Provision IAM’s Post

Transcript

Hello everyone, my name is Matt Groudon with provision IM. Now this time of year, the beginning of the year, I always like to take some time to read or maybe reread some data breach reports that have been posted over the last year. Specifically, I really like the Verizon data breach report. The 2023 version was released I think in the summer time frame, but still a great report. A highly recommend reading that report every year to any security professional and also briefing your board on the data. So I want to talk about a few data points in the report specifically around. Financial institutions in ways that you can protect yourself. So 1st 74% of the breaches in this report involved the human element that included stolen credentials or social engineering. In fact, 49% of the breaches involved credentials. And as was reported by the IC3 organization, business e-mail compromise is still a really big deal. And according to this Verizon report, more than 50% of the social engineering incidents were, in essence, Business e-mail compromise attacks. So what about ransomware? I know you're thinking that, well, for the second year in a row, it stayed steady at 24% of the breaches. So ransomware is still really a large threat that you have to think about and mitigate against. OK, So what can your institution do to stay ahead of those bad guys? Well, first, I highly recommend having a platform for information security training and also social engineering testing. Now I really like the Nobel Award platform. That's just my personal opinion, has a lot of really good training built into it, but there's. Actual engineering testing platform is really really spectacular and just a piece of advice on using social engineering training. A lot of times you wanna shoot for near zero response rate. That's not really the world that we live in anymore. It might sound good to go to management and say, hey look, we had near 0 people clicking in this test or we're trending down. But the sophistication of the bad actors, AI, generative AI, they're very, very sophisticated social engineering attacks. So you want to start thinking about testing differently and really have really more challenging social engineering tests that really reflect the real world. Situations that your employees are going to be in. So that's saying the purposely try to trick them and have 20% reporting necessarily. But you certainly don't want to shoot for near 0 either. Secondly, get a password manager. You know, ideally every time that you log into a website or an application, that is a different credential, meaning a different password. But let's be honest, not many people were doing that. What are the password manager? And makes that really, really easy to accomplish. You can randomize your passwords, You can have them super long. Whatever the complexity rules are, it's going to manage all that for you because in the event of stolen credentials, which is going to happen to you, then you can easily change that password #1. More importantly #2, if you have a password manager and you're using a separate password for every site, that means when whatever the site was that got compromised, you're not reusing that credentials to, say, your bank. That's the risk there and reusing credentials. Thirdly, for ransomware, check out that ransomware self-assessment tool. You know, I spoke about that a few times recently on this platform. It really is a great guide to help you understand the controls that you need to put in your institution, the type of testing that you need to do to really mitigate ransomware and be prepared. In case you are a victim of ransomware and lastly consider data protection tools and also and Identity and Access Management system, having inventory of your both your data and of your accounts will enable your organization to properly safeguard those crown jewels by limiting who has access to what and enforcing that concept of least privilege. So do you have any questions about the report or how you can properly protect your institution? Just let me know.