Web Watch

Ignoring the cloud is a risky mistake, says IT expert.There are two basic paths a bank can go down when developing a robust e-risk strategy, according to Kevin Prince, principal technology strategist for D+H, a financial technology company with offices in the U.S. and Canada. Prince specializes in the financial services industry with a particular interest in community banks, which he discussed in a recent webinar: Biggest IT Strategy Mistakes Made by Financial Institutions..Most bankers will recognize the first path: on premise solutions. This is the path currently taken by most community banks, Prince said. "This is simply adding software or protocols within the bank itself to mitigate risk," he said. As new risks emerge, more elements are added. "I don't want to say this is 'do it yourself', because you can use a third party vendor. But the solution is at your location, on your network.".The newer path banks are taking is cloud services, which Prince called advantageous for many reasons, and the No. 1 mistake banks are making is not putting cloud services at the forefront of their IT strategy. "Sometimes these two paths cross and you can do things in a variety of ways," Prince said. "Cloud services have economies of scale and you can usually do things more cost effectively by using cloud services.".Prince outlined several important elements of a security system to consider – or re-consider. For instance, many bankers are incorrect in their assessment of data encryption. Prince said it is very good for mobile devices, but there are gaps in its protection, and these are largely at work stations.."If data is encrypted on your computer, and a hacker gets malware installed on your computer, and they access that data, will they be able to see it? A lot of people would say no, the data is encrypted," Prince said. "That's not true. With your credentials on your computer, if you were able to get to the data unencrypted, so can the hacker. Encryption is great on a laptop that gets stolen at the airport. Someone would have to log in with your credentials, which they don't have, and therefore the data is protected. But on a live computer the hacker can get access to encrypted data.".Still, Prince said encryption belongs on every device with sensitive data as a ground rule. "I was talking to an FDIC examiner about a year ago and he said that any time he walks into a bank and they don't have encryption on their server he just fails them," Prince said. "He just writes them up. They're making a bigger deal about this all the time.".Encryption solutions come in both onsite and cloud forms, Prince said, with the latter having the advantage of allowing mobile devices, servers and work stations to have access to the same protection regardless of location..Another key element of any strategy is real time threat detection that identifies unusual behavior on the network. This is doubly important to install on top of common encryption setups because encryption alone is no guarantee. Prince said banks should explore real time detection schemes that look beyond the element of encryption. "[The service] might say, 'yeah, this data is encrypted, but why did it start on an inside computer and go out to a computer in China," Prince said. "That seems weird. Let's block it or send an alert." Unusually large and mysterious allocations of the bank's internet bandwidth is another example of detectable traffic that raises flags..Anti-virus software, a staple on most business networks, is morphing into something more like a data loss prevention tool, Prince said. Even if a breach can't be stopped, data loss prevention tools will stop data from leaving the bank's system.."For a financial institution some things might work and some things might not, so you'll want to look at the various forms of data loss solutions," Prince said. "A lot of these tools are designed not just to protect against hackers but to provide internal protection. Negligent employees, malicious employees — those kinds of things where you can have some preventative measures in place.".Email is another area where many banks are finding a better fit in the cloud, where spam and malicious email filters prevent bad files from ever entering a bank's on-site server at all.."Anytime this stuff trickles down to the end user there is a certain percentage of employees who will open things, click on things and cause havoc," Prince said. "The cloud solution [filters out harmful] email before it even gets to you.".FACEBOOK watch: Sunrise Banks, Minneapolis.Sunrise Banks' Facebook page calls on multiple resources to stay current and engaging. Part show page for bank services, part news aggregator, and part small business advice column, Sunrise creates an enticing Facebook presence..Updated daily, and often two or three times, the recurring news aggregation and business advice elements are particularly effective. Sunrise links to, among other things, Small Business Administration articles on financial management topics, and also creates original content, mostly informative YouTube videos, including bank President David Reiling recounting his "10x Leadership Characteristics." Characteristic #5: Woo, as in woo hoo! "Life is short," Reiling says in the video. "Have some fun. Have a nice balance of work and life."