Historically, security teams have put measures in place to safeguard applications. Today, however, the focus should be on member and credit union data, both of which are considered to be a credit union's crown jewels. To achieve this, credit unions need to make data protection a higher priority in overall operational effectiveness.

Collaboration Boosts Critical Insight

Because security and IT teams are small and focused on keeping the credit union infrastructure running, many have no time to mine the terabytes of data they are collecting to find actionable insights. Often, these teams find it challenging to keep up with developments in the security industry, let alone with happenings at peer organizations. Such practices often leave credit unions operating in vacuums.

To help improve best practices and maximize resources, credit unions should begin sharing data and information so multiple parties can benefit. For example, if a nearby credit union has faced a physical threat, another can be alerted to be on the lookout for similar activity and prepare for it. Information sharing can be very helpful when it comes to formulating strategy.

Credit unions can also collaborate and share information regarding regulatory assessments, which not only helps inform what the regulatory body is looking for but can also help shape future policies.

Create a Three-year Cyber Security Plan

Creating a near-future security plan does not have to be a drawn-out process, nor does it have to be overly complicated. It is more important to put security measures in place quickly rather than endlessly talking about them. Here are a few steps to take to get started:

1. If your credit union does not have an Information Security Officer, find one. After you have an ISO in place, document and gain approval for a written information security plan.
2. Create a cyber security strategy linked to your credit union's business model. The CEO's business goal is to run a financially sound operation. Support that goal by learning how to speak in business terms and articulating why items are of importance to business resilience. Target security spending where it will have the biggest impact (e.g., patch-automation systems and incident-response applications).
3. Redouble efforts to secure mission-critical assets. Decide which assets cannot afford to be breached, and dedicate more resources there. Make sure databases and file cabinets are very difficult to reach and breach.
4. Improve the organizational effectiveness of your security structure. Give your security leader a more direct role in recommending and justifying spending proposals. Also, promote greater collaboration between security and operations teams, removing conflicting priorities. Make sure new products and programs are reviewed by the ISO and security team.
5. Develop an enterprisewide plan to enhance a culture of security. Ideally, you want to see people within your credit union start "doing" security rather than just talking about it. Look for ways to make it fun. For example, host a lunch and learn with FBI agents to teach employees how to recognize the signs that fraud might be occurring. 
6. Shift thinking from safeguarding applications to securing the data itself. The ultimate goal of cyber thieves is to steal credit card numbers, customer information, intellectual property and other valuable corporate data, so make sure it is protected.

Conclusion

The recent Equifax security breach left many consumers — and perhaps your credit union's executive team and board — questioning the strength of the security measures being deployed by their banks and credit unions. Now is the time to not only reassure them your credit union has a good, strong system in place but that you are also looking ahead to make sure it remains strong and can face and thwart future problems.

For more information, please visit pscu.com