Your employees are your best defense against hackers.
It’s a motto you’ll hear over and over in cybersecurity circles, especially among organizations like banks with a high need for privacy and compliance. But it’s only half the story. After all, you can’t have highly motivated, security-conscious employees without all the training, policies, tools, and overall executive support needed to create a proper data-secure environment.
You can use many powerful tools and strategies to secure your network. Yet, it’s not enough to throw money at firewalls and licenses for cybersecurity tools. Your staff needs to understand its role in cybersecurity and how to use the tools they’re given to secure your bank, transactions, and customers.
Your bank needs to make all the right security moves to achieve that. Here’s my take on how to invest your time and money so you can make cybersecurity culture a reality at your bank.
Bank Cybersecurity Culture: Six Strategies for Making Data Safety a Priority
Bank cybersecurity and compliance are big topics, and the options for tips and tools are enormous. For the sake of this culture discussion, however, I’d like to focus on specific tools and strategies that will make a difference on the user level. When you have these six strategies right, you’ll be well on your way to having a cybersecurity culture that is widespread, well-resourced, and understood by everyone. But first, let’s start at the top.
Strategy #1—Make Cybersecurity Culture a Key Board Directive
Does your bank have an expert in IT that sits on its board? If you don’t, you’re missing a significant opportunity to educate the C-suite about the importance of your infrastructure. This is especially critical in cybersecurity matters, requiring continuous investment to position your institution for growth. If your board isn’t prioritizing your security metrics, no one else will.
Your board should intimately understand your IT budget and where you are spending your cybersecurity dollars. Because you can’t manage what you can’t track, you should agree on key performance indicators around cybersecurity. These KPIs should be presented to your board, if not monthly, then at least quarterly.
If your IT staff is not well equipped to do this, it may be time to invest in some fractional cybersecurity leadership, like the help you can get from a virtual chief information officer (vCISO.) If you need this kind of help, Integris can set you up with one of our vCISOs specifically trained to work with banks.
Strategy #2—Secure Your M365 Cloud Infrastructure
Most banks put a lot of emphasis on cybersecurity around the core providers that manage their financial transactions, and rightly so. However, when it comes to securing cloud productivity infrastructure for their staff, too many financial institutions rely too heavily on Microsoft’s native platform protections.
While they are a great start, proper user identification, offsite backup, and conditional document access are needed to lock down your M365 platforms fully. Remember, all it takes is one successful click on a phishing link, and hackers can now have the run of your entire internal productivity platform. A skillful hacker can use all the excellent interconnectivity M365 offers against your bank just as quickly.
You must talk to your IT staff or MSP about any additional cybersecurity tools you should overlay on your existing cloud platforms. They should meet regulatory standards and work properly together with the existing components of your cybersecurity platform. That means your monitoring reports and alerts should transfer well between the apps, and your offsite backup should be timed to your recovery time and recovery point needs. Talk to your IT leadership to ensure your tools are compatible and ready to handle the volume of data flowing through your productivity platforms.
Strategy #3—Conditional Access to Your Network Should Be the Norm
In an era where remote and hybrid work is mainstream, it can be tempting to facilitate remote access by lowering the barriers to your systems. However, there are ways to boost your security while also allowing for offsite access to your systems. That strategy is conditional access.
Hackers have learned ways around the standard password systems we’ve put in place. To combat this, conditional access works in the background to review multiple authentication factors—before a user is granted access. Specifically, conditional access tools will check:
- Location—blocking access when sign-ins are attempted from suspicious locales
- Endpoints—looking for sign-ins coming from unfamiliar devices
- Users—granting different levels of access to your network based on authorization ranks
- Suspicious Login—shutting down access with signs of malicious or harmful agents accessing your network
When you have these safeguards in place, employees will expect a certain level of login security. This is an essential first step in creating a
true cybersecurity culture.
Strategy #4– Keep Multi-factor Authentication at the Heart of Your Operation
Listen to cybersecurity experts speak on nearly any topic, and one of the first suggestions out of their mouths will be multi-factor authentication. It’s no mystery why. Once this simple tool has been added to your login process, you’ll weed out nearly all hackers attempting to log into your system. MFA programs will not just monitor for proper ID and password; they also send a secondary notification to the user’s cell phone, ensuring that the person logging into the system truly is them.
MFA tools are cheap and easy to install on your system. If you don’t already have them, talk to your IT leadership about getting them today. Once you do, you’ll need to train your employees to use them and download the authentication app on their phones.
Strategy #5—Encourage Password Management Hygiene
Most people understand the importance of never reusing their passwords, yet more than half will do it anyway. Let’s get real. Keeping track of all the passwords for all your tools and platforms is one of the major inconveniences of the modern age. Unfortunately, your bank can’t have a cybersecurity culture without good password hygiene.
Making password management easy should be a top priority. Talk to your IT leadership about installing a system-wide password vault. This will make it easier for your employees to manage numerous passwords. It will also make life easier for managers, who may need easy access to employee logins for staff who are out or have left their jobs.
Even more important, you must teach people the basics of coming up with hard-to-guess passwords. Here’s our tips:
- Avoid common or easily guessed phrases
- Write your password as a sentence using proper punctuation
- Replace common words in a phrase with unusual words that have a similar meaning
- Mix in CaPitals, L3ters, and Symbol$
- Or, when all else fails, use a password generator
Teach your employees to do this, and you’ll dramatically decrease the likelihood of hackers guessing their credentials. That brings me to my last and probably most critical suggestion.
#6—Invest in Monthly Cybersecurity Training for Everyone on Your Staff, No Exceptions
I know I’ve put this last on the list, but this is arguably the single most important move you can make to create a cybersecurity culture at your bank. When everyone has the same cybersecurity training from the top down, that consistency will stick.
Fortunately, many good cybersecurity vendors can provide monthly online cybersecurity training that’s engaging, understandable, tested, and trackable. It’s essential to find a cybersecurity vendor committed to staying up to date with the latest hacking trends and techniques. They can help your employees stay ahead of the increasingly sophisticated hack attempts coming at them every day.
To create an authentic culture of cybersecurity awareness at your bank, we highly suggest choosing a vendor that will test and grade your employees on their retention of the material. The results should be part of their employee file, and the aggregate results should be a key performance indicator tracked by your board.
With this training, your employees will become a true asset in breach prevention. Their vigilance will increase and become a true partner in your bank’s cybersecurity efforts.
Bank Cybersecurity Culture Is Only a Commitment Away
When your bank has a strong cybersecurity culture, you will naturally close some loopholes you didn’t know existed in your defenses. If you’re interested in committing to cybersecurity readiness, Integris stands ready to help. Our Financial Institution Division has 200 employees and has secured the IT infrastructure of hundreds of banks nationwide. Contact us for a free consultation.
