Financial Industry Compliance: Part 2, the FFIEC Information Security Handbook

by Val Hetrick, Fiberlink

In our previous post we surveyed several regulations and standards with provisions that apply specifically to endpoints.

We also noted that some of these included general guidelines such as “protecting against foreseeable risks” that might be challenging to pin down. What standards can financial firms use to address such vague requirements?

Here we will look at one source of guidance on financial industry best practices, the Information Security Handbook from the Federal Financial Institutions Examination Council (FFIEC).

This document can be downloaded at: http://www.ffiec.gov/ffiecinfobase/booklets/information_security/information_security.pdf

Patch Management

The FFIEC Information Security Handbook suggests that financial firms must “update operating systems with security patches and using appropriate change control mechanisms” and “Appropriately and in a timely manner patch, update, and maintain all software…” It also recommends a comprehensive patch management process, including processes to monitor vulnerabilities, prioritize and test patches, plan a rollout, and create an audit trail of all changes.

Configuration Management of Remote Endpoints

The FFIEC authors highlight the importance of protecting the integrity of remote devices. They specifically recommend that organizations “Appropriately configure remote access devices,” “Periodically audit… access device configurations and patch levels,” and highlight the importance of “Monitoring host and network condition to identify unauthorized configuration and other conditions which increase the risk of intrusion or other security events.”

Securing Remote Access Devices Against Malware

The FFIEC handbook insists that it is particularly important to “Appropriately secure remote access devices against malware” and to keep anti-virus definitions up to date. Also, to ensure that technical safeguards remain in place, organizations should have “Integrity checking software, combined with strict change controls and configuration management.”

Encryption

The FFIEC authors strongly emphasize the importance of encryption of both data stored on devices (data at rest) and data transmitted over wireless networks (data in motion).

Logging and Monitoring Remote Access Communications

The FFIEC handbook repeatedly emphasizes the importance of continually monitoring events in the environment. For wireless devices, it specifically suggests that financial firms “Log remote access communications, analyze them in a timely manner, and follow up on anomalies.”  It also recommends that firms:  “Log and monitor the date, time, user, user location, duration, and purpose for all remote access.”

Network Access Controls

The FFIEC authors recommend that for sensitive communications with remote devices financial organizations “Restrict the use of the access device by policy and configuration” and “Ascertain the trustworthiness of the access device before granting access [to corporate networks].”