At 11 p.m., after a long night of battling the attackers and plotting strategy, Dougherty finally convinced his CEO to have the site blacklisted and to take a break until morning. Continuing in a tired and emotional state would have played into the attackers’ hands. “It’s a mind game,” says Dougherty.

By Saturday morning, Dougherty had RSA, a security vendor he called in when the attacks began, working to set up a “take-down” service that seeks out and dispatches criminal websites (in this case, more than 30) with its own cyber baseball bat. Meanwhile, BellSouth began beefing up security around the credit union site to try to thwart attacks. Dougherty also began planning with RSA to build multifactor authentication into the website. As these solutions emerged, the CEO became comfortable with Dougherty’s blacklisting decision. “We built heightened awareness with the board and the executive management team,” says Dougherty. The site was back up by Saturday evening. In the end, 22 customers gave up their information to the thieves and the total losses were “less than five figures,” says Dougherty. (To learn why it’s hard to prevent customers from falling for phishing scams, see Stop End-Users Before They Click Again on Risky Websites.) Though the credit union had averted disaster, “it was a rude awakening,” he says.

Firewalls Aren’t Enough
Dougherty also woke up to the fact that he needed to communicate more with his executives and the board about IT security and its link with the bank’s risk and security strategies. Now he scans banking conference agendas for security content and encourages his executives and board members to attend. Sometimes he accompanies them. “I was with our chairman at a conference and there was a security presentation and so I said, Why don’t you come down and we’ll go to this together? Then, when he had questions, I was there to answer them. Sometimes the technology scares them and you have to get them comfortable with it.”

Every month, Dougherty also sends three or four security articles to executives and the board that he encourages them to read. He has subscribed to a fraud intelligence information service from RSA that gives updates on the latest threats and suggested responses, and he passes that information along too. “It’s vital to have data to relay to my management team,” he says.

Dougherty is also in charge of all training for employees and has broadened that educational effort to include security. He now demands that at least one security article go in each edition of the bank’s quarterly newsletter.