NCUA Risk Alert Addresses Cybersecurity Best Practices for Remote Work

The National Credit Union Administration (NCUA) issued a Risk Alert on cybersecurity best practices for credit unions leveraging employees working remotely or with their own personal networks and devices.

The Risk Alert discusses how credit unions can prepare employees to prevent security events. NCUA expects credit union management to proactively communicate with employees that remote work is being done securely. For example, policies and procedures should ensure that family members or others do not use devices designated for work, should keep devices physically secure, should establish strong, unique passwords for all log-ins and devices on their home network, etcetera.

In addition, credit unions need to develop policies and procedures for responding to security incidents. This would include immediate actions employees should take when they suspect a cyberattack and how the credit union would respond to a security incident.

The Risk Alert provides links to various cybersecurity resources.

Read the Risk Alert.

CUSO Allegedly Hacked

CU Today is reporting that a credit union service organization (CUSO), CU Collections based in Manassas, Virginia, was allegedly hacked by by a criminal organization called Maze.

The alleged data breach was reported by security firm Emsisoft to CU Today.

The stolen sensitive member information included home addresses, Social Security numbers, work and cell phone numbers, and member numbers, as well as other information in the collection files.

CU Today wrote that the company did not comment on the alleged data breach.

Currently, the National Credit Union Administration (NCUA) does not have the authority to examine third party vendors.

This alleged hack of sensitive member data at a third party vendor shows why the NCUA needs to be added to the Bank Service Company Act.

Read more.

NCUA's ONES Providing Adequate Oversight of CU Cybersecurity Programs

The Office of the Inspector General of the National Credit Union Administration (NCUA) concluded that NCUA's Office of National Examinations and Supervision (ONES) has provided adequate oversight of cybersecurity programs of credit unions.

ONES is responsible for supervising federal credit unions and state chartered credit unions with at least $10 billion in assets and corporate credit unions.

The audit assessed whether credit unions were taking sufficient and appropriate steps to protect the confidentiality, availability, and integrity of credit union assets and sensitive credit union data against cyber-attacks.

Read the report.

Trade Groups Encourage All Banks and CUs to Join Sheltered Harbor

The CEOs of six major financial industry trade groups wrote to the CEOs of all U.S. banks and credit unions today with “one simple message: Join Sheltered Harbor.”

A non-profit subsidiary of the Financial Services Information Sharing and Analysis Center, Sheltered Harbor was created to protect customers, financial institutions, and public confidence in the financial system if a catastrophic event like a cyberattack causes critical systems—including backups—to fail. Implementing the Sheltered Harbor standard prepares institutions to provide customers timely access to balances and funds in such a worst-case scenario. As of March, Sheltered Harbor members accounted for 71% of U.S. deposit accounts and 55% of U.S. retail brokerage client assets.

“The reason for Sheltered Harbor is simple: once improbable threat scenarios are now plausible,” the CEOs said. “In response, traditional business continuity and disaster recovery planning is not enough. The only way to minimize the impact of a devastating disruption is to prepare for it. Implementing the Sheltered Harbor standard prepares institutions to provide customers timely access to balances and funds in such a worst-case scenario.” Read the letter. Join Sheltered Harbor.

The six financial trade groups that signed the letter are the American Bankers Association, Bank Policy Institute, Credit Union National Association, Financial Services Forum, Financial Services Information Sharing and Analysis Center, and Securities Industry and Financial Markets Association.

Read the letter.

Phishing Attack Targets CU AML Officers

Krebs on Security is reporting that on January 30 a highly targeted, malware-laced phishing campaign landed in the inboxes of anti-money laundering (AML) officers at multiple credit unions.

The USA Patriot Act requires all financial institutions to appoint at least two Bank Secrecy Act (BSA) contacts responsible for reporting suspicious financial transactions that may be associated with money laundering.

These BSA contacts at credit unions are registered with the National Credit Union Administration (NCUA). This information is not publicly available.

Given the targeted nature of the spear phishing attack, some within the credit union industry speculated that NCUA may have been compromised.

However, NCUA denied the allegation. NCUA in a February 8 press release stated:

Upon learning of the recent spear phishing campaign targeting Bank Secrecy Act officers at credit unions, the NCUA conducted a comprehensive review of its security logs and alerts. This review is completed, and it did not find any indication that information was compromised.

It appears that the spear phishing campaign has spread beyond credit unions to other financial institutions.

This does raise the question of how did these phishers obtain this non-public information about BSA officers?

Bank and CU Trade Groups Urge Congress to Pursue National Data Breach Standards

Bank and credit union trade associations on December 18 called on Congress to move forward with legislation to implement strong national data security and breach notification requirements that would replace the current inconsistent patchwork of state laws.

“Our existing payments system serves hundreds of millions of consumers, retailers, financial institutions and the economy well,” the groups wrote in a letter to House Energy and Commerce committee leaders, who had requested comments on data breach legislation. “Protecting this system is a shared responsibility of all parties involved and we must work together to invest the necessary resources to combat never-ending threats to the payments system.”

The groups called specifically for legislation that would require all entities to protect consumers’ sensitive personal and financial data, notify consumers in a timely manner in the event of a breach and ensure compliance via appropriate federal and state oversight. They added that any national data breach legislation “must ensure that all entities that handle consumers’ sensitive financial data have in place a robust -- yet flexible and scalable -- process to protect data, which must be coupled with effective oversight and enforcement procedures to ensure accountability and compliance.”

The seven trade associations signing the letter were American Bankers Association, Consumer Bankers Association, Credit Union Nation Association, Financial Services Roundtable, Independent Community Bankers of America, National Association of Federally-Insured Credit Unions, and The Clearing House.

Read the letter.

