Back to Blog

Why User Access

By Finosec

January 20, 2022

Get notified on new insights from Finosec now!

Be the first to know about new Finosec blogs to grow your knowledge of the cybersecurity governance industry today!

Threats to your cybersecurity and information security programs are not just external. In fact, 60% of security breaches are internal threats. The weakest component in your cybersecurity posture will always inherently be the human link.

Breaches are not primarily because of malicious activity, and an internal threat may materialize due to: 

  1. Ignorant actions performed by a user’s during the course of a normal business day 
  2. Terminated employees who still have access to the system 
  3. Disgruntled active or terminated employees 
  4. An inactive or dormant is not removed from a system 
  5. Collusion – peer-to-peer sharing – such as an employee sharing login information with another employee 

 Managing to least privilege is vital to ensure that you mitigate the element of human error whenever possible. Using Memopost as an example, an employee with access to memopost could manipulate financial data and transfer money for personal gain. Likewise, an employee with access to change deposit and loan rates could either raise or lower rates. Worse still, an employee with system specification access could wreak havoc on the entire core system. A business can minimize risk by performing periodic reviews on users’ rights to an institution’s network as well as systems, either internal or cloud based. The rules to follow when settings up permissions for a user are: 

  1. Least privilege – a user is granted access only to the data they need to perform their job 
  2. Separation of duties – intended to prevent internal system conflicts and reduce the risk of unauthorized access 
  3. Need to know – based on the least amount of information a user needs to see or share to perform their job 

If you have questions about how this works or would just like to learn more about User Access reporting, be sure to join Finosec Academy, an ever growing community of people just like you who want to stay at the forefront of the cybersecurity industry. We hope to see you there!

Interested in having Finosec come alongside you and your institution to help simplify cybersecurity or have questions about User Access reporting? Visit our User Access Page and request a call to set up a meeting with our Finosec team. 

More from Finosec

Integrating FFIEC Authentication Guidance: A Blueprint for Your Next Exam With Insights from Recent Regulatory Actions

Integrating FFIEC Authentication Guidance: A Blueprint for Your Next Exam With Insights from Recent Regulatory Actions

The Federal Financial Institutions Examination Council (FFIEC) Authentication Guidance update in August 2021 has marked a significant step towards enhancing authentication and security access measures within financial institutions. This update expanded upon previous handbooks from 2005 and 2011, emphasizing a broader scope that now includes employees, third-party vendors, and system-to-system communications via APIs.

The Best Defense Against Ransomware

The Best Defense Against Ransomware

Beth Sumner, our VP of Customer Success, recently had the opportunity to discuss ransomware attacks and the importance of community bankers staying vigilant against these crimes in Independent Banker.  While the number of ransomware attacks continues to increase, so do the sums demanded by the attackers.

Succession Planning: Essential for Sustaining Information Security

Succession Planning: Essential for Sustaining Information Security

In today’s world where cyber threats evolve rapidly, the challenge of replacing an Information Security Officer (ISO) underscores a critical issue: the cybersecurity job market is scorching, yet talent is scarce. This gap has turned recruitment into a high-stakes game for financial institutions, where the departure of an ISO exposes vulnerabilities and regulatory risks. With remote work expanding the competition for skilled professionals, the importance of strategic succession planning has never been more acute, ensuring that institutions remain fortified even in the face of staffing changes.

Partnering for Peace of Mind and Effective Oversight

Partnering for Peace of Mind and Effective Oversight

Pendleton Community Bank, a $700 Million Dollar Bank with 133 Employees in Franklin, WV, led by CEO Bill Loving, faced a critical challenge when their Information Security Officer departed, leaving a significant void in their oversight capabilities. Their goal was clear: establish an effective process for information security governance and cybersecurity oversight to ensure compliance and peace of mind.

Talk To An Expert Now
Talk To An Expert Now 770.268.2765