February 2023

SOLUTIONS

Continuous Vulnerability Management

The threat landscape is constantly evolving, with an increase in incidents and breaches being reported rapidly across industries. In 2020, the number of data breaches soared from a decade ago, according to Statista: over 1,000 breaches compared to 662 in 2010. While vulnerability exposures have not increased as notably as breaches, they are still rising. With an average breach costing U.S. companies nearly $4 million USD, anyone in SecOps should sit up a little straighter and examine their vulnerability management processes and the tools used to manage them.

A good defense security posture is still the best offense in protecting against breaches and vulnerability exposures. While the risk may be lower for smaller organizations (fewer than 1,000 employees), all organizations with weak, semi-scheduled vulnerability assessments and management programs are at a much higher risk than those relying on continuous vulnerability management processes and solutions. (And it is important to note that some of the most nefarious hacking groups have decided NOT to go after large companies, as those attacks focus the spotlight on them. By hitting smaller targets, there is less publicity and less exposure of their exploits).

To stay protected, IT staff must stay on top of a regularly evolving situation that is not just influenced by the emergence of new vulnerabilities but also by threat intelligence, security updates and changes to their environment. Consider how many containers are short-lived or how many devices may only be connected to the network for short amounts of time. The rise of remote work, distributed teams and cloud-connected devices all have the propensity for increased exposures and need regular and consistent monitoring. The need for automated solutions and continuous vulnerability management is here. A more automated and supported approach is required to maintain the visibility required for dynamic environments and changing threat landscape.

Vulnerability management programs are one of the most critical components of a cyber security program. They are considered a requirement for reducing attack surface and preventing successful cyber-attacks.

Continuous vulnerability management is the gold standard because it can eliminate the security gap that periodic or annual scans may leave. It minimizes the exposure time of vulnerabilities, closes the window of opportunity for attackers, and is a CIS Critical Security Control indicating that it is a requirement for meeting IT security best practices and compliance.

The benefits of vulnerability management are obvious – networks simply cannot be protected without vulnerability remediation processes.

Periodic Scans and Vulnerability Assessments Are not Sufficient

If you are unsure about your organization’s ability to manage a cyber-attack or do not have an in-house IT security team, continuous vulnerability management is an opportunity to streamline security operations, strengthen operational resiliency, and gain strong cyber risk assurances.

AaSys’ Continuous Vulnerability Management is designed to strengthen the cybersecurity posture of our clients. Often penetration testing and vulnerability scanning are treated as once per year tasks intended to meet regulatory requirements. New vulnerabilities and threats are identified every day. A once-per-year approach is no longer sufficient. More frequent scanning and testing means that vulnerabilities can be identified and mitigated in a timelier manner. This approach reduces the risk of falling victim to viruses, ransomware and weak security settings or configurations.

AaSys utilizes the Qualys vulnerability scanner to identify both internal and external vulnerabilities. Qualys quantifies risk across your attack surface including vulnerabilities and misconfigurations. Risk is assessed based on business criticality and exploit intelligence from hundreds of sources to proactively measure, track and communicate risk. To identify the financial institution’s security weaknesses, AaSys examines all systems, components, and security mechanisms of the internal and external network infrastructure.

AaSys’ external vulnerability assessments are designed to look at the environment from the hacker’s view; that is, from the outside looking in. During this assessment, AaSys will identify vulnerabilities with systems that may allow access to the private parts of the institution’s network, allow the performance of a denial of service on the network or obtain information from the institution’s private network that should not be available on the outside of the unprotected network.

Corrective measures can include closing discovered and exploited vulnerabilities, modifying the financial institution’s security policies, creating procedures to improve security practices, and conducting security awareness training for personnel to ensure that they understand the implications of poor system configurations and poor security practices.

AaSys’ Internal Vulnerability and Penetration Test mimics the actions of an attacker having gained access to the network. Another scenario to be considered is the insider attack. Insiders may be authorized to bypass all the security measures to perform their daily duties. Because insiders are legitimate users of their financial institution’s networks and systems, sophisticated technical capability is not necessarily required to carry out an insider attack. On the other hand, technically capable insiders are able and have carried out more sophisticated attacks that can have more immediate widespread impact on financial institutions.

