IT Security: Is your bank ready to withstand today’s challenges?

Last year brought all of us serious challenges, with ramifications that will carry forward beyond 2009. The bail-outs, fraud, ponzi schemes and identity thefts of 2008 will be followed by sweeping new regulation and increased governmental oversight. . Beyond the obvious regulatory requirements, information security for the banking industry now plays a key role in retaining consumer trust. The global economic crisis combined with increasingly sophisticated, targeted attacks on financial institutions present a scary combination of motive and opportunity, making information security of paramount concern for 2009. . Do you know how your information security program stacks up? Below are a few red flags that may indicate opportunities for improvement:. Financial institutions, like most businesses, are looking for ways to lower expenses and do more with less. Now, however, is not the time to neglect security. The good news is that most information security programs can be improved significantly without tremendous capital expenditures but through more effective risk management techniques and oversight. . Here are steps you can take to improve the information security environment in your bank:. Establish governance – Senior management needs to take the protection of information assets seriously, allocate appropriate resources, oversee the security program and set the tone of protection for the organization. It starts at the top, and naming the right person to be the chief security officer is critical. The CSO should have enough knowledge to understand IT security concepts and the internal clout to enforce the management-approved policies across departmental boundaries. . Manage risk – Management and the board need to approve the organizational appetite for risk and how threats are managed. This includes clear and concise documentation of the organizational threats, how the threats are mitigated and where exposure remains. Most would prefer to protect a few critical systems extremely well, rather than protect everything poorly. To do this effectively, IT assets need to be classified and prioritized to determine the adequacy of controls.. Process vs. activity – Risk should be evaluated on a routine basis, not simply when the risk assessment is updated annually. When looking at new products/services, technology, vendors and even employees, you should include threats and mitigating controls in your evaluation and selection process. . Increase awareness – A culture of protection and healthy paranoia should exist among employees. This is accomplished through ongoing training and education — not only on "what" the security policies are, but on "why" the policies exist to protect the institution, and "how" to respond if there is suspicious activity. . Quality testing – Key security controls need to be tested on a regular basis and when change occurs within the environment. There are a variety of methods to effectively test the technical, administrative and physical controls. Tests can range from security vulnerability assessments and disaster recovery exercises to test technical controls, to tabletop exercises and social engineering testing methods to test administrative and physical controls.. No doubt, this is the year when management oversight will be required to appropriately allocate resources, as well as achieve compliance. The focus will be on how overall IT risks are managed. An effective risk management program combined with governance will go a long way to improve the overall security posture to meet the challenges ahead. .Jeff Olejnik is president of Assurity River Group. For more information, see www.assurityriver.com.