Phishing attacks are becoming more and more common as the years go on. You see phishing emails disguised as many things, from phony Microsoft 365 login pages to fake fantasy football sign ups. Nowadays we know two things when it comes to Phishing, your organization is not immune to attacks and employee training has never been more important.
At Tandem, we regularly receive the question, "What's the difference between policies, standards, controls, and procedures?" This question is foundational to being able to understand how to best write an information security policy. By defining what each of these elements are (and are not), communication can happen more clearly, which is why you try to have these things in the first place.
"If you don't know where you are going, any road will take you there." – The Cheshire Cat, Alice in Wonderland by Lewis Carroll
Picture this: You have a big event coming up, like an audit, an exam, a board report, you get the idea. You know they are going to ask for your policy review meeting minutes. What exactly are you going to give them?
It's no secret that phishing tests are a commonly used form of security awareness training. In fact, the 2022 Tandem State of Cybersecurity Report found that 92% of surveyed financial institutions are implementing phishing tests. This makes it the most common form of training right now.
If you asked a hundred Information Security Officers (ISOs) about their favorite part of the job, I would be willing to venture a guess that exactly zero of them would respond with anything related to the organization's information security policies. This is a tragedy, my friends.
Since the effective date for the incident notification rule for banks, we have received several questions asking about whether an incident would be classified as a "notification incident" or not. For example:
During the development of our Incident Management product, we spent a lot of time researching and reviewing guidance, so we could know exactly what should be included in a financial institution's incident management program. While not an exhaustive list, if you are looking for guidance regarding what to include in your plan, the resource below will help you get started.
On May 13, 2022, the FFIEC published an entry to the IT Examination Handbook Infobase What's New page stating that they had rescinded the E-Banking booklet. If you're anything like me, you may be asking questions like "why" and "what am I expected to do now?" If that's you, you've come to the right place. Let's answer those questions.
If you work in a financial institution, you may be familiar with using the terms "electronic banking," "internet banking," and "mobile banking" interchangeably. With the publication of the FFIEC's new Authentication and Access to Financial Institution Services and Systems guidance, a new term appeared: "digital banking." The introduction of this new term made me wonder, what does it all mean? Should these terms be used interchangeably and if not, what exactly are the differences among them?