Bank Security Tips

Jim Stickley from TraceSecurity recommends if banks adhere to the following simple best practices, officials can reduce identity theft risk by up to 80 percent:
  • Shred bins should be conveniently located near all bank employees.
  • Logged in computers should not be left logged in and unattended under any circumstances.
  • Sensitive data, including computer backup tapes, should be encrypted
  • To prevent phishing, e-mails sent from upper management should be verified for authenticity.
  • All bank employees must be trained on proper policies and procedures and never leave visitors unattended in non general public areas.

Shred bins. Many banks use paper shredders, but unless shredders are conveniently located near all branch personnel, they don't get used properly. Stickley has found that unless the shred bins are within a few feet of employees, many documents will simply find their way into the trash bin, unshredded, and ready to be discovered by Stickley's dumpster diving team.

Unattended computers. Most banks concentrate their security at the entry to the facility or branch. Beyond the initial greeting area, Stickley finds that security becomes more lax. Bank employees, assuming anything on their desk is safe because they are located away from the front area, often leave sensitive paperwork on their desks, or leave Post-It notes on computer monitors listing log-on IDs and passwords. This is a major mistake because visitors, maintenance and other individuals often receive access to this area. In addition, computers should not remain logged in while employees are away at lunch or after they've gone home for the day. Unattended computers put a bank's information systems at a much higher risk.

Encrypt all sensitive data. Confidential data should be encrypted at all times when not being used. This includes information stored on workstations and laptops. There are a number of applications available that will encrypt sensitive documents on the hard drive, so if a laptop or workstation is accessed or stolen, the data that has been encrypted will be protected from identity thieves. Additionally, all backup tapes must be encrypted and stored securely off-site. There are a number of storage security appliances that encrypt the data as it is stored to the tapes. This will reduce the risks associated with tapes being lost or stolen. According to Stickley, on numerous occasions he has stolen unencrypted backup tapes that were sitting on shelves in plain view. These tapes, often as small as a pack of cigarettes, have contained account information for thousands of customers.

E-mail verification. Bank's customers aren't the only people vulnerable to phishing attacks. Stickley and his team often use phishing tactics to extract critical information from bank employees prior to visiting a branch for an undercover social engineering audit. Employees need to understand e-mail that appears to come from another employee or legitimate source could be forged.

If a manager requests confidential information from an employee via email, the employee should always contact the manager via the phone for verification. Stickley's team will also employ e-mail spoofing and domain hijacking to trick the employee into releasing sensitive information. For example, if a bank's name is Pond Bank, and their domain name is pondbank.com , Stickley will register a fake domain name that replaces the letter "o" in Pond with the numeral "zero," and then send spoofed e-mails to bank employees asking for sensitive information. Banks should also consider adding cryptographic signatures to enable authenticated e-mail messages that can prevent forgeries.

Policy enforcement and employee training. Employee awareness training and strict policy enforcement are the most important methods to protect an organization from identity thieves. Monthly meetings should be scheduled to review security policies. For example, employees must understand that bank visitors must be accompanied at all times, and that unoccupied desks should be free of confidential information, and filing cabinets should locked when unattended.

Additionally, policy management software should be an essential component of any security program to ensure that employees are contacted when policy and procedure changes occur.

Featured

  • Just as Expected

    GSX produced a wonderful tradeshow earlier this week. Monday was surprisingly strong in the morning, and the afternoon wasn’t bad at all. That’s Monday’s results and asking attendees to travel on Sunday. Just a quick hint, no one wants to give up their weekend to travel and set up an exhibit booth. I’m just saying. Read Now

    • Industry Events
    • GSX
  • NOLA: The Crescent City

    Twenty years later we finds ourselves in New Orleans. Twenty years ago the aftermath of Hurricane Katrina forced exhibitors and attendees to look elsewhere for tradeshow floor space. Read Now

    • Industry Events
    • GSX
  • Nothing Artificial About this Intelligence

    I have been looking forward to this year’s GSX show in New Orleans, the Cresent City, or if you prefer The Big Easy. It seems like quite a while since we’ve been here. Twenty years ago, ASIS, as it was known then was literally washed out of the city by someone known as Katrina. It is a good thing to come back to NOLA. Read Now

  • From Monitors to Mission Control

    Security Operations Centers (SOC) were once defined by rows of static monitors, each displaying a single feed with operators quietly watching for issues. That model has become obsolete. Incidents evolve too quickly, data comes from multiple locations, and decisions must be made in seconds—not minutes. Read Now

  • New Gas Monkey Garage Venue Uses AI-Enhanced Video Technology

    Gas Monkey Garage, the automotive custom shop and entertainment brand founded by Richard Rawlings of Fast N’ Loud TV fame, has opened a vibrant new restaurant and bar in South Dakota, equipped with advanced, AI-enhanced video tech from IDIS Americas. Read Now

New Products

  • Compact IP Video Intercom

    Viking’s X-205 Series of intercoms provide HD IP video and two-way voice communication - all wrapped up in an attractive compact chassis.

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions.

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction.