Quotations from the FFIEC Auditing handbook...

"Information is one of a financial institution's most important assets. Protection of information assets is necessary to establish and maintain trust between the financial institution and its customers.

"Information security is the process by which an organization protects and secures systems, media, and facilities that process and maintain information vital to its operations.

"Financial institutions protect their information by instituting a security process that identifies risks, forms a strategy to manage the risks, implements the strategy, tests the implementation, and monitors the environment to control the risks.

"Organizations often inaccurately perceive information security as the state or condition of controls at a point in time. Security is an ongoing process, whereby the condition of a financial institution's controls is just one indicator of its overall security posture. Other indicators include the ability of the institution to continually assess its posture and react appropriately in the face of rapidly changing threats, technologies, and business conditions.

"A security event occurs when the confidentiality, integrity, availability, or accountability of an information system is compromised.

"Appropriate security controls are necessary for financial institutions to challenge potential customer or user claims that they did not initiate a transaction. Financial institutions can accomplish this by achieving both integrity and accountability to produce what is known as non-repudiation. Non-repudiation occurs when the financial institution demonstrates that the originators who initiated the transaction are who they say they are, the recipient is the intended counter party, and no changes occurred in transit or storage.

"Security risk variables include threats, vulnerabilities, attack techniques, the expected frequency of attacks, financial institution operations and technology, and the financial defensive posture. All of these variables change constantly. Therefore, an institution's management of the risks requires an ongoing process.

"The board of directors is responsible for overseeing the development, implementation, and maintenance of the institution's information security program. Oversight requires the board to provide management with guidance and receive reports on the effectiveness of management's response. The board should approve written information security policies and the information security program at least annually.

"Employees should know, understand, and be held accountable for fulfilling their security responsibilities.

"Management also should consider the roles and responsibilities of external parties. Technology service providers (TSPs), contractors, customers, and others who have access to the institution's systems and data should have their security responsibilities clearly delineated and documented in contracts.

"The quality of security controls can significantly influence all categories of risk.

"A strong security program reduces levels of reputation and strategic risk by limiting the institution's vulnerability to intrusion attempts and maintaining customer confidence and trust in the institution."

NPI's Summary of key FFIEC Requirements

1. The board of directors will be held accountable for the I/T security program
2. Responsibility for security tasks can be delegated, however accountability cannot
3. Delegating responsibility for I/T security to an external security monitoring firm is possible, however it is highly unlikely the firm can adequately address the responsibilities in small institutions where employee duties are shared on a day-to-day basis
4. An automated security monitoring program can be implemented in the smallest of institutions that exceed FFIEC requirements at a minimal cost
5. Local bank management/employees can be trained to respond to suspicious activities (local system alerts)
6. NPI can assist the institution with establishing a local cost-effective I/T security monitoring program to generate the alerts necessary to meet the FFIEC requirements including the I/T portion of the Gramm-Leach-Bliley Act (GLBA).

Client List
Partners
Press Releases
Client Comments
Past Projects
Information Request


Net Health Check
Net Performance Review
Vulnerability Assessment
Banking I/T Assessment
NetSentry Monitoring
Frame Relay Analysis
Custom Services
NetDocs Documentation
On-Site Training


NetLogger
NetSpector
Technical Reference