Addressing the Graham-Leach-Bliley Act with Predictive Security Intelligence
The Gramm-Leach-Bliley Act (GLBA) of 1999 was enacted in response to the rapid increase in Internet banking and online access to account information. GLBA Section 501(b), titled “Establishing Standards for Safeguarding Customer Information,” requires financial institutions in the United States to create information security programs that:
- Ensure the security and confidentiality of customer information;
- Protect against any anticipated threats or hazards to the security or integrity of such information; and,
- Protect against unauthorized access to or use of customer information that could result in substantial harm or inconvenience to any customer.
Penalties for non-compliance include fines to businesses of up to $100,000 per violation, fines for officers and directors of up to $10,000 per violation, criminal penalties of up to five years in prison, and revocation of professional licenses.
GLBA doesn’t prescribe any technologies or exact guidelines of developing such a program to safeguard customer information and integrity. Instead, the Federal Financial Institutions Examination Council (FFIEC), comprised of examiners from many different regulatory bodies, is tasked with GLBA enforcement. The FFIEC IT Examination Handbook and the FFIEC “Authentication in an Internet Banking Environment” supplement – as well as numerous enterprise risk management frameworks prescribed by COSO, COBIT and NIST – assists auditors with exhaustive tests to assess compliance with GLBA Section 501b.
The examination steps for Section 501(b) include the following considerations:
- Involvement of the board in overseeing and designing the corporate information security program
- Evaluation of the risk assessment process
- Evaluation of the adequacy of the program to manage and control risk
- Assessment of measures to oversee service providers
- Process to adjust the information security program
- Communication of findings
Addressing GLBA Requirements with CORE Security Solutions
IT security guidance from the FFIEC provides risk professionals and auditors the necessary best practices to fulfill and enforce GLBA Section 501b. Predictive security intelligence solutions from CORE Security address much of the FFIEC guidance as detailed in the table below:
FFIEC Guidance |
How CORE can help |
Information Security Risk Assessment (from FFIEC IT Examination Handbook) Financial institutions must maintain an ongoing information security risk assessment program that effectively:
Risk Assessments (from “Authentication in an Internet Banking Environment” supplement) Institutions must establish a Risk Assessment that accounts for:
The Risk Assessment must be reviewed, updated or performed at least every 12 months |
Conduct Proactive, Real-World Risk Assessments Our predictive security intelligence solutions enable financial institutions to proactively identify critical threats, see how risk changes over time as technology and business processes evolve, and prioritize their risk and security practices to stay ahead.
|
Information Security Strategy (from FFIEC IT Examination Handbook) Financial Institutions should develop a strategy that defines control objectives and establishes an implementation plan, including appropriate considerations of prevention, detection, and response mechanisms as well as layered controls that identify threats to organizational assets. |
Build Risk Preemption into Your Security Strategy
|
Security Controls Implementation (from FFIEC IT Examination Handbook) An effective control mechanism includes numerous controls to safeguard and limits access to key information system assets at all layers in the network stack. This section addresses logical and administrative controls, including access rights administration for individuals and network access issues.
Institutions should implement a strategy of Layered Security to protect online transactions:
Use the results of the Risk Assessment to adjust levels of authentication controls accordingly. |
Verify Security Controls Efficacy FFIEC guidance acknowledges that diverse security controls at different points in a transaction flow can help mitigate weaknesses. Most banks also realize that single layer of authentication will simply not work with constant change and myriad of technologies.
|
Security Threat & Process Monitoring & Updating Financial institutions should continuously gather and analyze information regarding new threats and vulnerabilities, actual attacks on the institution or others, and the effectiveness of the existing security controls. They should then use that information to update the risk assessment, strategy, and implemented controls.
|
Stay Ahead of Evolving Threats Things change -- Financial institutions should validate their ongoing risk mitigation strategy and processes by monitoring network and host activity to identify policy violations, anomalous behavior, unauthorized configuration, and other conditions that increase risk. They should also analyze the results of monitoring to accurately and quickly identify, classify, escalate, report and guide responses to security incidents. CORE solutions enable financial institutions to:
|