Vetting a Vendor
Every part of a financial institution must be secure
- By Jeff Walker
- Aug 01, 2016
Security continues to be a major area of vulnerability for the banking
industry, with attacks impacting individuals, small businesses
and major corporations. From phishing to ransomware, fraudsters
are constantly evolving their methods to counter steps taken by
banks and credit unions to protect their environments. To maintain
their reputation as organizations trusted most by consumers and businesses when
it comes to managing assets, financial institutions must ensure that every part of
their operation is secure, including those areas where vendors play a role.
Financial institutions are complex entities with many moving parts. These
intricacies typically lead banks to partnering with several vendors to assist with
both consumer facing and internal processes, such as mobile and Internet banking,
small business banking, loan processing, bill pay processes and P2P payments.
Because of the many challenges associated with building new technology infrastructure
in house, these vendors have become not only a logical choice but also
a strategic alternative. These companies are helping financial institutions innovate
and keep up with the rapidly evolving needs of consumers and business owners.
While these relationships are typically mutually beneficial partnerships, because
vendors are a vital component of the financial institution’s infrastructure,
careful vetting must be done to limit vulnerabilities introduced by these third parties.
Banks and credit unions must ensure that the vendors they select not only
have the highest standards in customer satisfaction and compliance, but also when
it comes to security.
VETTING VENDOR SECURITY
In security, “you’re only as strong as your weakest link” is a well-known adage.
For this reason, financial institutions must conduct extensive due diligence on the
security practices of their vendor partners, or else they jeopardize their customers’
financial health as well as their brands. After all, if a bank or credit union suffers
a breach due to a vendor’s oversight, customers won’t blame the vendor; instead,
they’ll blame their financial institution that’s supposed to safeguard their finances.
This type of mistake is a costly one that is nearly impossible for a bank or credit
union to fully recover from, as its reputation will be tarnished and its customers
will become highly sensitive to the risk of doing business with them.
Once a financial institution has identified several vendors it could potentially
partner with for a desired product or solution, it must start with a review of the
vendor’s overall strategy and approach to security. Some vendors tend to view
security as a “necessary evil,” simply a box that must be checked by going through
the necessary motions. This is obviously not the type of vendor that a bank or
credit union should aim to partner. Instead, the preference should be given to vendors
that consider security an integral part of their operations, part of their core
culture, something that is lived and breathed every day.
While vendor culture can be a difficult thing to ascertain, good indicators include
the strength and depth of the vendors’ security policy, the quality and experience
of security staff and the presence of a strong plan for handling security
incidents. The amount of time a vendor has had its security certifications in place
is also a good gauge for measuring how well the consumers’ data will be protected.
The level of effort the vendor takes to keep these certifications can also be a positive
indicator of its commitment to security. However, if a vendor’s commitment
does not continue beyond obtaining and maintaining certification, then there is
cause for concern. Vendors that truly care about the security of the organizations
they do business with will go above and beyond, demonstrating additional ways to
safeguard sensitive information and data.
VENDORS IN THE CLOUD
When ‘the cloud’ first became a high
profile topic a few years back, many
organizations avoided its use primarily
because it was unclear how secure it
could be. As time went on, most of these
concerns were dispelled as companies,
including financial institutions, began
to realize and trust how safely the cloud
could store and back up sensitive data.
In fact, security for use in the cloud began
to meet and exceed that of other options
attracting companies who especially
needed the ability to reduce IT costs
while maintaining scalability, reliability
and flexibility within their operations.
Among the organizations that began
to move more of their infrastructure to
the cloud was banks and credit unions.
However, vendors whose solutions are
cloud-based do require their own unique
set of security measures.
When looking to validate the security
of a cloud-based vendor, it is important
to note that not all clouds are created
equal. Financial institutions must
understand where the data resides and
if it’s possible for the data to move out
of this country without the institution’s
or customer’s knowledge. Today, most
physical cloud-based storage facilities
feature military level security, but
banks and credit unions must confirm
a potential’s vendor cloud storage location
meets this level of protection. It
is also paramount to investigate if the
vendor employs any subcontractor services,
and if so, what kind of security
measures these companies are taking,
as their security practices can reflect
back on the financial institution as well.
Finally, it’s essential to understand
what type of security forensics or reporting
the cloud service supports and what
notification processes are in place for a
potential compromise or disclosure.
THE BANK’S ROLE
After vendor selection, the financial
institution’s job is far from done. At
a minimum, financial institutions
should confirm that their vendor partners
continue to maintain the same or
commensurate security certifications.
In addition, the security of a vendor’s
products, services and platforms
should continue to be evaluated at
least annually. Because vendors truly
become part of an institution, their
status should be monitored as closely
as the institution’s own internal systems.
Best practices include having a
vendor management program in place
to help bankers and vendors communicate
and coordinate their priorities
to remain on the same page.
Besides vendor screening, financial
institutions have a responsibility
to their customers to discern that all
aspects of their operations are secure.
Information technology is expanding
the sharing and use of data across
and outside of typical security barriers
like corporate firewalls. It is important
for financial institutions to
realize that protections that were once
adequate may lose value over time as
new attacks surface and the information
ecosystems change due to evolving consumer demands. One example
of this is the amount of information
being shared by organizations and
consumers across social media and
networks today. With many consumers
in the United States using fewer than
five unique passwords to secure their
online information, organizations are
considering and implementing different
ways to secure their networks from
attacks that might originate in these
types of social exchanges.
SINGLE PLATFORM VENDORS
Security has never been more important
or required more commitment. Many
progressive financial institutions are
reducing the number of vendors they
deal with by seeking partnerships with
vendors that deliver more functionality
on a single platform. Fewer platforms
equate to fewer vulnerabilities and a
simpler strategy for monitoring and updates.
Separate, disparate systems complicate
the security assessment; blurring
the clarity of the institution’s overall
security state. What was previously a
complex, costly and siloed IT environment
is being modernized to improve
security, deliver more convenience to
the end user and position organizations
for the digital future.
The financial industry is a leader in
security because there’s really no other
option when the stakes are this high;
the monetary assets of billions of consumers
and millions of businesses are
on the line. Simply meeting security
regulations isn’t enough because regulations
tend to be more than a few steps
behind cyber criminals and the leading
security practices required to combat
them. For example, many of today’s
attacks across industries focus on social
engineering and ransomware. Both
of these methods bypass many of the
boundary protections and provide entry
points for multi-phased and long
term attack methodologies. Unfortunately,
current regulations have yet to
catch up with these new attack methods,
leaving financial institutions, and
their customers, vulnerable.
With all this in mind, no financial
institution that values its brand and
the customer loyalty it creates can take
the task of vetting vendors and their
security practices lightly. Consumers
ultimately don’t recognize the difference
between a mistake made by a
vendor and a mistake made by a bank
or credit union, nor should they have
to. Once a vendor becomes part of the
bank, there is no separation; what happens
to the customer reflects negatively
on the institution and industry as a
whole. Financial institutions succeed
because they are the trusted, proven
gatekeepers and advisors for people’s
livelihoods and that relationship cannot
be maintained without the best security
practices being
employed by the vendors
that serve those
organizations.
This article originally appeared in the August 2016 issue of Security Today.