Author: iltadmin

An Opportunity for Community Banks and Credit Unions

The ability to effectively distinguish themselves from their national big chain counterparts has been the rallying cry for most community banks and local credit unions. And if the reports of market share losses over the last two years are any indicator, it’s a battle that most are losing.

The ugly truth is, your customers will likely have to walk or drive by three to five national bank branches to get to yours; so, you better have something truly special to give them a reason to ignore all of the glitz and glamour your much better financed counterparts have to offer.

From the website www.thefinancialbrand.com, come the following insights

• Consumers are worried about their financial health across virtually all demographic segments. For many, this may mean living paycheck to paycheck or worse.
• Unsatisfied with offerings from their primary financial institution, most consumers rely on a hodgepodge of paper and digital tools, from monthly statements to electronic tracking tools available online and on mobile devices. There is a need for better options that are real-time, consolidated and easy to use.
• Security options top the list of desired tools for managing finances and protecting identity.
• As consumers become more aware and comfortable with digital apps across industries, they are more comfortable with digital banking solutions, opening the door for organizations that can provide integrated financial wellness applications.

And this is where community banks and credit unions can take advantage of the significant opportunity the AI-based financial wellness tools and cutting-edge security solutions can provide them.

Most key to these solution offerings are proactive tools that provide financial wellness insight to the customer as well as alerts and notifications regarding when bills are due or potential cash flow challenges that are based on past spending and income trends.

Consumers are demanding less cumbersome and time-consuming budgeting tools. Instead of reporting that is solely based on past transactional history, present-day AI solutions are capable of crafting highly personalized customer experiences and targeted financial guidance which is based in real-time, is contextual and forecasts rather than simply reports.

And these are offerings that even the 500 pound gorillas in the marketplace are slow to offer. Today more than any other time in our history, community banks and credit unions must heed the sage advice so many of us have heard in the past.

Innovate or die.

Let me start off by saying that I am supremely confident that data backup and recovery for your business is not exactly at the forefront of your daily concerns.You have clients, patients, and customers to satisfy.  Inventory to manage, bills to pay and operations to control.  Your day to day business operations take up every moment of every day and there is little room to be proactive about anything.But…data backup and security is a lot like flood insurance.  You don’t really give it much thought until the coastguard pulls up to your front door in an inflatable zodiac to rescue you.

And while I am at it, I am willing to bet that if you DO experience some catastrophic computer/network disaster, you are going be REALLY concerned about getting your data back.

Systems will be down, clients won’t be getting serviced and you are going to be giving serious consideration to day drinking at work.  And if there is a problem with restoring all that data, and YOU were responsible for backing it up, let’s just say you won’t be the most popular kid in the lunchroom.

And because the only way that I am going to be able to get you to take this seriously, here are some scary statistics to ponder.

1. 20% of all small businesses will be hacked within a one year’s time period.  Yep, one in five.
2. Of all the companies who suffered a critical data loss for more than a week, 93% declared bankruptcy.
3. Do you manage your own network?  40% of you will have it accessed by a hacker. And half of you won’t even know it happened!
4. Almost a third of all targeted attacks are deployed on companies with under 250 employees.

Now at this point, you might be thinking to yourself…” Hey pal,back off with the spooky disaster statistics.  We do backups.”

But my question to you is HOW do you perform them and HOW OFTEN?

I remember my first job was working for a veterinary hospital and the office manager at the time would perform system backups once a week on tape.  Then she would take that tape, stick it in her purse, and take it home until it came time to perform another backup.

Now, for 1989, this wasn’t a bad system, despite the myriad of things that could have gone wrong.  Like, what if the backup didn’t work (we never tested it)?  Or what about all the data that we collected in the six days between backup sessions?  Were we just ok with losing all of that?

Today, we have a variable cornucopia of options when it comes to backing up and securing our critical I.T. data.  From multiple/redundant external drives to cloud solutions, we have come a long way from taking a data tape home in our purses.

Andbecause each business’s data and I.T. environment is different, it is wise to talk to a professional firm who can assess not only the best service or tool, but the procedures and policies that will hold your shiny new backup system together.

InfoLink works with multiple vendors to provide just the right solutions that are tailored to your specific business and needs.  No cookie cutter fixes here.

And the best part is…we can actually SAVE you money on your solutions, not cost you more.To schedule a free evaluation of your systems and get answers on how to protect

them with iron-clad confidence, reach out to us today by visiting us at infolinktechnologies.net

As soon as I start talking about computer security, data breaches, and malware to small business owners, their eyes inevitably glaze over and their facial expression tells me one thing.

I know this is important, but I am too busy dealing with today’s challenges to worry about what MIGHT happen…

Hey, after all, this kind of thing only happens to the big companies, right?

The fact is, businesses large and small, from big retailers to small town chiropractors are being attacked. And it isn’t until your business has ground to a halt that you start to wonder why it happened and what the heck you are going to do minimize the damage.

Just for a moment, ask yourself these questions:

1. If you suddenly lost all access to your databases (customer info, transactions, etc.), how would that impact your business?
2. How would your customers/clients react to the news that you exposed their sensitive information to an outside source?  Oh, and BTW, you had no idea who it was or what they would do with it?
3. You no longer controlled your network and all sales functions came to a grinding halt, how many hours/days of that could you sustain before the damage was permanent?

