Banking Law

Of all the reactions to last week's announcement that RSA had suffered a security breach that compromised its SecureID tokens, used by many banks as part of two-factor authentication, one that especially intrigued me was related by Tracy Kitten on The Fraud Blog. Mike Angelinovich, CEO and co-founder of security company OHVA Inc., had strong words for the FFIEC Guidance that most banks and other financial institutions follow:

"If we want to really improve online security, then these governing boards, such as the FFIEC, need to release some meat behind their requirements and not just offer guidance. Look at what has happened over the last five years under the FFIEC guidelines: Not much outside of annual record-breaking levels of online theft."

Mike's is not a lone voice, crying in the wilderness.

Even Stephen Northcutt of SANS Institute, who's been careful not to jump to conclusions about the RSA breach, says two-factor token technology may need some review. "The FFIEC should work closely with RSA to get good advice, so the guidelines can include information about what additional measures should be implemented to help security, to increase the security of two-factor authentication."

It's true that FFIEC's guidance is about six years old and that cybercriminals, and banking technology, have not been exactly standing in place since 2005. Therefore, the critics have a point. The proposed guidance (most recently discussed by Tracy last month) also is coming under attack, even before it's issued.

"The regulators' awareness of some of the threats is positive, and what they are trying to do on the business banking side is good," says former Bank of America executive David Shroyer, now a partner at risk assessment provider Fraud Red Team. Shroyer says the FFIEC draft update gives banks more insight about online threats. "But the new guidance is not explicit about antivirus updates and patches, and that's important," he says. "Financial institutions live and die by this guidance."

Tracy hopes that the RSA breach will prompt FFIEC to revise its guidance before it's issued, but seems skeptical. In this case, my sympathies are with the regulators, but I'm not as much of a geek as Tracy might be, and as the experts she quotes surely are. Technology is changing so quickly and cybercriminals are so well-funded (in many cases, by organized crime) and so "smart" (intellectually, if not morally), that whatever updates FFIEC will issue, will likely be quickly stale.

A lesson for bankers is that consulting regulatory guidance in the area of information technology and online banking security should be merely the first step, not the only step. You might decide to rest on the premise that you've done all the guidance suggests and, therefore, your information security and authentication processes and procedures are "safe and sound," as far as the regulators are concerned. Unfortunately, the crooks aren't resting. Like sharks, they're always moving, and moving forward. If your security is breached and your customer loses money, whether it's your fault or that of a third party, it's your name that will be plastered over the the pages of the local newspaper, online message boards, blogs, and Twitter "tweets." You may escape legal iability or regulatory penalties, but that will not spare you from the reputational "hit," which can be more painful.

The unfortunate fact of life is that banks who want to swim in cyberspace are well advised to be swimming at least as fast as, and preferably faster than, the sharks.