Act/Anti-Money Laundering Programs (BSA/AML)
  - Community Reinvestment Act (CRA)
  - GLBA Privacy Rules and Data Security Guidelines
  - CAN-SPAM Act and Telephone Consumer Protection Act
  - Children’s Online Privacy Protection Act
  - Fair Credit Reporting Act
- Reputation Risk, including:
  - Fraud and Brand Identity
  - Third Party Concerns where social media activities are outsourced
  - Privacy Concerns arising from the public posting confidential information
  - Consumer Complaints and Inquiries
  - Employee Use of Social Media Sites, including through employees’ own personal social media accounts
- Operational Risk, paying particular attention to the requirements in the FFIEC booklets “Outsourcing Technology Services” and “Information Security”

As you can see, whether you have separate social media policies, or incorporate the elements into other policies, the requirements have expanded considerably. Use this summary as a checklist as you draft your new, or update your existing, policies.

I have written before about the unique challenges presented by social media, and how it doesn’t easily lend itself to traditional risk management techniques. This new guidance recognizes that, and makes it crystal clear that although it is difficult, you must still follow the same basic risk management procedures you use for everything else…Identify, Measure, Control and Monitor.

One final thought…you are expected to tailor your efforts to the breadth of your involvement in this area. The standard “size and complexity” considerations apply here. But even if you decide not to engage in a formal social media effort, you must still have a policy because you cannot completely avoid the risks of employees posting on their personal accounts, and third parties posting negative comments. Unlike other endeavors, risk avoidance is not an effective control!

[poll id=”7″]

Comments are now closed. If you would like to view comments, here is the link: http://www.regulations.gov/#!docketDetail;D=FFIEC-2013-0001

← Previous 1…345…15 Next →