The reality of computer security is that once you are a victim of an attack, the damage is done and there is little you can do to reverse it.  Your client?s confidence in you is already shattered, business has been lost, and the costs to repair it are going to be significant.

So, what’s the moral of this story BE PROACTIVE!

Almost all of the threats that are currently out there can be avoided by having sound and consistent I.T. security protocols and procedures in place. Gary Hayslip produced an exceptional article for csoonline.com that outlines the foundations of a sound Incident Management Plan.

1. Identify
   The business develops an understanding of its risk and then implements the capabilities to manage it. Core tasks in the Identify function are orientated towards gaining an understanding of the critical systems, assets, data, and capabilities required for business operations.
   • Identify and prioritize critical business systems and processes which may be exposed to compromise. Think of the procedures, applications, data, and people required for essential operations needed by the organization to function as a business.
   • Develop a Disaster Recovery and Business Continuity Plans (BC/DR) while taking into account some of the following requirements:
     • Coordinate how business with work with suppliers and primary customers during a business emergency.
     • Plan how the business would conduct manual or alternative business operations if required.
     • Plan how the company would do offline financial transactions.
     • Develop written procedures for emergency system shutdown and restart.
     • Develop and test methods for retrieving and restoring backup data; periodically test backup data to verify its validity.
     • Have established agreements and procedures for conducting business operations in an alternate facility/site.
     • Educate and train staff on Business Operations Plan, DR/BC Plan.
2. Protect
   The business implements a cybersecurity program with appropriate security controls and capabilities. The core tasks in the Protect function are centered on the organization developing the strategic processes to limit and contain the impact of a cybersecurity incident.
   • Develop core critical “cyber hygiene” policies including Acceptable Use, Access Control, Change Management, Information Security, Incident Response, Remote Access, BYOD, Email/Communication, and Social Media.
   • Implement an enterprise cybersecurity program comprised of these best practices:
     • Backup business data (daily incremental/weekly – full).
     • Keep all systems updated with anti-virus and anti-malware security software.
     • Keep all computer operating systems updated with current operating systems and EDR security patches.
     • Secure wireless networks with encryption and vendor recommended security procedures.
     • Implement, monitor, and audit system and network logging.
     • Implement access control and authentication of critical/sensitive networks and business data.
     • Train employees in cybersecurity awareness and proper use of business systems.
3. Detect
   The business implements the appropriate security controls and technologies to identify and investigate the occurrence of a cybersecurity event. The core tasks in the Detect function are focused on the timely discovery and investigation of anomalies and abnormal events through continuous monitoring and detection.
   • Implement continuous assessment, monitoring and remediation of network and assets deemed critical to the business.
   • Develop a training program for security personnel on the use of cyber threat intelligence and management of anomalous events.
   • Develop an incident response plan for the organization’s cybersecurity teams to manage during a cyber-event by doing the following:
     • Maintain a current inventory of computer assets (hardware, software, and cloud).
     • Maintain a list of IT service providers and emergency/law enforcement contact information.
     • Create a checklist of specific actions in the event of a cyber incident.
     • Define and establish priority notification of employees.
     • Define and establish priority notification of customers/clients as deemed necessary and at the appropriate time.
     • Define other notifications (e.g., law enforcement).
     • Account for Regulatory Compliance (as required).
     • Conduct refresher training on incident response emergency procedures (at least annually).
4. Respond
   The organization implements the appropriate controls and procedures to take action with regards to a confirmed cybersecurity incident. The core tasks of the Respond function are designed to support the business ability to contain the impact of a cybersecurity incident.
   
   • Identify impacted/compromised systems and assess the damage.
   • Implement incident response plan actions (emergency/contingency plans) to minimize the impact on business operations.
   • Attempt to preserve evidence of incident while disconnecting/segregating affected identified assets.
   • Collect the affected assets system configuration, network, and intrusion detection logs.
   • Notify appropriate internal parties, third-party vendors or authorities, and request assistance, if necessary.
   • Reduce damage by removing (disconnecting) affected assets.
   • Document all steps that were taken during the incident and conduct a “lessons learned” discussion to improve the incident response team?s procedures.
5. Recover
   The organization develops and implements procedures to be activated in the event of a cybersecurity incident. The core focus of the Recover function is to keep the company in operation during such an event and assist it in recovery efforts as it returns to normal business operations.
   • Restore recovered asset to a periodic “recovery points” if available and use backup data to restore systems to last known “good” status.
   • Ensure all backups of critical assets are stored in a physically and environmentally secured location.
   • Remember updating recovered systems with current data may require the business to manually input transactions if it was conducted offline due to a cyber event.
   • Create updated “clean” backup from restored asset.

In today’s dynamic threat environment, developing a risk management methodology is a strategic imperative for companies. NIST’s risk management functions are necessary steps an organization can follow to manage its risk and the impact of a cyber incident. It is important to begin the process; accept you need it and incorporate it into the business portfolio of critical operations that are required to be successful.