Data Breaches and Cyber Risks

Data Breaches and Cyber Risks

MD/DC Credit Union Association

2015 Volunteer Leadership Conference

Presented by: Ken Otsuka

Data Breaches – How do they Happen?

•

Network hackers and malware

•

Employee negligence / theft

•

Lost / stolen laptops, backup tapes /

disks and other data-bearing mobile

devices

Data Breaches

•

Financial risk

•

Compliance / Legal risk

•

Reputation risk

Agenda

•

Board’s role in data security

•

Data breach studies by the Ponemon Institute, Verizon, Mandiant and

PricewaterhouseCoopers (PwC)

•

Data breach insurance claims study – NetDiligence

•

Best practices for securing members’ confidential data

•

Mobile devices

•

Assessment tools

–

National Institute of Standards and Technology’s (NIST) Cybersecurity

Framework

–

Federal Financial Institutions Examination Council’s (FFIEC) Cybersecurity

Boards Have a Duty to Protect Member Data

• Appendix A implements the Gramm-Leach-Bliley (GLB) Act’s safeguards rule and requires credit unions to develop a written information security program (ISP)

– Ensure the security and confidentiality of member information;

– Protect against anticipated threats to the security and integrity of such information; and

– Protect against unauthorized access to, or use of, such information that could result in substantial harm to members

• The board is responsible for overseeing the development, implementation, maintenance and approving the ISP

• ISP must contain an incident response plan (IRP)

– Addressed in Appendix B

– Board is responsible for the IRP

• Management must report to the board at least annually on the overall status of the written information security program

Ponemon Institute

Is Your Company Ready for a Big Data Breach?

The Good

•

73% of the organizations have an incident response plan in place compared to

61% in last year’s study

The Bad

•

78% of the organizations say they either don’t review and update their incident

response plan or have no set timeframe for doing so

•

Only 30% of the respondents say their organizations are effective or very

effective in developing and executing their incident response plan

•

56% of the organizations do not perform a risk assessment on their information

systems to identify vulnerabilities

•

Only 54% of the organizations have training and security awareness programs

– Only 34% of the organizations train customer service representatives on how to respond to questions in the event a breach occurs

Source: Ponemon Institute’s 2014 study, Is Your Company Ready for a Big Data Breach?

Ponemon Institute

Is Your Company Ready for a Big Data Breach?

The Ugly

•

43% of the organizations experienced a data breach involving a theft of more

than 1,000 records

•

60% of the organizations experienced more than one data breach during the

last two years

•

Only 41% provide for either continuous monitoring (20%) or daily monitoring

(21%) of their information systems for suspicious/anomalous traffic

Verizon 2015 Data Breach Investigations Report

External threats far exceed internal threats and partner threats.

Verizon 2015 Data Breach Investigations Report

•

In a controlled study 150,000 emails were sent

•

50% of the recipients opened the email and clicked on the link within

the first hour

Source: Verizon 2015 Data Breach Investigations Report

Mandiant’s 2015 M-Trends Report

Source: Mandiant 2015 M-Trends Report

PwC’s Global State of Information Security Survey 2015

Total number of security incidents reported by respondents climbed to 42.8 million. The equivalent to 117,339 incoming attacks per day

Source: PwC Global State of Information Security Survey 2015

Security incident: The National Institute of

Standards and Technology (NIST) defines security incident as a violation of computer security policies, acceptable use policies, or standard practices. These include, but are not limited to:

• Attempts (failed or successful) to gain unauthorized access to a system or its data • Unwanted disruption or denial of service

• Unauthorized use of a system for the processing or storage of data

Malware’s Role in Data Breaches

What’s an Advanced Persistent Threat (APT) attack? • Malware planted on network via spear phishing attack

• Establishes communication with command & control server

• Moves slowly about the network searching for sensitive data to steal and the credentials necessary to access that data

• Sensitive data is extracted using encryption and other techniques to disguise it

• Data breaches are frequently the result of credential-stealing malware • Distributed in spear phishing attacks

