{"id":1380,"date":"2018-11-07T19:16:15","date_gmt":"2018-11-07T19:16:15","guid":{"rendered":"https:\/\/albanknews.com\/?p=1380"},"modified":"2018-11-07T19:16:15","modified_gmt":"2018-11-07T19:16:15","slug":"best-practices-for-financial-institutions-to-prevent-or-mitigate-intrusions-through-mobile-devices","status":"publish","type":"post","link":"https:\/\/albanknews.com\/?p=1380","title":{"rendered":"Best Practices for Financial Institutions to Prevent or Mitigate Intrusions Through Mobile Devices"},"content":{"rendered":"

by <\/i><\/span>Fob H. James, IV, Burr Forman<\/span><\/a><\/p>\n

Mobile devices are widely used by employees of banks for good reason. They facilitate efficiency and productivity by allowing employees to work and communicate on the go; however, there is always a catch. The downside of authorizing work-related mobile devices is their use can potentially result in the loss of sensitive bank-owned data. Mobile devices provide attackers with additional points of entry into the bank\u2019s systems and points of origin to execute phishing or social engineering schemes.<\/span><\/p>\n

Many bank employees access their work email accounts through their mobile devices. The mobile device itself is usually protected by a PIN code, but the device\u2019s email exchange is generally configured with a saved username and password. This configuration potentially exposes confidential information that is accessible in the bank\u2019s email system. It also invites phishing or social engineering schemes that originate from an actual employee\u2019s email address or text message. The success rate of these schemes greatly increases when the source is an authentic account. Data stored in core banking systems is also at risk if employees access these systems from their mobile devices. <\/span><\/p>\n

Banks are increasingly using two-factor authentication to protect systems that contain sensitive data. The common method for two-factor authentication requires a user to obtain a token key generated by an app on his or her mobile device and then use that key in combination with a username and password. A misappropriated mobile device may provide an attacker with an opportunity to beat two-factor authentication defenses. <\/span><\/p>\n

Bank regulators have taken notice of the risks associated with mobile devices. As a result, they have issued guidance recommending that banks identify risks related to mobile devices and maintain controls to mitigate those risks. For example, the Federal Financial Institution Examination Council (FFIEC) has released a suite of booklets as part of its comprehensive Information Technology Examination Handbook, which provides participating examiners with in-depth guidance for assessing or auditing the security risks to a financial institution\u2019s information systems and their implementation of information security programs, business continuity programs and overall risk management programs. These booklets also provide financial institutions with valuable insight into information security policies that they may be expected to implement to mitigate the risk of threats, including those associated with mobile devices. For example, FFIEC\u2019s Information Security booklet provides that: <\/span><\/p>\n