CYBERSECURITY AWARENESS MONTH

Since 2004, the President of the United States and Congress have declared October to be Cybersecurity Awareness Month, helping individuals protect themselves online as threats to technology and confidential data become more commonplace. The Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance (NCA) lead a collaborative effort between government and industry to raise cybersecurity awareness nationally and internationally. 

Cybersecurity Awareness Month Theme

See Yourself in Cyber

This year’s campaign theme — “See Yourself in Cyber” — demonstrates that while cybersecurity may seem like a complex subject, ultimately, it’s really all about people . This October will focus on the “people” part of cybersecurity, providing information and resources to help educate CISA partners and the public, and ensure all individuals and organizations make smart decisions whether on the job, at home or at school – now and in the future. CISA and NCA encourage each of you to engage in this year’s efforts by creating your own cyber awareness campaigns and sharing this messaging with your peers.

• For individuals and families, the collaboration encourages you to See Yourself taking action to stay safe online. That means enabling basic cyber hygiene practices: update your software, think before you click, have good strong passwords or a password keeper, and enable multi-factor authentication (meaning you need "More Than A Password!") on all your sensitive accounts. 
• For those considering joining the cyber community, you are encouraged to See Yourself joining the cyber workforce. CISA and NCA will be talking with leaders from across the country about how to build a cybersecurity workforce that is bigger, more diverse and dedicated to solving the problems that will help keep the American people safe. 
• For partners in industry, CISA and NCA encourage you to See Yourself as part of the solution. That means putting operational collaboration into practice, working together to share information in real-time, and reducing risk and build resilience from the start to protect America's critical infrastructure and the systems that Americans rely on every day. 

4 Things You Can Do

Throughout October, CISA and NCA will highlight key action steps that everyone should take:

• Think Before You Click: Recognize and Report Phishing: Phishing, smishing (text or SMS), and vishing (voice call) attacks are getting increasingly elegant and harder to recognize – until after your data has been stolen. If a link looks a little off, think before you click. It could be an attempt to get sensitive information or install malware. 
• Update Your Software: Don't delay -- If you see a software update notification, act promptly. Better yet, turn on automatic updates. It’s easy to press “remind me later” on software updates. But cyber attackers target old application vulnerabilities because a single weak spot is a pathway to your business’ most sensitive information.
• Use Strong Passwords: Strong passwords are the first line of defense against cyberattacks. Unfortunately, employees often reuse weak passwords – they need over 100+ accounts to get their work done. But it can be difficult to memorize a secure password: one that is at least 16 characters long, made up of a unique mix of lower and upper case letters, symbols, and numbers. Use password managers to generate and remember different, complex passwords for each of your accounts. A passwords manager will encrypt passwords securing them for you!
• Enable Multi-Factor Authentication: While a strong password protects an account, there’s still a chance that a hacker could access it by force. Additional layers of authentication provide extra roadblocks to protect your business; without them, your cybersecurity is inadequate. You need more than a password to protect your online accounts, and enabling MFA makes you significantly less likely to get hacked.

Source: CISA, LastPass

ABA Announces Launch of Third Annual Anti-Phishing Campaign 

As the industry observes Cybersecurity Awareness Month in October, American Bankers Association President and CEO Rob Nichols announced the launch of the third annual #BanksNeverAskThat campaign, the latest iteration of ABA’s award-winning campaign geared at educating consumers about the persistent threat of phishing scams.

The campaign uses attention-grabbing humor and other compelling content to empower consumers to spot bogus bank communications asking for sensitive information like passwords and social security numbers. This year’s content also includes a new, interactive, scam-spotting online game called “Scam City,” which is available on the campaign website, BanksNeverAskThat.com.

Banks that register to participate in the campaign will have access to a full range of free resources, including videos and social media posts

Source: American Bankers Association

DC District Court Rolls Back HMDA Threshold

On September 23, 2022, the United States District Court for the District of Columbia issued a Memorandum Opinion that reversed a section of Regulation C, the Consumer Financial Protection Bureau’s (CFPB) regulation which implements the Home Mortgage Disclosure Act (HMDA). After the adoption of the 2020 rule, the National Community Reinvestment Coalition, Montana Fair Housing, Texas Low Income Housing Information Service, Empire Justice Center, the Association for Neighborhood & Housing Development, and the City of Toledo, Ohio, filed a lawsuit challenging the changes to the closed-end loan and open-end line of credit reporting thresholds. The court noted the plaintiffs asserted “that HMDA data have been invaluable in ‘uncovering and addressing redlining, fair lending violations, and other inequitable lending practices’ over the decades.” The plaintiffs challenged the 2020 Rule as arbitrary and capricious, contrary to law, and in excess of the CFPB’s statutory authority under the Administrative Procedure Act (APA). The court noted that the CFPB based the change in the reporting thresholds on concerns from lower-volume reporting institutions that the burdens of reporting were not justified based on the small amount of data that they report.

The parties each filed motions for summary judgment, with the court granting the plaintiffs’ motion on the closed-end loan threshold change and granting the defendant’s motion on the open-end line of credit threshold change.

As noted by the court, the October 2015 rule not only changed the threshold to be a HMDA reporting institution for closed-end loans, and made the reporting of open-end lines of credit mandatory, the rule more than doubled the number of data points that institutions must collect and report. Additionally, a number of the new data reporting items are complex. However, a subsequent law enacted by Congress, the Economic Growth, Regulatory Relief and Consumer Protection Act, created a partial exemption for lower volume lending depository institutions that basically exempted the institutions from the expanded reporting requirements.

After addressing the assertions of both parties, the court concluded with regard to the change in the reporting threshold for closed-end loans that while the change did not exceed the CFPB’s statutory authority, the “CFPB failed adequately to explain or support its rationales for adoption of the closed-end reporting thresholds under the 2020 Rule, rendering this aspect of the rule arbitrary and capricious.”

The CFPB has not issued a public statement regarding whether it plans to appeal the ruling. If the CFPB does not appeal the ruling, then the CFPB will need to determine how to re-implement the 25 closed-end loan threshold.

*Source: Ballard Spahr, LLP

Remote Working Tidbits

Here are October's tidbits for staying energized when working from home...

1. Step outside. Take a short morning walk.
2. Refuel your batteries and be sure to take a lunch.