of allowing credentials (for example, an account that “shared” “admin” multiple people use), enforcing strong password requirements, etc. Review user access periodically for all systems and applications based on the risk to the application or system. Submit to the president of the credit union requests for changes to physical and logical user access, including those that result from voluntary and involuntary terminations. Have such changes approved by the president. Require and manage identification and authentication for access to systems, applications, and hardware. Provide that access controls include password complexity and limits to password attempts and reuse. Change all default passwords and unnecessary default accounts before system implementation. Require multi-factor authentication for members when accessing products or services. Use physical security controls to prevent unauthorized access to information systems and telecommunication systems. Encrypt all passwords in storage and in transit. Encrypt confidential data when transmitted across public or untrusted networks (e.g., Internet). Encrypt mobile devices (e.g., laptops, tablets, and removable media) that store confidential data. Use encrypted connections and multifactor authentication for remote access to critical systems by employees, contractors, and third parties. Put into place administrative, physical, or technical controls to prevent users without administrative responsibilities from installing unauthorized software. Utilize formal procedures to authenticate customers who request customer service (e.g., the call center). The controls required will vary depending on the risk of the transaction or request (wire transfer requests will have greater controls than a balance inquiry). Dispose of or destroy data according to documented requirements and within expected time frames. Restrict the use of removable media (removable hard drives, flash drives, etc.) to authorized personnel. Conduct independent testing (including penetration testing and vulnerability scanning) according to the risk assessment for external- facing systems and the internal network. Use antivirus and anti-malware tools to detect attacks. Audit or verify firewall rules at least quarterly. Use e-mail protection mechanisms to filter for common cyber threats (e.g., attached malware or malicious links). Monitor the environment for anomalous activities. Monitor and review customer activity that generates anomalous activity alerts. Review logs of physical and/or logical access following events.
of allowing “shared” credentials (for example, an “admin” account that multiple people use), enforcing strong password requirements, etc. Review user access periodically for all systems and applications based on the risk to the application or system. Submit to the president of the credit union requests for changes to physical and logical user access, including those that result from voluntary and involuntary terminations. Have such changes approved by the president. Require and manage identification and authentication for access to systems, applications, and hardware. Provide that access controls include password complexity and limits to password attempts and reuse. Change all default passwords and unnecessary default accounts before system implementation. Require multi-factor authentication for members when accessing products or services. Use physical security controls to prevent unauthorized access to information systems and telecommunication systems. Encrypt all passwords in storage and in transit. Encrypt confidential data when transmitted across public or untrusted networks (e.g., Internet). Encrypt mobile devices (e.g., laptops, tablets, and removable media) that store confidential data. Use encrypted connections and multifactor authentication for remote access to critical systems by employees, contractors, and third parties. Put into place administrative, physical, or technical controls to prevent users without administrative responsibilities from installing unauthorized software. Utilize formal procedures to authenticate customers who request customer service (e.g., the call center). The controls required will vary depending on the risk of the transaction or request (wire transfer requests will have greater controls than a balance inquiry). Dispose of or destroy data according to documented requirements and within expected time frames. Restrict the use of removable media (removable hard drives, flash drives, etc.) to authorized personnel. Conduct independent testing (including penetration testing and vulnerability scanning) according to the risk assessment for external- facing systems and the internal network. Use antivirus and anti-malware tools to detect attacks. Audit or verify firewall rules at least quarterly. Use e-mail protection mechanisms to filter for common cyber threats (e.g., attached malware or malicious links). Monitor the environment for anomalous activities. Monitor and review customer activity that generates anomalous activity alerts. Review logs of physical and/or logical access following events.
detailed%20Cybersecurity%20program%202.docx