Ransomware, Phishing, Business Email Compromise: Is Your Incident Response Plan Ready
Phishing, Business Email Compromise, and Ransomware are some of the biggest concerns and examination focus for 2022. Having an incident response plan is not a suggestion, it is a requirement. Security breaches are real and inevitable, not to mention increasing every day. Does your Plan provide a framework for an effective and timely response?
When it comes to a security event or breach, it isn’t a matter of “if” but “when”. No one is immune, no one is 100% secure. Any breach regardless of the type or size can be potentially devasting and the catalyst for breaches continuing to emerge and intensify. 2021 is said to have been a breakout year for ransomware as the cybersecurity attack vector of choice; affected all industries and even single individuals. We now have Ransomware as a Service (RaaS), a pay for use malware. The third quarter of 2021 touts an unprecedented surge of unique phishing website – an increase of over 400 thousand. And if all that isn’t enough, business email compromise (BEC), another damaging form of cybercrime has exploded on the scene. The outcome of an attack can result in huge financial losses but that isn’t the only concern, what about reputation risk?
Financial institutions are particularly vulnerable by the very nature of the business. You have information that thieves want, information they can parley into cold hard cash, if not the cash itself. Your incident response plan should provide confidence that you have the right personnel and procedures in place to deal effectively and timely to s a security breach. And if that isn’t enough, the financial services industry is mandated to implement security controls and a framework for identifying potential risks, monitoring for and detecting unauthorized access mitigating the outcome, effectively responding to the event, and notifying customers, law enforcement and regulators when it does happen. Be sure that examiners will be looking at your Plan.
The incident response plan shouldn’t be just a checklist. You need well thought out detailed procedures/response steps that have been practices and tested to ensure you are as prepared as you can be when a security breach happens.
- Is there a Regulatory requirement for a having a plan?
- What guidance, alerts, bulletins are there surrounding incident response?
- Roles and responsibilities, who is responsible?
- What type of things would represent a breach or event?
- What are the key elements of a Plan?
- Do we really need a Plan if we outsource IT?
- We have a disaster recovery plan, isn’t that the same thing?
Who Should Attend?
Senior management, Audit, Compliance, Risk Management, IT Committee, IT Officers, Information/Cyber Security Officers, Operations Officers, anyone interested in developing the IRP.
Susan Orr is a leading financial services expert with vast regulatory, risk management, and security best practice knowledge and expertise.
As an auditor and consultant, Orr is dedicated to assisting financial institutions in implementing appropriate policies and controls to protect confidential information and comply with regulatory mandates and best practices. Her expertise as an auditor and former examiner provides her the knowledge and expertise to conduct comprehensive IT general control and data security reviews and assist de novo institutions in the vendor selection process, preparing policies and procedures, and instituting controls. She also consults for numerous security providers and vendors helping them align products and services to meet institution regulatory mandates. Susan is a Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC), and Certified Risk Professional (CRP).
- Live Access, 30 Days OnDemand Playback, Presenter Materials and Handouts – $279
- Available Upgrades:
- 12 Months OnDemand Playback + $110
- 12 Months OnDemand Playback + CD + $140
- Additional Live Access + $85 per person