With New Bank-Security Guidance, How Safe From Cybercrime is Your Firm?
You probably missed the guidance titled "Supplement to Authentication in an Internet Banking Environment," issued by the Federal Financial Institutions Examination Council last June. Granted, the FFIEC report isn't exactly a page-turner. But it may boost the safety of the funds in your corporate bank accounts.
Tue, February 14, 2012
CFOworld — You probably missed the guidance titled "Supplement to Authentication in an Internet Banking Environment," issued by the Federal Financial Institutions Examination Council last June. Granted, the FFIEC report isn't exactly a page-turner. But it may boost the safety of the funds in your corporate bank accounts.
And that's key, because if cybercriminals illegally access your company's account and steal money, your firm -- and not the bank -- may be on the hook. Just ask Karen McCarthy, president and CEO with Great Neck, N.Y.-based Little & King Integrated Marketing Group. In February 2010, thieves illegally accessed her firm's bank account, draining it of $164,000. While McCarthy has been able to recover about $100,000, all four employees remain on drastically reduced salaries, and the acquisition of Little & King by another marketing firm, which had been underway when the theft occurred, was halted. Bankruptcy remains likely, says McCarthy, who also founded something called the Cyber Looting Awareness and Security Project. "It's a lot of money to make up."
The regulation often referred to as Reg E, which covers electronic funds transfers, limits consumers' liability in cases of unauthorized transfers to $50 in most cases, although the amount can hit $500. However, Reg E doesn't apply to commercial bank accounts, says Doug Johnson, vice president and senior adviser for risk management with the American Bankers Association. Moreover, the decisions in court cases involving unauthorized transfers from business accounts have been mixed, with some courts finding for the banks, and some for the businesses that lost money, according to information from Guardian Analytics, a provider of bank security technology.
FFIEC's 2011 Supplement, which examiners were to start using this year, covers customer authentication, layered security, and other controls that can make online banking safer. The term "guidance" actually may be a bit misleading, though. "The only gray area is how examiners will interpret it," says Tom Hinkel, director of compliance with Safe Systems Inc., a provider of technology solutions to financial institutions. Rather than just offering up recommendations, he says, the approach is "thou shalt" or "thou shalt not."
Need for Robustness
The report resulted from FFIEC's finding that "risk assessment and management wasn't as robust as it needed to be," within some institutions, Johnson says. In particular, the new guidance calls for a dynamic, rather than a "once-and-done," approach to risk assessment, he adds.
The new Guidance recognizes the changes in the Internet banking environment that have occurred since 2005. "We're seeing the evolution of sophistication from the attacker side," says Kevin Richards, president of the Information Systems Security Association. While security at the perimeter of a network used to suffice, solutions today increasingly need to focus on improving the code within applications themselves.