• Tool of choice in Advance Persistent Threat (APT) attacks

Intelligence

Gathering Point of Entry

NetDiligence

2015 Cyber Liability & Data Breach Insurance Claims

• Per breach costs

– Average payout: $673,767 Median payout: $76,984

• Per record costs

– Average cost per record: $964.31 Median cost per record: $13.00

– Average records lost: 3.16 million Median records lost: 2,300

• Crisis service costs

– Average cost of crisis services: $499,710 Median cost of crisis services: $60,563

– Crisis services include the cost of

forensics, legal counsel guidance, notification and credit monitoring

• Legal costs

– Average cost of legal defense: $434,354 Median cost of legal defense: $73,600

– Average cost of settlement: $880,839 Median cost of settlement: $50,000

Why the Problem?

•

Intrusion detection and network monitoring is weak

•

Malware

•

Lack of encryption

•

Websites are porous and need constant care

– Hardening and patching

•

Cyber thieves take advantage of human error

– Unchanged default settings

– Failing to install patches

– Failing to protect laptops

– Improper disposal of paper records

Best Practices

• Encryption

– Data residing on the network (servers, workstation hard drives and laptops)

– Data residing on mobile devices

– Backup tapes/disks

– Data transmitted over the Internet and in emails

• Endpoint security

– Protects the endpoints (devices) connected to credit union network

– Includes typical protections such as a firewall and antivirus/antimalware

• Block access to personal email accounts

• Spam and web filters

• Intrusion detection system (IDS)/intrusion prevention system (IPS)

• Install operating system patches when made available

Protect data wherever it is located

Best Practices

• Vulnerability assessments

• Penetration testing

• Monitor system logs

• Disable / lockdown workstation USB ports and CD Rom drives

– Helps prevent insider theft of confidential member data

• Data loss prevention (DLP) solution

– Identifies, monitors, and protects data at rest, in motion, and in use

– DLP tools allow credit unions to see which databases, file servers, desktops and laptops hold sensitive data

– Identifies when someone is transmitting data via email or downloading to external storage devices

• Third-party reviews of network security

• Secure paper records

Protect data wherever it is located

Best Practices

•

Accessing network/systems remotely

– Telecommuters working from home

– Third-party vendors

Protect data wherever it is located

 At rest  In motion  In use

Remote Access Best Practices

• Prohibit remote employees from using home computers to access network • Establish a virtual private network (VPN)

– A VPN is a network that uses the Internet to provide remote employees with secure access to the credit union’s network

• Prohibit employees from using unsecure wireless networks (public Wi-Fi) • Require multifactor authentication – not just usernames and passwords

Mobile Devices: Tablets / Smartphones

•

Credit union issued versus employee

use of personal devices (BYOD)

– Both should be secured

•

Secure the business side of the device

(sandboxing)

– Good Technology

– MaaS360

•

Adopt acceptable use policy

Mobile Devices Used for Business Purposes

• Antivirus software

• Password protect the device/time-out feature to lock the device

• Remote wipe capability

• Prohibit employees from storing

confidential member data to the device  If it is necessary to store such data on

the device, the data should be encrypted

• Encrypt confidential member data transmitted in emails

Data Breaches – Employee Negligence

– Malware captures screen shots

– Social Security numbers, account information and transaction records for 115,000 accountholders (members) may have been compromised

• Credit union employee accidentally published a file on the credit union’s public-facing website

– File contained member names, addresses, Social Security numbers, account numbers and account passwords

• Credit union employee accidently emailed a spreadsheet to a member

– Spreadsheet contained member names and account numbers

• Credit union employee’s laptop stolen from vehicle

– Contained unencrypted sensitive data (names, addresses, SSN’s and account numbers) on 45,000 members

Data Breaches – Vendor Negligence

•

Credit union uses third-party vendor to mail monthly account

statements

–

Members received their correct statements plus a portion of statements

belonging to other members

•

Credit union downloaded confidential member data to a thumb drive

for their outside auditor

-

Auditor lost the thumb drive in a public park while watching son’s football

game

-

14,500 members impacted

Security Awareness Training

•

Must be addressed in the credit union’s information security program

•

All employees should receive training on at least an annual basis

Malware – Beyond Theft of Data

• Targeted 100 financial institutions in 30 countries, including U.S.

