Back to Blog

Why You Need to Know Every System for Every Employee

By Zach Duke

July 23, 2024

Get notified on new insights from Finosec now!

Be the first to know about new Finosec blogs to grow your knowledge of the cybersecurity governance industry today!

Are you confident that your bank has clear and thorough visibility to every employee’s physical and digital access to systems? If you’re like most banks we work with, the answer to this question is “no”. There are many challenges that make tracking employee access difficult; changes in management, employee promotions or terminations, and manual process to name a few.

In fact, one of the most common audit findings our customers have cited are terminated employees who retain access after they’ve left the organization. Understanding User Access Reviews and the landscape surrounding them is one of the cornerstones to a robust IT security and oversight process.

Examiner Expectations

In banking technology landscape, managing system access for every employee and understanding the regulatory expectations outlined in the FFIEC Authentication Guidance is crucial. As our previous blog Integrating FFIEC Authentication Guidance: A Blueprint for Your Next Exam With Insights from Recent Regulatory Actions, highlights the clear expectations examiners have coming into your institution. Aligning your practices with this guidance is necessary to avoid unnecessary or avoidable findings on exams.

Addressing Shadow IT

Unapproved software and systems, known as shadow IT, pose significant risks to your organization. Maintaining a detailed system inventory helps mitigate these risks by tracking all applications, their users, and associated risks. Regular audits, clear policies, and monitoring tools are essential. For a deeper dive into the risks posed by Shadow IT, you can read our blog: The Hidden Risks of Shadow IT: Why Community Banks Need a Detailed System Inventory.

Ensuring robust cybersecurity and effective governance is only possible by understanding every system that employees use. This helps maintain security, compliance, and operational efficiency.

The Critical Foundation of an Information Security Program

The most important step in effective information security is having a comprehensive system inventory. This includes two main components:

  • Identification of Systems: Documenting every system that employees use and
  • Authentication Management: Ensuring all systems with logins are tracked and reviewed.

Challenges and Solutions

Many community banks struggle with incomplete documentation for all systems and employees and managing permissions for the systems. Ensuring systems have appropriate access, controls, and access is managed to the principle of least privilege. 

Benefits of a System Inventory

Among the benefits of maintaining a system inventory are:

  • Reduced Risk of Shadow IT: Managers help uncover unapproved systems and help take them through the proper approval and documentation process, thus avoiding having employees with access that elevates risk to your institution.
  • Audit Preparedness: Easier to remove access for terminated employees, preventing unauthorized access.
  • Enhanced Security: Effective tracking of all systems, especially in a cloud environment.

Steps to Implement a System Inventory

To address these challenges, implementing a detailed system inventory and approval process begins with three steps:

  1. Document All Systems: Record all systems and logins used by employees.
  2. Approval Process: Have managers approve systems used by their employees.
  3. Access Reviews: Conduct regular user access reviews to ensure compliance

Conclusion

Creating a system inventory and approval process enhances security and prepares institutions for audits and regulatory compliance. Knowing every system for every employee ensures a more secure and efficient IT environment.

More from Finosec

The Critical Foundation of Managing Access to Banking Systems

The Critical Foundation of Managing Access to Banking Systems

Managing access to banking systems has become increasingly complex as financial institutions navigate legacy reporting systems, API access, and cloud solutions. These challenges, along with the risks posed by unmanaged systems, emphasize the need for maintaining a...

Talk To An Expert Now
Talk To An Expert Now 770.268.2765