The NYDFS released a new report on the Cyber Security in the Banking Sector that highlights problems faced by almost every bank in the US with third party vendors.
Last week, The New York State Department of Financial Services (NYDFS) released a report on the Cyber Security in the Banking industry, the analysis revealed several disconcerting aspects related to the securiy posture of the financial institutions when work with vendors.
The authors of the report audited 150 banks and most interesting findings of the study they elaborated are:
Only 63% of the surveyed institutions were cover by insurance in case of a cyber-security incident.
Only 47% of the surveyed institutions reported having cyber insurance policies to cover security failures committed by third-party vendors.
Only 50% of the surveyed institutions have clauses in their agreements with third-party vendors.
“A bank’s cyber security is often only as good as the cyber security of its vendors. Unfortunately, those third-party firms can provide a backdoor entrance to hackers who are seeking to steal sensitive bank customer data,” said Benjamin Lawsky, the state’s Superintendent of Financial Services, commenting the report.
Another disconcerting data is related to the security of encryption to protect sensitive data in transit, nearly 90% of the interviewed banks are using encryption for transmitting data to third parties, but unfortunately only 38% are using encryption for all the other communications.
NYDFS clarified that multiple banks allow vendors like law firms, IT companies, to access their systems without being worried about securities measurements, but not all is bad and it’s stated that as the conclusion to the report:
“Banking organizations appear to be working to address the cyber security risks posed by third-party service providers, although progress varies depending on the size and type of institution”
About the Author Elsio Pinto
Elsio Pinto is at the moment the Lead Mcafee Security Engineer at Swiss Re, but he also as knowledge in the areas of malware research, forensics, ethical hacking. He had previous experiences in major institutions being the European Parliament one of them. He is a security enthusiast and tries his best to pass his knowledge. He also owns his own blog http://high54security.blogspot.com/
Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines.
Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.