Are security managers meeting new needs?

In 1968, when congress enacted the Bank Protection Act, the risks faced by banking institutions were significantly different from the risks faced by banks today. For the most part, bank security programs of this era were targeted to the paper-based physical delivery systems of that period, and the basic role of the bank security director at that time was primarily focused on physical security, such as ensuring that the proper security devices and systems were in place.

Over the next twenty-five years not much changed. Congress passed numerous laws addressing such new concerns as money laundering, but the attention remained focused on physical security and paper trails to address risks such as armed robberies, check fraud, and currency safekeeping. Now, however, bank security is going through a paradigm shift.

Advances in technology have caused the scope of financial institution risk to take on an entirely different character, unrecognizable from the risks banks faced only a decade ago. For example, banks are not adding physical branch sites; they're closing them. But "virtual" access to bank assets through electronic means is growing exponentially. If bank security departments are to be seen as adding value to their organizations in this new environment, they must be viewed as enablers in safeguarding emerging technologies.

While some financial services security professionals have successfully expanded their efforts to address technology risk management by integrating information systems security, disaster planning, and overall technology risk control under a single program, others continue to operate with a circa-1968 security program design. Those security directors can be heard at industry conferences complaining that so much at their institution "gets done outside their box."

Indeed it does, and security professionals must break out of that box to survive. If they do not soon recognize the need to shift priorities, they will become less and less relevant to their company's well-being, replaced by or subsumed under the information technology group within each organization.

Conversely, if they look closely at their institution's technology risk profile, they will see an opportunity to make a difference. Many banks' weakest security component is not the absence of new data protection technologies, it is the absence of proper oversight. At the same time that these banks invest heavily in data security systems, they fail to establish policies to ensure that audit logs are systematically monitored, that suspicious or unauthorized access events are resolved, and that timely criminal referrals are made for technology-related crimes.

Security directors can fill this need. They can help their institutions develop formalized policies for monitoring computer access and ensure that access violations are investigated.

Security managers should integrate these technology risk management programs with their existing security programs. But before they can take that initiative, they must garner the specific technological know-how required to convince senior management that the bank security director can be entrusted with protecting the bank's technology assets and computing infrastructure.

Doing so involves more than understanding general concepts. The security manager should become comfortable with tasks such as retrieving text-file records of computer access events and obtaining audit trails from other sources such as printer queues, transaction logs, and cost-accounting systems. In other words, the security manager must be computer literate.

Once management understands the logic of incorporating technology risk control into the bank security program, the security director needs to implement safeguards to address the six "As" of technology risk control as follows.

Assurance. Documented policies must be in place to assure management that internal controls exist for all aspects of information and technology risk. Policies should provide a clear standard of what is expected based on a single authoritative source that everyone can refer to and interpret consistently.

Authentication and authorization. Authentication and authorization systems must be in place to uniquely identify individual users. The best method involves three-factor authentication, which includes something the user has (an access card or token), something the user knows (a password), and something intrinsic to the user - a characteristic such as a retinal image or face recognition.

Audit trails. Audit trails should be in place to detect and report user access events, discern user actions taken, and trace transaction events back to source applications.

Availability. Availability of corporate information and technology resources should be ensured through appropriate emergency disaster and business continuity plans, both for the corporate infrastructure and for each business unit.

Asset tracking. Systems should be in place to track information technology assets, including all components of a distributed computing environment. This concern can be addressed through prudent business practices, software tools, and products.

For security directors who have not begun to address the movement toward electronic banking, now is the time to get started. Of course, doing so will require a serious commitment of time and resources. New security hardware and software solutions are introduced almost daily. They address everything from Internet/intranet and Web security to workstation-to-server controls and security for distributed applications.

Attempting to gain a working knowledge of this vast and shifting landscape can be overwhelming. But the challenge must be met if banks are to be adequately protected against technology crimes and if security professionals are to continue to play a vital role in developing and maintaining the needed safeguards.

John J. Melia, Jr., CPP, CFE (certified fraud examiner), CISSP (certified information systems security professional), CBCP (certified business continuity professional), is director of compliance/risk management for Home Loan and Investment Bank, FSB, based in Warwick, Rhode Island. He is a member of ASIS.