Then in May, the FDIC reported to Congress that five additional, major data breach incidents occurred since October 2015. In every case, employees with legitimate data access left the agency and inadvertently downloaded personal data. The agency retroactively reported the breaches, claiming the FDIC closed the cases before its Office of Inspector General defined them as major incidents. A major incident involves at least 10,000 records.

Join us in Dallas at the new Credit Union Times Fraud: Don't Let It Happen To Your Credit Union Conference, where you will find the latest tools and techniques for preventing fraud and data breaches; strategies for responding in the immediate aftermath and best practices for restoring reputation, financial stability and information security. This two-day conference is designed for credit union executives, board of directors and those responsible for your credit unions cyber security policy. Register to attend and save $150.

“An effective FDIC information security and privacy program is critical to our mission of maintaining stability and public confidence in the nation's financial system,” FDIC Chairman Martin J. Gruenberg said in a statement before the Committee on Science, Space and Technology.

KnowBe4 Founder and CEO Stu Sjouwerman explained, “Most of these are incidents where employees copied sensitive information to a portable device and walked out the door. That's covered by security policy and procedures, and simple technical controls that block USB ports from being used on workstations.”

The OIG audit identified several weaknesses that the FDIC needed to address and made several recommendations to improve its security, including an insider threat program, which better enables the FDIC to deter, detect and mitigate the risks posed by the employee. In addition, the OIG reported a key control intended to prevent the copying of sensitive resolution plans to removable media did not function properly.

“While the FDIC investigation report is alarming, it's not surprising,” J. Paul Haynes, CEO of cybersecurity firm eSentire, said. “The breach cases at the root of the cybersecurity posture investigation pertain to insider threat, which is a long-standing risk, as employees do things, such as copy and remove sensitive client personally identifiable information, usually when exiting employment.”

The OIG did make clear the FDIC has a number of long-standing controls designed to mitigate risks associated with trusted insiders, including background investigations, periodic inspections of FDIC facilities to identify security concerns, employee nondisclosure agreements, a data loss prevention tool and programs to help employees with personal issues.

“We concur with the OIG's findings and recommendations, and expect to complete implementation of all of our responsive actions by the end of 2016,” Gruenberg said. “Our expectation is that by taking the steps outlined we will be effective in significantly minimizing the potential for similar incidents going forward.”

The FDIC also discontinued individuals' ability to copy information to removable media to prevent these types of incidents from occurring in the future.

“In the case of the FDIC, enacting, monitoring and enforcing policies around insider threat are critically important to stemming these kinds of breach incidents. The FDIC was able to track and reclaim the data, but in similar circumstances many other firms aren't as successful and suffer significant client data leaks as a result, often detected months after the fact.” Haynes added.

Join us in Dallas at the new Credit Union Times Fraud: Don't Let It Happen To Your Credit Union Conference, where you will find the latest tools and techniques for preventing fraud and data breaches; strategies for responding in the immediate aftermath and best practices for restoring reputation, financial stability and information security. This two-day conference is designed for credit union executives, board of directors and those responsible for your credit unions cyber security policy. Register to attend and save $150.