• Losses per institution ranged from $2.5M to $10M

• Funds stolen from institutions – not from depositor accounts

• Distributed via phishing attacks

• Sought out employees with administrative rights

• Performed reconnaissance (video) to learn details of the 3rd _{party EFT systems used}

• Logged into 3rd _{party EFT systems to transfer}

funds to other institutions

Carbanak Malware

The National Institute of Standards

and Technology (NIST)

Framework for Improving Critical

Infrastructure Cybersecurity

NIST’s Cybersecurity Framework

Background

• President Obama issued Executive Order 13636 (Improving Critical Infrastructure Cybersecurity) in 2013

– Directed the National Institute of Standards and Technology (NIST) to spearhead the development of a framework to reduce cyber risks to “critical infrastructure”

• NIST published the Framework for Improving Critical Infrastructure Cybersecurity (Cybersecurity Framework) in 2014

• Critical Infrastructure is defined in Presidential Policy Directive 21 (Critical Infrastructure

Security and Resilience) to include the following sectors:

Industry Sectors • Chemical • Commercial facilities • Communications • Critical manufacturing • Dams

• Defense industrial base • Emergency services

• Energy

• Financial services

• Food and agriculture • Government facilities

• Healthcare and public health • Information technology

• Nuclear reactors, materials and waste • Transportation systems

NIST’s Cybersecurity Framework

What is it?

• Collection of best practices, procedures and guidelines developed in partnership by the government and private sector to manage cyber risk

• Relies on industry standards and best practices (e.g., ISO and COBIT)

• Intended to be used by organizations of all sizes to evaluate, maintain and improve security over information systems

• Not a “one-size-fits-all” approach

• Enables credit unions to understand how their cybersecurity risk management processes stack up against the ideal standards addressed in the Cybersecurity Framework

• Promotes participation in information sharing groups, such as FS-ISAC

Federal Financial Institutions

Examination Council (FFIEC)

Cybersecurity Assessment Tool

www.ffiec.gov/cyberassessmenttool.htm

• Assists credit unions in identifying their risks and determining their cybersecurity preparedness

• Developed specifically for financial institutions based on the results of the cybersecurity assessments conducted by FFIEC member agencies piloted in 2014

• A better option for credit unions than NIST’s Cybersecurity Framework

• Designed to provide a measurable and repeatable process to assess a credit union’s level of cybersecurity risk and preparedness

Cybersecurity Assessment Tool

Step 1: Determine Inherent Risk Profile

Step 2: Determine Cybersecurity Maturity Level

Step 3: Analyze Results

Step 1: Inherent Risk Profile

• The Inherent Risk Profile (IRP) identifies a credit union’s inherent risk before

implementing controls

• IRP identifies the amount of risk posed to a credit union based on the types of products, services and activities; and the volume and complexity of the credit union’s operations in five categories:

– Technologies and connections

– Delivery channels

– Online/mobile products/services

– Organizational characteristics

– External threats

Step 2: Cybersecurity Maturity

• Determine the credit union’s Cybersecurity Maturity level across five domains

– Cyber Risk Management and Oversight

– Threat Intelligence and Collaboration

– Cybersecurity Controls

– External Dependency Management

– Cyber Incident Management and Resilience

• Five levels of Cybersecurity Maturity

– Baseline (lowest level)

– Evolving

– Intermediate

– Advanced

– Innovative (highest level)

Step 2: Cybersecurity Maturity

Components and Declarative Statements

•

Within each component are declarative statements

– Declarative statements are the minimum regulatory guidelines that must be attained and sustained for that level of maturity

•

Credit unions must satisfy all declarative statements for each maturity level,

and previous levels, to achieve that domain’s maturity level

Source: FFIEC

Step 2: Cybersecurity Maturity (Baseline)

