The last few decades, banks have been directing their cybersecurity resources toward the online banking website, encrypting mobile banking apps, and monitoring their core systems. However, criminals are now turning their attention to a less obvious aspect of banking operations that provides a great deal of opportunity to take advantage of bank customers: the bank's print and email delivery partners. These vendors store and transmit sensitive data, such as bank account statements, tax documents and other types of confidential information.
The vulnerability of print and email delivery services became evident after the data breach that occurred at the Industrial Credit Union of Whatcom County when hackers gained access to the credit union's data through a breach at a third-party vendor who provided printing and email services to credit unions. The Industrial Credit Union data breach also illustrates a growing trend in the financial services industry: criminals are moving away from directly targeting banks to targeting third-party service providers that banks do business with.
Outsourced Communication Systems: The New Cyber Vulnerabilities
Most customers suppose that their banks handle every piece of information directly. In practice, however, many institutions resort to external vendors for the delivery of communications, given that it is faster, cheaper, and more efficient. The said vendors typically manage:
- Printed statements
- Loan documents
- Email notifications
- Tax forms
- Regulatory notices
The trouble is that those vendors often operate outside the most protected perimeters of the financial system. Their systems may not have the same standards of cybersecurity protection as the banks they serve. Even when such controls exist, they may not be revised or watched closely enough, if at all.
Cybercriminals know this fact.
Rather than trying to penetrate into a bank's secure infrastructure, nowadays attackers tend to target vendors that store the same data-names, account numbers, Social Security numbers-without the same oversight.
Vulnerabilities of Print and Email Delivery Services as a Target for Attack
Due to a variety of reasons, Print and Email Delivery Services are targeted as Priority Targets for Cybercrime:
- Storage of High-Value Personally Identifiable Information
- Many of These Small-Medium Sized Businesses Are Not Able to Afford to Maintain the Type of Cyber-Security in their Organization
- Financial Institutions Rely Upon These Companies Daily
- Less Than Robust Monitoring of the Vendor Networks
Warning Signs Were Present Long Before This Current Serial Breach Trend
For years, federal regulators (primarily the FDIC and NCUA) have been advising banks of the increasing threat to customer data being created by third-party vendors. The guidance states that for all vendors providing access to customers’ information (which includes any vendor having access to non-public personal information), the bank remains accountable for the security of those vendor’s systems.
However, as a result of this and other repeated warning signs, a majority of the banks perceive vendor risk assessments as a task that allows them to maintain their compliance obligations rather than as a mechanism for protecting customer information. As evidenced by the dramatic rise in breaches attributed to third-party vendors, the financial institutions are feeling the effects of this lack of recognition.
The Vendor Breach of a Communication Vendor Will Have Greater Impact on Consumers than Most Banks Realize
The aftermath of a vendor’s system compromise can have an impact far beyond what most banks anticipate. Communication vendors frequently manage communication systems for many organizations, so, when one communication vendor suffers a compromise, there is a ripple effect throughout the entire financial services industry.
The potential impacts associated with vendor breaches include:
- As previously described in bullet points
- Lack of Protected Status of Customer Data
- A Generalized Notification Requirement
- Reputational Risks
- Legal Liability Potential and Consumer Claims
- Increased Regulatory Scrutiny
In addition to creating a very real threat to a bank’s reputation, if a vendor is compromised and customers’ Social Security Numbers, Birth Dates, Financial Accounts, and Tax Identifications are part of the data that is collected from that breach, customers are at an Increased Risk of being victimized from identity theft on multiple occasions.
Financial Institutions Must Start Recognising Communication Delivery Vendors as Being Critical Infrastructure to Their Business.
While communication delivery vendors may not seem as cutting-edge as core banking technologies, they play a key role in establishing trust with consumers through the collection and storage of sensitive information that is necessary to provide consumers with their banking services. As threats from cybercriminals continue to evolve, financial institutions will need to develop a much more proactive attitude towards evaluating and securing their vendors' delivery systems.
Key Steps Being Implemented in the Industry Include:
- Monitoring Vendors in Real-Time Utilizing 24/7 Oversight, rather than Conducting Annual Reviews
- Requiring Cybersecurity Certifications From Communication Delivery Vendors
- Implementing Multi-Factor Authentication and More Restrictive Access Control
- Securing All Print and Email Data Transmission By Encrypting It
- Conducting More Thorough Audits of Legacy Communication Software
Including in Vendor Contracts Clauses That Require To Report Any Security Incidents Within Hours, Rather Than Days.
By implementing these protections, financial institutions reduce their overall risk and align themselves with the soon-to-be-required regulatory expectations, which require financial institutions to show accountability for their vendors operations even when those operations are outside their own network.
A Low But Important Priority for Financial Institutions' Security
The financial industry is at a point now where cybercriminals have focused their attention on targeting the weakest link in a financial institution's operations rather than the best-performing institution. Therefore, today communication delivery vendors are one of the highest risk areas for financial institutions.
And as vendor-related incidents like the Industrial Credit Union breach continue to emerge, the industry will likely see renewed emphasis on securing every point where sensitive financial information passes—even the ones customers rarely think about.
