Independent Banker - June 2017 - 70

Risks & Rules
and chief information security offi cer
for $1.3 billion-asset Orrstown Bank,
says that " data and cybersecurity are
not technology problems but rather
people problems. " While a layered
technology-security approach helps
" Constant awareness in
small, easily consumed,
bite-sized blurbs [is
what] we've found to be
most eff ective. "
-ANDREW LINN,
ORRSTOWN BANK
the Shippensburg, Penn.-based bank,
" constant awareness in small, easily
consumed, bite-sized blurbs [is what]
we've found to be most effective, "
Linn adds. Longer annual training
courses are also important, but
the smaller just-in-time awareness
opportunities during or after an event
have a longer-lasting impact.
Bjorklund underscores the importance
of building support with the
lines of business so the IT department
can work more effectively with
these leaders to drill down messages
about data security through these
teams. " A lot of the time it's just
about competing priorities, " he says.
" People are stretched thin and wearing
more hats and just don't have the
time to allocate here. "
Digital bulletin board
Many community banks have opted
to create their own intranets to " keep
all employees aware of the possible
dangers of exposing the banks' and
customers' information, " says David
Daniel, senior vice president of
sales and marketing and partner
at Banc Intranets, which provides
enterprise content management
solutions for 180 community banks.
Using the intranet as a channel for
communication, Daniel says several of
the company's bank clients use blogs
to share information with employees
about potential cyberthreats and permit
or encourage online discussions.
" We also see banks use intranets to
provide online courses and content
to educate employees and then test
them to ensure they are understanding
the threats and risks associated
with data security, " he adds.
As new threats emerge and the
industry's policies and practices
change, it is increasingly important
to build on and adapt the messages
being sent to employees, according
to Bjorklund. It is also critical to
measure the progress of these data
security efforts to see what is working
and what is not, so banks can gauge
progress and know how to adapt.
" It's like checking the air pressure
IndependentBanker.org
ICBA Independent Banker® magazine's website
Visit our site for
continued coverage and
the latest industry news!
IB Digital Edition
Trending Articles
Webinar Event Center
IBmag Social Media
... and more!
on your tires. You can't just look, you
have to measure, " Bjorklund says,
suggesting that to gauge how much
progress has been made in developing
a culture of data security, banks
should consider a number of tests.
The fi rst is a social engineering test,
where an outside fi rm or consultant
sends phishing emails or sets other
electronic traps to see if employees
will fall for these frauds. The second
is a vulnerability scan, where an internal
or external security professional
checks the network, applications
and software for weaknesses that a
hacker could exploit to get in, steal
information or take over the network.
A more creative approach would be
something like surveys, contests and
an employee quiz, whether on the
intranet or in real life.
Zazzaro says he knows that embracing
better security practices will
often " slow people down. " But that
makes communicating the urgency
and necessity of these mandates and
best practices all the more important
to getting buy-in throughout the
organization. " Some people will push
the limits; they want ease and convenience.
That's the world we live in, "
he says. " It's always a challenge. "
#IBMag
Karen Epper Hoffman is a writer in
Washington state.
http://www.qmags.com/clickthrough.asp?url=http://IndependentBanker.org&id=20263&adid=P70A1
Independent Banker - June 2017

Table of Contents for the Digital Edition of Independent Banker - June 2017
