Articles

By: (GCIH, GPEN, GWAPT)
Publication: The Kansas Banker, Oct/Nov 2018

KBA Oct/Nov 2018Several years ago my wife and I enrolled in country western dance lessons offered in our community. I have a reputation for being challenged in the areas of rhythm and coordination, but it sounded like fun. Over several weeks we learned multiple dances ranging from the supposedly simple two-step to more complex dances. I learned that I could manage on a dance floor as long as I stuck to the basic dances like the two-step and that I never would have rhythm or coordination.

Read Full Article

 

By: (ISACA Cybersecurity Fundamentals)
Publication: The Kansas Banker, Septempter 2018

KBA September 2018Social media can be a leisurely and personal activity. It can also quickly become a business blunder. Take McDonald's as an example. In 2017, a Twitter account run by the fast-food company was compromised by a hacker with malicious intentions. The hacker released a hateful tweet directed towards the U.S. President using the McDonald's corporate Twitter account. The tweet was only public for 20 minutes, but the repercussions lasted much longer. Even though it wasn't McDonald's staff who sent out this tweet, the tweet was under the company name, so they had to respond to the criticism and fallout.

Read Full Article

 

By: (Network+, CISA)
Publication: VACB (Virginia Association of Community Banks)The Community Banker, Fall 2018

VACB Fall 2018In 1984, a fantasy movie involving a young boy, a rock-eater, a weird dog-dragon hybrid, an entity known as The Nothing, and an assortment of other strange characters was released. This movie, titled The NeverEnding Story, is remembered by many people not only because of the story itself but because of the main title track which lingers long after the credits have rolled. After watching the movie, one could be caught belting out "NeverEnding Stooooooryyyyyyyy! Ah, ah, ah!" for anyone nearby to listen. While this song is easily adapted for a number of tasks in everyday life (never ending laundry, dishes, or bills), for those in IT roles it has become "NeverEnding Paaaaaattccheeeeees!"

Read Full Article

 

By: (CISA, CISSP)
Publication: The Kansas Banker, August 2018

2018 August KBA One of the challenges community banks face in selecting an IT audit partner is the confidence they are comparing apples to apples when reviewing security-testing proposals. Not only do the definition of terms vary, some audit firms sell an "IT Audit" that is nothing more than a GLBA regulatory compliance audit. Though confirming your Information Security Program meets your examiners' expectations is important, an audit without a thorough internal network assessment really is not an IT audit. Your technical controls like patch management, malware protection, user access controls, Internet content filtering, file access controls, etc. are where the rubber meets the road. If these controls are not functioning as intended, it becomes a moot point you have them faithfully listed in your InfoSec Risk Assessment and Policies.

Read Full Article

 

By: (Network+, CISA)
Publication: The Kansas Banker, July 2018

KBA July 2018Several months ago, I stumbled across a comic that was a perfect representation of the battle institutions and IT departments face every day. It was a boxing ring, with a ring announcer introducing the participants in the corners of the ring. One corner contained firewalls, encryption, antivirus software, and other layers of data security while the opposing corner contained "Dave," a hapless user wearing a shirt emblazoned with the words "Human Error." This comic is both funny, because many of us know a "Dave," and disheartening, because no matter how much money and time are spent on network layout, configuration, and security, the harsh reality is it only takes one user on the other side of the mouse, clicking on the wrong item, to wreak havoc on your network. While incidents are still going to occur, they can be reduced with routine and thorough employee security awareness training.

Read Full Article

 

By: (CISA, CISSP)
Publication: The Kansas Banker, April/May Issue

KBA Cover April, May 2018“The sky is falling.” This is how one security writer described the initial panic experienced by the IT world early this year. Two unprecedented vulnerabilities named Meltdown and Spectre were reported on January 3, 2018.

These two vulnerabilities were and are a big deal because they are hardware vulnerabilities affecting any device with a silicon chip. This includes microprocessors on workstations and servers, mobile phones, tablets, cloud services, and other platforms. There were several matters which made these vulnerabilities seem scarier than other vulnerabilities.

Technical Aspects of the Vulnerabilities

Read Full Article

 

By: (Security+)
Publication: Nebraska Banker, March/April 2018

NBA March/April 2018What is the Internet of Things (IoT)?

For the purposes of this article, you can think of the IoT as the global network of “things” that are connected to the internet. This includes the obvious things (e.g., smartphones, computers, wearables, etc.) and the less obvious (e.g., A.I. devices, office automation, coffeepots, smart TVs, etc.).

If you work in technology, you should be aware of the IoT, as it is certainly a trendy topic. As a trendy and often misunderstood arena, the IoT has not historically been discussed in-depth during security awareness training. This means that even if you are aware of the dangers presented by the IoT, your employees may not be as mindful.

Read Full Article

 

By: (Security+, ISACA Cybersecurity Fundamentals)
Publication: The Kansas Banker, February 2018

KBA February 2018You have probably heard this before now, but the greatest threat to an organization's information security is the people. Attackers are aware of the human element, and they create schemes to exploit us. The best way to combat this weakness is to train and test employees.

The goal of information security awareness training is to create a change in employee behavior and to create a security-minded culture inside your institution. A change in culture will not happen overnight, and it may take longer for some employees to make adjustments to their behavior, but it is possible.

Read Full Article

 

By: (CISA, CISSP, CRISC)
Publication: The Nebraska Banker, Jan/Feb 2018

NBA Jan/Feb 2018 Issue Over the past few years, as cybersecurity threats have risen, the need for financial institutions to designate an Information Security Officer (ISO) has increased.

What does this ISO role look like?  In this article, we will examine what the Federal Financial Institutions Examination Council (FFIEC) handbooks say about an information security officer. For the purposes of this article, we will refer to the Chief Information Security Officer, Information Security Officer, and Corporate Information Security Officer similarly, and use the acronym "ISO" to encompass the collection of job titles.

 

What is an Information Security Officer?

Read Full Article

 

By: (Security+)
Publication: The Community Banker, Winter 2017

VACB Winter 2017The thought of reviewing a financial statement can be scary. While financial statements have similar elements, they are far from standardized and can be complicated to understand. Here are six tips to help simplify the scope of financial statement reviews.

Obtain Financial Statements

The first and easiest step in conducting a successful financial statement review is obtaining the financial statements.

Publicly Traded Companies are required to submit audited financial statements to the Securities and Exchange Commission (SEC) at least annually. The largest and most complex companies submit even more frequently. Often, these financial statements are published online and can be found with a quick web search. I find that searching “[Company Name] Financial Statements” or “[Company Name] Form 10-K” frequently turns up what I need.

Read Full Article