Posts about:
It's no secret that phishing tests are a commonly used form of security awareness training. In fact, the 2022 Tandem State of Cybersecurity Report found that 92% of surveyed financial institutions are implementing phishing tests. This makes it the most common form of training right now.
If you asked a hundred Information Security Officers (ISOs) about their favorite part of the job, I would be willing to venture a guess that exactly zero of them would respond with anything related to the organization's information security policies. This is a tragedy, my friends.
Since the effective date for the incident notification rule for banks, we have received several questions asking about whether an incident would be classified as a "notification incident" or not. For example:
During the development of our Incident Management product, we spent a lot of time researching and reviewing guidance, so we could know exactly what should be included in a financial institution's incident management program. While not an exhaustive list, if you are looking for guidance regarding what to include in your plan, the resource below will help you get started.
On May 13, 2022, the FFIEC published an entry to the IT Examination Handbook Infobase What's New page stating that they had rescinded the E-Banking booklet. If you're anything like me, you may be asking questions like "why" and "what am I expected to do now?" If that's you, you've come to the right place. Let's answer those questions.
If you work in a financial institution, you may be familiar with using the terms "electronic banking," "internet banking," and "mobile banking" interchangeably. With the publication of the FFIEC's new Authentication and Access to Financial Institution Services and Systems guidance, a new term appeared: "digital banking." The introduction of this new term made me wonder, what does it all mean? Should these terms be used interchangeably and if not, what exactly are the differences among them?
Every member of your staff is responsible for doing their part to help secure the organization from incidents, but do they know that? Employee training is a significant component of an effective incident management program. In this article, we are going to explore training benefits, target audience, potential topics, and available resources.
As distributed ledger technology has evolved over the last few years, the National Credit Union Administration (NCUA) has stepped into the unknown and has provided their supervised entities with guidance on the topic. In fact, they published two:
On December 9, 2021, the Federal Trade Commission (FTC) published their revised Standards for Safeguarding Customer Information (16 CFR Part 314) in accordance with the Gramm-Leach-Bliley Act (GLBA). This updated rule exists to improve how financial institutions regulated by the FTC develop and implement their information security programs.
In a recent Tandem "Ask Me Anything" webinar on risk assessments, one of the attendees asked, "What is a GLBA risk assessment?" This is a great question and one that is foundational to the world of information security for financial institutions. Let's talk about what it is and how to do one, with a dash of history for good measure.