The Need for Secure Remote Access in Financial Institutions
Cyber security is one of the most urgent concerns for today’s financial services institutions. Financial institutions such as banks, credit unions, insurance companies, and investment funds need to carefully balance their clients’ demand for more flexibility in accessing their accounts, while ensuring compliance with complex regulatory guidelines and security standards. Financial websites and apps are a prime target for fraud, financial theft and other cybercrimes, with recent reports finding as many as 75% of the top 20 US commercial banks to be infected by malware. The need to maintain a high degree of security, while providing a seamless and fully transparent user experience can be quite a challenge. Here are a few tips to secure clients’ online financial activity without compromising on usability:
Follow best practices to ensure secure login
Financial institutions should develop and implement comprehensive security measures to reliably authenticate customers accessing financial services online. Both end-user logins and transactions on the corporate website should only take place over secure private connections in order to protect customer data and avoid cyber-theft. Organizations need to continuously keep a pulse on the latest cyber threats (e.g., phishing, spear phishing, social engineering), and take steps to educate both employees and customers on how to avoid falling victim to these attacks.
Implement a secure remote access/administration service
Insecure or insecurely used remote access technologies offer an abundance of options for attackers to breach the company’s systems. Remote access to financial systems must be protected by firewalls or other similar devices and utilize advanced security measures such as two-factor authentication (2FA),. On the other hand, secure access tools should also be seamless and easy to use, to ensure compliance by non-technical employees and contractors. Financial institutions should consider choosing a remote access solution that will simplify security solutions while maximizing flexibility and choice.
Constantly monitoring access
Because they are working with highly sensitive data, banks and other financial institutions must be able to centrally manage and monitor all remote access to their systems and keep detailed event logs, including a history of inbound and outbound network traffic. They must also strictly define what constitutes “suspicious” traffic and set up real-time alerts to ensure that such traffic is carefully monitored, in order to prevent hacking attempts. This doesn't necessarily have to be a cumbersome task. There are software tools that can help banks easily investigate attempted security breaches through extensive logging, event recording, and detailed audit trails. It is also important to ensure that system admins can view all active connections in real time, and selectively terminate them.
Update anti-virus and other software consistently
Keeping pace with constant antivirus updates can be time-consuming and costly, especially when software is installed locally. For banks that need to update this software in multiple geographically distributed branches, this can seem virtually impossible. In such cases, it may be easiest to provision virtual or cloud-based desktops with the antivirus software being managed on the server side, instead of physically updating it on all individual desktops, thus lowering the burden on IT.
Preparing for a security breach
In the event that all the above measures fail to completely protect the organization from attacks, it is crucial to have a back-up plan in place to deal with security breaches. In the financial sector in particular, any incident can end up in legal actions, fines and other penalties, not to mention the damage to the organization’s reputation. An effective plan will reduce the risk of financial losses for both the bank and its clients. Such a plan should incorporate feedback from IT professionals, privacy experts and legal experts.
What is your experience with online banking online systems? What do you think banks should be doing to improve security? Leave us a reply or comment below.