How Banks Can Achieve Compliance While Improving Security and Productivity
All employees in small and medium-sized banks – front and back office – are spending valuable hours managing and gaining access to the systems and applications that run the business, from entering a number of different passwords and keeping tabs on them, to ensuring that passwords and access are protected to maintain the integrity of security policies. But this effort can take the focus away from other, more strategic initiatives. Banks need to be able to enforce security and better address compliance needs, which improves productivity, satisfies consumer demandsand, most importantly, drives revenue and profitability.
With the heightened awareness around identity theft, many banks have measures in place to discover customer identity fraud and the related security processes to confront it. However, these internal processes and measures are under increased scrutiny with a number of federal and industry regulations, such as Gramm-Leach-Bliley Act, Sarbanes-Oxley, HIPAA, the USA PATRIOT Act, Basel II, and multi-factor authentication measures as recommended by the Federal Financial Institutions Examination Council (FFIEC).
But despite this ‘watchful eye’ and established internal security policies, employees don’t always have access to business-critical applications without interruption. Today’s bank infrastructure complicates these issues with its legacy systems, homegrown IT applications and inherited systems from mergers and acquisitions. And while Web applications have been introduced, they are not replacing the legacy or mainframe IT systems anytime soon. The result: employees with yellow notes stuck all around their monitors to keep track of their many passwords for a heterogeneous infrastructure – leaving password information exposed for anyone to see. And with the lost and forgotten passwords comes the sharing of passwords with superiors and other staff members. It’s convenient, but employees are inadvertently violating compliance regulations.
To make matters worse, when passwords need to be reset, many bank employees rely on their helpdesk. But helpdesks often lack the ability to provide new access rights via secure channels, as passwords are typically communicated via email or over the phone. And according to Gartner, the average cost of a helpdesk call can run an organization anywhere from US$10 to US$30, dipping into the bottom line.
Streamlining these processes – automatic provisioning, self-service password resetting, and password management to name a few – improves productivity, leading to reduced costs, increased customer satisfaction and additional opportunities to sell more services.
Without being able to effectively track who is accessing what applications and when, IT and security staff are scrambling to address compliance requirements without an automated and repeatable process in place. They are often forced to manually track down and report on the information required by the various standards affecting the institution – which is inefficient and inaccurate but crucial. In today’s world, banks cannot afford to be on the front page of The Wall Street Journal for failing to comply with federal regulations.
Addressing the challenges surrounding access control across multiple applications is only possible when passwords can be streamlined and automatically recognize not only the employee, but also his or her role at the organization. Banks often struggle with role-based access because without an automated process, it’s very hard to keep track of and manage credentials in an industry where temporary hires and high turnover is common. There needs to be a standard, automated process to ensure that employees have access to only those applications they need, and that all access rights are terminated for former employees.
Equally important is the ability to easily generate and distribute enterprise-wide reports to ensure awareness and accountability. By gaining control of the processes and policies that define how information is shared and how users interact with resources, banks can easily monitor and report on enterprise-wide activities and data.
Banks are subject to multiple audits throughout the year, so having robust, repeatable and automated processes are imperative to their viability. Automation of access rights also enables organizations to create an audit trail that can effectively and efficiently track compliance throughout the entire organization.
A sound security infrastructure is critical to provide the agility and streamlined security processes that enable banks to gain a competitive advantage. To achieve this, banks should evaluate solutions that address identity, security and compliance management, and can be tailored to the individual needs of a bank.
Role-based access contributes to a bank’s ability to meet both security and compliance objectives that are in line with overarching security goals. For instance, employees should be able to log on from a single workstation and be presented with a screen that displays all necessary applications that are specific to their jobs. This helps to eliminate confusion and ensures employees are not only productive, but also in compliance. Role-based access also creates a trackable and manageable access log, saving time and money come audit season.
It is critical to control and/or reduce the number of passwords employees use to gain access to necessary applications as it will ultimately reduce the number of sign-on attempts. Security concerns associated with frequent sign-ons can be addressed with strong password policies, one-time passwords and/or strong authentication technologies, such as smart cards and biometrics.
Passwords should also be synchronised with all systems, if possible, to cure the post-it note syndrome. Look for solutions with a self-service interface for password management of employees – so if a password is lost or forgotten, employees can retrieve or reset their password on their own. In the event of needing to share passwords, consider solutions that offer temporary access delegation for physical resources and logical information systems with a single authentication measure.
To meet the specific needs of banks, identity management systems should also allow temporary access to certain systems and applications for authorized employees. This becomes especially important at times when a supervisor needs to assign a senior staff member to act as the supervisor, such as over the weekend or while the supervisor is on vacation. By allowing temporary access delegation, the solution enables an efficient process that allows supervisors to seamlessly assume responsibility once back in the front office.
Despite their size, small- and medium-sized banks have a very large role to fill in ensuring that sensitive information is secure and managed in compliance with a variety of regulations. In an industry where turnover rates are high, it can be a daunting task to ensure that all access rights are appropriately delegated and controlled – never mind ensuring that the access history of all systems are accurate and ongoing. But implementing an identity-based solution that is automated and tailored to the specific needs of the bank can alleviate a lot of angst. The hours and resources once dedicated to piecing together paper audit trials and access control can now be redirected to a bank’s most important asset: its customers.
Solid security practices improve the overall security of an organization’s infrastructure. The following are recommended best practices for implementing a security management framework:
1. Define security policies. Establishing security policies is an important first step in the security management lifecycle. Security policies establish clear guidelines about what needs to be protected, who needs access to what systems, and what is considered acceptable behavior throughout the organization, including the use of information technology and considerations around the protection of information assets.
2. Security awareness. Security policies are meaningless unless employees are aware of them and understand their role in following and enforcing the policies. Employee awareness helps ensure successful policy adoption and execution. Making employees aware of security policies should include training about the appropriate processes to follow for password creation and resets. Temporary, roaming and remote employees may require awareness training tailored to their unique circumstances.
3. Security control points. A solid security framework is built upon people, processes and technology. Once processes are established and employees understand their role in following and enforcing them, your bank can implement technology to support the policies and people. By automating and standardizing these IT controls, banks can realize increased efficiencies while ensuring that employees do not violate important policies.
4. Monitor control points. Security management is not a one-time event; rather, it is an ongoing process. Once IT controls are in place, they must be monitored to ensure no violations occur. In other words, the IT group must still confirm that employees are unable to access systems they are not authorized to access.
5. Remediation management and compliance reporting. To complete the circle, banks must implement processes for identifying and remediating any gaps discovered in their security frameworks. Using technology to identify and recommend remediation steps can go a long way to ensuring an effective process. Technology can also provide the enhanced visibility that enables your bank to respond in real time to compliance needs, such as by generating compliance reports.