•

Some credit unions may have trouble qualifying for the Baseline

Cybersecurity Maturity Level

•

The controls needed to achieve the Baseline maturity level are

consistent with the minimum guidelines contained in the FFIEC’s IT

Examination Handbook

•

Credit unions must meet the minimum guidelines to be placed in the

Baseline maturity level

The effects are cumulative in that all declarative

statements in each maturity level, and previous

maturity levels, must be attained and sustained to

Step 3: Analyzing Results

•

As inherent risk rises, so too should maturity levels

•

If a credit union’s maturity levels are not aligned with the inherent risk profile:

– Management should consider reducing inherent risk, or

– Develop a strategy to improve the maturity levels by adopting controls needed to meet the declarative statements required to achieve a higher maturity level

Source: FFIEC

Danger zone – policies, procedures and controls are not sufficient given the Inherent Risk Profile Over-investment

in cybersecurity preparedness

Additional Thoughts and Comments

• Domain 3, Cybersecurity Controls, could be the most important domain and the most

difficult for many credit unions to achieve even the Baseline maturity level

– Domain 3 is the largest part of the Assessment

– Examples (declarative statements for Baseline maturity level):

• Mobile devices (e.g., laptops, tablets, and removable media) are encrypted if used to store confidential data. (*N/A if mobile devices are not used.) (FFIEC Information Security Booklet, page 51)

• Remote access to critical systems by employees, contractors, and third parties uses encrypted connections and multifactor authentication. (FFIEC Information Security Booklet, page 45)

• Domain 2, Threat Intelligence and Collaboration, is a short but major part of the Assessment

– Organizations participating in FS-ISAC are in a much better position to defend against cyber attacks

Piggybacking on FFIEC joint statements:

• Cyber Attacks Compromising Credentials and Destructive Malware (March 30, 2015)

CUNA Mutual Group’s Collaboration with FS-ISAC

•

Credit unions that have or purchase a cyber liability insurance policy through

CUNA Mutual Group may be eligible for a discount on the basic membership

(new memberships and renewals)

•

Visit CUNA Mutual Group’s dedicated web page to learn more

Session Summary

•

Information theft is one of today’s

most common forms of fraud

•

Given the financial, legal, and reputational risks

of a data breach -- failing to prepare can be

disaster

•

Take proactive steps to prevent incidents from

occurring in the first place

Questions & Answers

Ken Otsuka, CPA

Senior Consultant - Risk Management CUNA Mutual Group

Disclaimer

This presentation was created by the CUNA Mutual Group based on our experience in the credit union and insurance market. It is intended to be used only as a guide, not as legal advice. Any examples provided have been simplified to give you an overview of the importance of selecting appropriate coverage limits, insuring-to-value and implementing loss prevention techniques. No coverage is provided by this publication, nor does it replace any provisions of any insurance policy or bond.

Credit Union Loss Scenarios – Case Studies

The credit union loss scenario claim study examples do not make any representations that coverage does or does not exist for any particular claim or loss, or type of claim or loss, under any policy. Whether or not coverage exists for any particular claim or loss under any policy depends on the facts and circumstances involved in the claim or loss and all applicable policy language.

CUNA Mutual Group is the marketing name for CUNA Mutual Holding Company, a mutual insurance holding company, its subsidiaries and affiliates. Insurance products offered to financial institutions and their affiliates are underwritten by CUMIS Insurance Society, Inc. or CUMIS Specialty Insurance Company, members of the CUNA Mutual Group. Some coverages may not be available in all states. If a coverage is not available from one of our member companies, CUNA Mutual Insurance Agency, Inc., our insurance producer affiliate, may assist us in placing coverage with other insurance carriers in order to serve our customers’ needs. For example, the Workers’ Compensation Policy is underwritten by non-affiliated admitted carriers. CUMIS Specialty Insurance Company, our excess and surplus lines carrier, underwrites coverages that are not available in the admitted market. Data breach services are offered by Kroll, a member of the Altegrity family of businesses. Cyber liability may be underwritten by Beazley Insurance Group.

This summary is not a contract and no coverage is provided by this publication, nor does it replace any provisions of any insurance policy or bond. Please read the actual policy for specific coverage, terms, conditions, and exclusions.