During his on-site testing jobs, Stickley often dressed up as an individual who is known to be trustworthy, such as a fire inspector. About four years ago, he said, he and a colleague gained access to a financial institution branch by pretending they were air conditioner repairmen. Unfortunately, the institution's security failed big time, as they managed to steal its backup server without any problem.

“We literally unplugged it from the wall and carried it out the door,” he said. “Employees were watching me, and no one said a word. One employee was outside in her car – we always had someone waiting outside when we stole stuff so we wouldn't go too far away with their property – and the look on her face was of sheer terror.”

While Stickley said he has seen a distinct improvement in employees' awareness of potential threats since he began his career, financial institutions are still at great risk of being hacked and are typically only as strong as their weakest link.

“Nowadays, if someone really focuses on your organization, it's not a matter of if you're going to get hacked, it's a matter of when,” he said. “It's like a terrorist. All you need is one terrorist to carry out an attack, and all you need is one employee to make a mistake.”

As a security tester, Stickley spent the majority of his time hacking into companies' systems remotely. One tactic that often tricked users was the bogus e-card, he said. He also entered facilities and installed keyboard loggers to access information at a later time, and physically stole items such as servers, drives, documents, phones and laptops.

What prevented many organizations from keeping their information safe, he discovered, was a lack of adequate employee education. So, two years ago, he founded Stickley on Security with the goal of addressing that very issue. Through its SOS Advisor, SOS Executive and Employee EDU solutions, his firm helps organizations and their customers, executive teams and employees stay informed of and prepared to combat the latest threats.

“One thing that frustrates me the most is the shifting of security budgets to products, when the main problem is education,” he said.

Many organizations, he said, tend to host one-day security training sessions for their employees once or twice a year; however, this strategy is not effective enough to fight fraud and identity theft. Instead, Stickley recommends scheduling quarterly training sessions in addition to deploying two to three emails per week that inform employees of the latest threats.

An organization's website is also an important tool for providing fraud and identity theft education to customers or members. Stickley said it's important to keep this portion of a website simple by focusing on three key points – what the risk is, how it can affect customers or members, and what they can do to fight it – as opposed to publishing “doom and gloom” content.

When asked what he thinks are the biggest threats credit unions face today, Stickley said scams that originate via email top the list. He said he even favors banning all email traffic from outside the credit union if possible. Web browsing poses another huge risk, he said, as cybercriminals have begun to use online advertisements as a front for malware.

In addition to running his education-focused security firm, Stickley serves on several corporate boards and appears as a speaker for corporations, security-related conferences, seminars and forums, covering topics that range from basic identity theft to national cyber terrorism. He's also shared his security insights as a guest on numerous national television shows, including NBC's “Nightly News” and the “Today Show,” CNN's “NewsNight,” CNBC's “The Big Idea” and Anderson Cooper's “Anderson.”

For CU Times' virtual cybersecurity conference, he'll be delivering the opening keynote, “Know Your Vulnerabilities: Credit Unions Are Only as Secure as Their Weakest Links,” which will cover data breach trends, how to beef up security measures to stand up to the latest cybercrimes and how to educate employees at every level of the credit union to actively prevent attacks.

CU Times' free virtual cybersecurity conference, “Data Breach Defense,” runs from 10 a.m. to 5 p.m. ET on Tuesday, Oct. 6. To register, visit CUTimes.com/DataBreachDefenseConference.