Corrective measures can include closing discovered and exploited vulnerabilities, modifying the financial institution’s security policies, creating procedures to improve security practices, applying missing security patches and service packs, and conducting security awareness training for personnel to ensure that they understand the implications of poor system configurations and poor security practices.

When it comes to closing the cyber-security gaps that attackers seek to exploit, sooner is better than later but continuous is the gold standard. Taking the time to set up an appropriate, continuous vulnerability management cycle and then choosing the best solution to support will create a more defensible and secure environment that can protect your organization from becoming another breach statistic.

When it comes to solutions, AaSys offers several programs to optimize client security. Our 24/7/365 managed SIEM, powered by Adlumin, includes our cyber specialists as they monitor client network looking for behavioral anomalies and alerts. Powered by OTX, a renowned threat intelligence community, the latest attacks and vulnerabilities are identified, and proactive measures can be taken. Reporting is another valuable asset with the AaSys Security Operations Center. Reports specifically for the Board of Directors or Management are easy to download and understand.

AaSys also provides programs that include a combination of external penetration testing and internal penetration testing, both of which are augmented with security scans. Reducing the time between test or scan can be critical when protecting the enterprise. AaSys’ seasoned Red Team helps to make sense of identified vulnerabilities as well as steps that can be taken to mitigate issues. Your Account Executive can customize a program based upon your requirements.

Sources:

https://purplesec.us/learn/continuous-vulnerability-management/

https://www.crowdstrike.com/blog/why-continuous-vulnerability-management-is-essential/

Pay Attention to the Human Cost of Identity Fraud

CUs must acknowledge the emotional and physical toll fraud takes on members, and focus on fraud prevention tools.

Millions of words have been written about the financial cost of identity fraud, for both the financial institution and the victim – and for good reason. In 2021 identity fraud cost U.S. businesses an estimated $52 billion, according to Javelin Strategy & Research.

But victims pay an additional price, as well, that credit unions should keep in mind as they look beyond the dollars and cents. A recent survey by the Identity Theft Resource Center (ITRC) took a deep dive into the emotional, physical and physiological effects on fraud victims, and the data show that victims are increasingly dealing with nonfinancial ramifications – from sleep problems to severe mental health effects.

The report reflects the responses of 120 victims who contacted the ITRC, a nationally recognized non-profit organization established to support victims of identity crime, between April 2021 and March 2022. The number of victims reporting negative feelings or emotions from an identity crime is on the rise, from 79% in 2021 to 87% in 2022. Victims reported a wide gamut of emotions, from anxiety (80%), anger (72%) and loss of trust (55%) to shame or embarrassment (40%), guilt (33%) and even suicidal feelings (10%).

Victims reporting physical problems increased, as well, from 44% in 2021 to 68% in 2022. Sleep problems (92%) and stress (88%) were the top-reported physical issues, which also included persistent aches and pains (42%) and new unhealthy or addictive behaviors (17%).

Perhaps it’s no wonder that victims of identity fraud often blame their bank or credit union, which can result in customer attrition. A 2020 Aite Group survey found that some consumers are unlikely to do future business with a bank or credit union where a checking account, credit card or loan was opened in their name. And customers flee their banking relationship more definitively depending on how unsatisfied they were with the financial institution’s level of assistance. Twelve percent of people said they’d switch to a new financial institution, even if they were satisfied with the response to credit card fraud. That number leaps to 42% among people who were unsatisfied with the financial institution’s response.

So, what should credit unions be doing to mitigate the issues fraud victims deal with? For starters, acknowledge that members can suffer an emotional and physical toll that can impact all areas of their lives – and their relationship with their financial institution.

Second, focus more on preventing fraud in the first place rather than dealing with the often costly and complicated aftermath. That could mean reassessing your fraud-protection solutions and adding additional elements or data. In a recent survey of frontline fraud fighters by my company Kevari and About-Fraud, more than a third of respondents (34%) cited new tools or services as the single most important investment an organization could make to manage fraud more effectively.

Acknowledging the human cost of fraud and bolstering your fraud systems and controls can reduce fraud losses and prevent reputational damage, while protecting your members – and your relationships.

Source: January 30, 2023,Adam Elliott, Founder and President of Kevari, formerly ID Insight