A Better Way to Fight Cybercrime: The Consortium

Battling cybercrime in the financial services industry can be downright scary. Threat actors are continuously evolving new phishing or ransomware campaigns on banks and credit unions. Human error remains the number-one attack vector—often an unsuspecting employee who unwittingly gives a scammer the keys to your credit union. 

Today, some of the things that members and employees value most, such as online banking and mobile banking apps and the ability for employees to work from home, have added to the risk of cyberattacks. A recent report found that more than 8 in 10 credit unions have breached employee credentials that are available on the Dark Web.¹ The same report found that 4 in 10 credit unions may be vulnerable because of old technology.  

The direct cost of ransomware and reputation loss can be significant. You have three options, as I see it. Let’s count down from least optimal to best.  

Option #3 is going it alone—your credit union against the legion of hackers that get better at their trade with every passing day. 

Option #2 is hiring a group of consultants, each of whom brings piecemeal solutions, but none offers one comprehensive solution. Since you’re footing the bill alone, the cost can sometimes make you wonder whether the cure is worse than the disease.  

Option #1: A Better Way: Consortiums 

Cornerstone Resources has partnered with Blackswan Cybersecurity to offer a customized managed security service provider (MSSP) that deploys round-the-clock monitoring and remediation. It’s an option we believe offers a superior solution using what’s known as a consortium solution. Most important, it’s a way for your credit union to jump to the head of the class in cybersecurity and minimize expenses because your costs will be shared among a consortium of credit unions that receive the same service.  

Our new consortium MSSP will take an integrated approach to fighting cybercrime. You’ll get a full slate of services designed for credit unions—everything from vulnerability assessments to phishing exercises that make everyone at your credit union more aware of the risks. In addition, you’ll get architecture and configuration reviews.  

Resources’ new MSSP will ensure that if you need service or support, you’ll be able to talk to a human being any time, day or night. If you have a breach, we will be there to respond, remediate, and augment your staff, if need be. Our goal is to make your IT environment as secure and resilient as possible, so you won’t need additional vendors.  

Since we operate on the consortium model, you’ll also benefit from the experience of other credit unions. While we are intervening to address an issue at one member credit union, we’ll be protecting all other member credit unions from a similar incursion.  

So, at the same time your credit union is under the microscope of cyber criminals, it will be under our microscope too, and you’ll know exactly what’s happening on your own real-time dashboard.   

We’ll also recommend improvements based on what our cyber analysts observe in your environment, as well as those of all other consortium members. Everyone will learn from every member’s experiences.   

I’m a big believer in the cybersecurity partner we’ve found in Blackswan and in the consortium model as a way to protect against cyberattacks that will only become more frequent and damaging.  

It’s not often that you can get better service at a lower cost and learn from the experiences of your peers at the same time. Watch for more details about our new consortium MSSP.

Idrees Rafiq, Jr. is VP Information Security and Risk Management Consulting for Cornerstone Resources. He serves on the CUNA Tech Council Executive Committee and is a member of the National Credit Union-Information Sharing and Analysis Organization (NCU-ISAO) Leadership Board, faculty for Southwest CUNA Management School and Southeast CUNA Management School. Visit Cornerstone Resources for more information.

____________________

¹ Black Kite, “Credit Union Industry Risks Significant Financial Impact Due to Cybersecurity Vulnerabilities,” March 17, 2021