Using IT to Reduce the Risk of Data Breaches and Fraud At Your Credit Union

Credit Unions and other financial institutions are at major risk of data breaches. And most cyber attacks are financially motivated. Now that you know that your organization could be a target, how can you take the appropriate steps to protect yourself? In this post, we’ll investigate some of the basic network security strategies to institute in an effort to protect your data and prevent both breaches and fraud.

These strategies include:

• Securing firewalls
• Implementing strong BYOD and Acceptable Use policies
• Maintaining strong Rights Management policies

Securing Firewalls

Firewalls take their name from a real world, physical structure: a wall between adjoining structures that literally prevents fire from spreading from one space or structure to another. Their place in the IT world was cemented when they were first introduced over 25 years ago, and they’ve become an integral piece of security planning ever since. So, if a firewall takes its name from a building component, then what does it do in relation to IT? The same thing, essentially. A firewall works to contain threats, preventing them from penetrating your security network and doing harm. This means that if someone is attempting to gain access to your network, they’ll be stopped before they can get in. And if they do manage to find their way in, the firewall will then work to contain them, blocking them from actually accessing any data.

To ensure that your firewall is as secure as possible, here are a few quick tips:

• Have an official change request and approval process - a quick email asking for access changes shouldn’t be considered sufficient documentation
• Speaking of changes, do your best to batch them rather than make them on one-off occasions. Of course if there is an emergency you can make exceptions to this rule, but for the most part it’s best to implement the changes at the same time. This could be particularly beneficial so that as you’re making the changes you’ll be aware of whether one change overrides another or creates a particularly arduous roadblock.

Implementing Strong Policies and Procedures

One of the most efficient ways to keep your data safe is to do your best to eliminate human interference or error. In many organizations, it’s quite common for employees to access their business email on their personal mobile device, or use their work computer to perform personal tasks.

By putting strong Bring Your Own Device (BYOD) and Acceptable Use policies into place, your employees will have a clear understanding of what they can and cannot do with company resources and on company time. For example, requiring users to utilize two-factor authentication on their mobile devices in order to access work email will add an additional layer of security to any data that’s transmitted across your network. Additionally, blocking certain websites - such as personal email and social media accounts - will prevent users from inadvertently allowing nefarious third-parties onto your network via a backdoor.

In addition to protecting your data, these strategies will protect your customers’ data and help to eliminate the risk of fraud. If a cybercriminal gains access to an employee account, they could potentially send emails or other communication to customers asking them to provide sensitive information unbeknownst to anyone at your organization.

Applying Strong Digital Rights Management Policies

Finally, instituting strong Digital Rights Management (DRM) policies will limit the data and information that certain individuals have access to. By doing this and working with a Policy of Least Privilege (PoLP), users will have access only to the data they need. Therefore, if an individual account is compromised, sensitive data - such as financial documentation and account information - won’t be available through that account. Now that you’ve got a few tips - which are obviously just scratching the surface - for implementing strong policies under your belt, learn more about security best practices in our white paper Security In Layers.