Cybercriminals want to unleash the kill chain, a systematic process designed to target and engage an adversary to create the desired effects. The kill chain concept has been adopted to describe the attack and exploitation process used by computer criminals.

This is an integrated, end-to-end process, Fredriksen said, and any one deficiency can interrupt the entire process. Rather than focusing all cyber-protection efforts on one point (i.e. the perimeter), PSCU network and information defenses are designed to interrupt the kill chain at multiple layers in the system.

Intelligence-driven security, Fredriksen explained, yields a much more robust security infrastructure than traditional methods do.

“The whole idea of building tech walls and hoping the bad guys stay out has not worked since the city of Troy,” he said.

Erik Gustafson, president and chief technology officer at the Chicago-based Xamin, said in a CU InfoSecurity presentation, “Where I find a gap in the market is internal hardening, especially from a network standpoint, as well as PCs and servers.”

Gustafson recommended credit unions look at their network strategy and focus on the non-obvious factors that could trigger a breach.

“Most focus on only the obvious, the external pieces,” the Xamin executive said, adding, “Internal hardening almost always goes ignored, except for at audit time.”

Xamin scans reveal between 3,000 and 8,000 instances of vulnerabilities during onboarding. Updates to third-party software, such as Java, Acrobat and Flash, bear responsibility for 75% of the issues.

He said many organizations tell you they have proper patch management, but some of the tools they used have holes in the patching. Other vulnerabilities come from third-party hardware and a network with holes.

Credit unions also need to perform third-party audits that include a hardware and software configuration review, experts said.

“Once a year scans/audits are no longer good enough,” Gustafson advised. “Don't get laser focused on just buzz words or hot topic items. Establish a security team [internally or outsourced].”