Beware of putting too much security pressure on IT staff

EDISON, N.J. – An IT staff may be good at launching and developing new technology systems, but in most cases security is not its forte, said Rachelle McLure, national director of solutions at security firm RCG Information Technology. “You can’t do it all. I think when you get into the smaller IT shops, you have one person who is doing everything. There are some security issues that even the larger companies can’t always learn by doing,” said McLure. She said it’s a mistake not to train IT staff at all about technology. While many companies are outsourcing security, there needs to be a certain security IQ in-house as well. “It’s not just about infrastructure security – firewalls, routers and hubs – credit unions have to be educated on processes, like for passwords,” said McLure. “Security is a shared responsibility.” Even members can play a role, she said. For example, for members that have a large stake of their financial lives invested in the CU, the CU could offer a sort of premier security service for those members that they can purchase for a fee. That may go against CU beliefs of equality for members, but the fact is that if a system is overly secure it’s going to be hard to use. Maybe some members would sacrifice the functionality for the security, said McLure. McLure also warned that CUs have to be diligent in researching third-party security firms. “You don’t want to run into a company of black hats putting up a facade of white hats. There are a lot of reputable firms out there,” she said. She recommended looking for firms that have done extensive work with the government.