Are you confident that your bank has clear and thorough visibility to every employee’s physical and digital access to systems? If you’re like most banks we work with, the answer to this question is “no”. There are many challenges that make tracking employee access difficult; changes in management, employee promotions or terminations, and manual process to name a few.
In fact, one of the most common audit findings our customers have cited are terminated employees who retain access after they’ve left the organization. Understanding User Access Reviews and the landscape surrounding them is one of the cornerstones to a robust IT security and oversight process.
Examiner Expectations
In banking technology landscape, managing system access for every employee and understanding the regulatory expectations outlined in the FFIEC Authentication Guidance is crucial. As our previous blog Integrating FFIEC Authentication Guidance: A Blueprint for Your Next Exam With Insights from Recent Regulatory Actions, highlights the clear expectations examiners have coming into your institution. Aligning your practices with this guidance is necessary to avoid unnecessary or avoidable findings on exams.
EXPERT INSIGHT
“Compliance with FFIEC Authentication Guidance is not just a regulatory necessity; it’s a strategic advantage for any financial institution,” says Scott McIlrath, Finosec CTO & Former Bank ISO
Addressing Shadow IT
Unapproved software and systems, known as shadow IT, pose significant risks to your organization. Maintaining a detailed system inventory helps mitigate these risks by tracking all applications, their users, and associated risks. Regular audits, clear policies, and monitoring tools are essential. For a deeper dive into the risks posed by Shadow IT, you can read our blog: The Hidden Risks of Shadow IT: Why Community Banks Need a Detailed System Inventory.
Ensuring robust cybersecurity and effective governance is only possible by understanding every system that employees use. This helps maintain security, compliance, and operational efficiency.
The Critical Foundation of an Information Security Program
The most important step in effective information security is having a comprehensive system inventory. This includes two main components:
- Identification of Systems: Documenting every system that employees use and
- Authentication Management: Ensuring all systems with logins are tracked and reviewed.
Challenges and Solutions
Many community banks struggle with incomplete documentation for all systems and employees and managing permissions for the systems. Ensuring systems have appropriate access, controls, and access is managed to the principle of least privilege.
Benefits of a System Inventory
Among the benefits of maintaining a system inventory are:
- Reduced Risk of Shadow IT: Managers help uncover unapproved systems and help take them through the proper approval and documentation process, thus avoiding having employees with access that elevates risk to your institution.
- Audit Preparedness: Easier to remove access for terminated employees, preventing unauthorized access.
- Enhanced Security: Effective tracking of all systems, especially in a cloud environment.
Steps to Implement a System Inventory
To address these challenges, implementing a detailed system inventory and approval process begins with three steps:
- Document All Systems: Record all systems and logins used by employees.
- Approval Process: Have managers approve systems used by their employees.
- Access Reviews: Conduct regular user access reviews to ensure compliance
Conclusion
Creating a system inventory and approval process enhances security and prepares institutions for audits and regulatory compliance. Knowing every system for every employee ensures a more secure and efficient IT environment.
