The FFIEC has released an update titled “Authentication and Access to Financial Institution Services and Systems.” It replaces two previously released FFIEC issued pieces: “Authentication in an Internet Banking Environment” released in 2005, and the “Supplement to Authentication in an Internet Banking Environment” released in 2011. The guidance has been expanded to include employees, third party vendors, and APIs with increased expectation in regards to controls and risk management. This update is clearly focused on an understanding of the threat landscape, having a current risk assessment, ensuring layered security, and a general increase in authentication implementation. Take a few minutes to watch Finosec President and CEO Zach Duke unpack this information.
Here are some of the key components of this guidance and some first steps on understanding how it can apply to you.
First, it is important that you have a current inventory of information systems, digital banking services, and customers. Next, you’ll want to identify which customers and users should be classified as high risk, based on transactions and role/responsibility respectively. This high-risk identification, coupled with the inventory, are a great place to start ensuring that you are on track with risk assessment best practices. Finally, these elements will also provide clear direction on how to best implement layered security, which users should have MFA enforced, and more. In short, the risk management construction will trickle down into other areas of authentication implementation.
If you would like to read this new guidance in its entirety, you can download the PDF by signing up for Finosec Academy. Simply visit https://www.finosec.academy to get signed up and find the PDF along with plenty of other updates surrounding cybersecurity. Don’t hesitate to reach out to Finosec if you have questions or concerns about this guidance!
Finosec’s User Access reporting directly addresses this guidance! To learn more simply visit https://www.finosec.com/solutions/user-access-reporting.