Bank and Credit Union Trade Groups Call for National Data Breach Standards

Seven financial trade associations wrote to lawmakers calling for a national data security and breach notification standard.

In a letter to Representatives Blaine Luetkemeyer (R-Mo.) and Lacy Clay (D-Mo.), the financial trade associations called for a standard that would require all entities handling sensitive personal and financial data to have robust protections in place and to notify consumers in a timely manner in the event of a breach. They also added that such a standard would help eliminate current inconsistencies between a patchwork of state and federal laws.

“Our existing payments system serves hundreds of millions of consumers, retailers, financial institutions and the economy well,” the groups wrote. “Protecting this system is a shared responsibility of all parties involved and we must work together and invest the necessary resources to combat increasingly sophisticated threats to the payments system.”

The seven financial trade associations that signed the letter are the American Bankers Association, Consumers Bankers Association, Credit Union National Association, Financial Services Roundtable, Independent Community Bankers Association, National Association Federally-Insured Credit Unions, and The Clearing House.

Read the letter.

McWatters: Closing the Stabilization Fund and Reg Relief Are Top Priorities

Credit unions can expect more regulatory relief and streamlined operations from the National Credit Union Administration (NCUA) in the future, Acting Board Chairman J. Mark McWatters said at the annual conference of the National Association of Federally-Insured Credit Unions.

According to the press release, McWatters stated he wants the Board to revisit the risk-based capital and stress testing rules.

Earlier this week, The United States Department of the Treasury (Treasury) recommended raising the asset threshold for credit unions subject to stress testing rule from $10 billion to $50 billion. Also, Treasury recommended that NCUA either eliminate the risk-based capital requirement or raise the asset threshold for credit unions subject to the risk-based capital rule from $100 million to $10 billion.

Acting Chairman McWatters told the attendees that closing the Temporary Corporate Credit Union Stabilization Fund (TCCUSF) is a top priority. This would allow the agency to return surplus funds to federally-insured credit unions in 2018. A plan for closing the TCCUSF is expected within weeks.

Other areas that McWatters would like to see the agency address include cyber security, fighting fraud, and identifying ways to help small and low-income credit unions to thrive.

Survey Shows Drop in Compliance and Risk Management Concerns

Despite a persistently stringent regulatory environment, banks and credit unions are becoming more confident in their compliance and risk management programs, according to the Regulatory and Risk Management study by Wolters Kluwer.

Overall, levels of concern among the 846 respondents collectively declined for the first time in the survey’s four-year history. A majority of the respondents -- 59 percent -- said that their compliance department now plays a collaborative role in major business decisions within their organization, and 39 percent are using an integrated or strategic risk management program.

While confidence is growing, respondents still noted several key obstacles to implementing an effective compliance program, including inadequate staffing (33 percent), manual processes (26 percent) and too many priorities (21 percent). Preparing for the new Home Mortgage Disclosure Act rules was also a central point of concern, with most respondents worried about being able to accurately capture the data required by the rule and training bank employees.

On the risk management side, 70 percent of respondents fingered cybersecurity as the top risk their institutions will face over the next year, up from 66 percent in the 2015 survey.

Read the press release.

Read the survey.

CU Was Slow to Respond to Hack of Online Banking Site

KrebsonSecurity is reporting that the online banking site of Coast Central Credit Union (Eureka, CA) "was compromised and apparently had been for nearly two months."

The "crooks had hacked the credit union’s site and retrofitted it with a “Web shell,” a simple backdoor program that allows an attacker to remotely control the Web site and server using nothing more than a Web browser."

According to the report, the credit union was contacted on February 23 about the hack; but did not immediately fix the problem.

The author wrote that when he contacted the credit union he explained who he was, how they’d likely been hacked, how they could verify the hack, and how they could fix the problem. Two days later when he noticed the site was still hacked, he contacted the credit union again, only to find they still didn’t believe he.

Eventually, the credit union believed him and disabled the Web shell.

Read the KrebsonSecurity.

NCUA's Supervisory Priorities for 2016

The National Credit Union Administration (NCUA) issued a letter to federally insured credit unions regarding its supervisory priorities for 2016.

The letter is intended to assist credit unions in preparing for their next NCUA examination.

NCUA noted that field staff will focus on the following issues this year: cyber-security, Bank Secrecy Act compliance, interest rate risk, TILA-RESPA integrated disclosure rule, credit union service organization reporting, and incident response procedures regarding unauthorized access to members information.

Read the letter.

Matz Warns CUs about Cyber and Interest Rate Risks

In a speech before the Credit Union National Association, Debbie Matz, the National Credit Union Administration (NCUA) Chairman, stressed that credit unions needed to be prepared for volatile and rising interest rates and also cyber-attacks.

With regard to interest rate risk, Chairman Matz warned that chasing near-term profits by concentrating your portfolio in long-term investments, while long-term rates are rising and short-term rates remain low, may be appealing; but it is ultimately a trap. When short-term rates begin to rise, this strategy will leave your credit union vulnerable.

But the majority of her speech focused on cyber-security issues.

Chairman Matz cited an example where hackers "broke into a medium-size credit union and used the credit union’s passwords to access one of the larger credit bureaus. From there, the hackers stole credit reports on hundreds of people who weren’t even credit union members."

She asked the audience to imagine a scenario where the hackers were not motivated by money, but by terrorism. Imagine the damage the cyber-terrorist could do, if they infilitrated the payment system.

Chairman Matz told the audience that NCUA "examiners will be looking to see how credit unions are implementing appropriate risk mitigation controls to better protect, detect, and recover from cyber-attacks. This includes vendor due diligence, strong password policies, proper patch management, employee training, and network monitoring."

She encouraged the audience to review recently developed voluntary national cyber-security framework by the National Institute of Standards and Technology.

Read the speech.