Despite these challenges, there are some steps that credit unions can act on immediately to enhance their level of security, without overstretching their resources or skimping on the services that today's members demand.

To accomplish this, credit unions should first leverage the FFIEC's Cybersecurity Assessment Tool to determine their risk profile and cybersecurity maturity level. The NCUA adopted the FFIEC CAT to ensure all credit unions meet proper cybersecurity standards. The first part of the assessment evaluates a credit union's risk profile based on several factors, including its technologies and connection types, delivery channels and online or mobile products. Characteristics like the number of internet service providers used, third-party connections, wireless access, which products and services are available through online or mobile delivery channels, and the credit union's overall IT environment all impact its inherent risk profile.

Once the risk profile is determined, the credit union can then use the FFIEC CAT to evaluate its overall cybersecurity maturity level and assess its current state of cybersecurity preparedness. By evaluating its risk profile and maturity level, the credit union can determine whether its maturity levels are appropriate according to its risk exposure. Based on this assessment, any security gaps within the network can be identified and remediated.

In addition to the FFIEC CAT, it is advised that credit unions conduct an internal penetration test to verify that applications, networks, systems and even employees are not vulnerable to a security lapse that would enable unauthorized access to sensitive data. An internal penetration test will also be useful in evaluating how credit union employees respond to breach attempts.

According to PwC's "2016 Global State of Information Security" report, employees are the cause for 34% of data breaches. By testing how employees respond to breach attempts, the credit union can develop an employee training program and teach staff best practices for handling sensitive information and safeguarding the network. Staff training is just one facet of a strong security program. Reviewing common techniques used by cyber criminals, including social engineering and phishing scams, can significantly lower the risk and cost of a data breach.

Furthermore, implementing an organized incident response plan can mitigate the risk and impact of a breach. In fact, Ponemon's "Cost of a Data Breach" report revealed that having an incident response team can reduce the average cost of a stolen record from $221 to $195.20. While the savings may not seem substantial, it can make a difference when thousands of records are stolen. Credit unions must operate with the mindset that a data breach is inevitable, so when a breach does occur, the credit union has an incident response plan already in place that the team has practiced and is ready to act on. Ultimately, the faster a credit union can identify and contain a breach, the lower the monetary loss and reputational damage.

A strong cybersecurity strategy also requires real-time intelligence about the latest cybercrime tools and tactics. While traditional attacks, like phishing emails and ransomware, are still used, cyber criminals evolve their tactics to bypass new security measures. One new attack method is called cross-site scripting and works against all operating systems, servers and browsers. Attackers convince a user to open a hyperlink with malicious data, whether via email, instant message or through a website. The hyperlink directs the user to a trusted website, but the attacker formats the hyperlink so that malicious data is written as code inside the website where harmless data would typically go. These attacks can be highly damaging because they do not require stealing a user's login credentials. Instead, they take advantage of the user that is already logged in to hack the account. This is also difficult to detect because the user is visiting a trusted website. By sharing intelligence about these emerging attack vectors among other institutions, regulators and infrastructure providers, the frequency, magnitude and consequences of a data breach can be reduced.

While it may seem as though credit unions have the odds stacked against them when combatting cybercrime, the FFIEC CAT provides a solid foundation for credit unions to build a strong cybersecurity program. By leveraging the assessment, credit unions can determine their risks and vulnerabilities, unique to their organization and service offerings. From there, initiatives such as employee education and proper cybersecurity protocols can be established and reviewed regularly to maintain a high level of security. This proactive approach to cybersecurity will allow credit unions to focus on providing innovative services that their members want without taking on undue risk.

Bob Thibodeaux is CISO for DefenseStorm. He can be reached at [email protected].