RSI Helps Broker Dealers and Financial Advisors Address FINRA Cybersecurity Checklist and Mitigate Cybersecurity Risk.
In a months time broker dealer firms from around the country will descend upon Washington DC to attend the FINRA 2017 conference. Given evolving threat environments and continuing challenges of Cybersecurity controls (per FINRAs 2017 Priorities list) its certain that Cyber threats and mitigation efforts will be hot topics addressed within the keynotes and workshops scheduled throughout the week.
FINRAs Cybersecurity checklist is an excellent resource to assist companies looking to establish or augment an existing Cybersecurity program. Whether youre ready to deploy a solution or need to scope out your requirements, we recommend these due diligence steps in picking a Cybersecurity vendor.
Pick a vendor that has extensive knowledge and experience in dealing with the distinct threats and mitigation policies facing the financial sector. Assess their flexibility in designing a tailored solution for your needs that can scale with your businesss growth and (taking the hackers perspective) your potential attack surface.
Is the vendor on your short list responsive in following up on your initial query and conveys urgency and appreciation for your business? Their level of concern (or lack thereof) demonstrated early on will likely mirror their responsiveness when reacting to a breach event or a regulatory audit warning. Can they align your security needs within the broader context of IT support? Every proactive or reactive cyber mitigation measure informs IT response capability and vice-versa.
RSI can help you navigate todays turbulent Cybersecurity waters and accomplish the goals cited in FINRAs Checklist. Our security and compliance services sync 1:1 with FINRAs security best practices and we can align with your security requirements as well.
Section 1 – Identify and Assess Risks – Inventory
Identify and analyze potential dangers or risks to a firm’s business that could arise through its information technology systems.
RSI Capability – IT Assets & Infrastructure Assessments
Regular review of your organization’s existing IT infrastructure helps you identify areas of improvement, allowing for more informed and strategic business decisions to take place. Our IT Assets and infrastructure assessment analysis identifies, quantifies and prioritizes all potential hazards that might affect your systems.
Section 2 – Identify and Assess Risks – Minimize Use
Limit Personally Identifiable Information (PII) collections to the least amount necessary to conduct its mission; the organization may limit potential negative consequences in the event of a data breach involving PII.
RSI Capability – PII Security Assessment
Our PII data security assessment includes automated scan for PII, interviews and security reviews of network security, and vulnerability assessment scan. We also assess the security controls supporting PII storage and transmission as well as results of current network and penetration tests.
Section 3 – Identify and Assess Risks – Third Party
Firms should manage Cybersecurity risk that can arise across the lifecycle of vendor relationships using a risk-based approach to vendor management.
RSI Capability – 3rd party vendor security assessment
We can help you implement a 3rd party vendor security assessment program and tools with proven methodology.
Section 4 – Protect – Information Assets
Organizations should have robust malware incident handling capabilities to limit the damage that malware can cause and restore data and services efficiently.
RSI Capability – Robust Cyber Defenses and 24×7 Malware Monitoring Services
Your networks & computers are protected from attack, damage or unauthorized access via our threat correlation analyses, holistic application security, self-sealing BYOD protection, advanced anti-malware and more by our 24×7 Security Operations Center (SOC)
Section 5 – Protect – System Assets
Identify and maintain an inventory of assets authorized to access the firms network and critical assets that should be accorded prioritized protection.
RSI Capability – Identity Access Management (IAM) and Authorized Asset Identification
Our Identity Access Management (IAM) services provide control and protocols for managing cyber security. We have tools that capture, track, and compare a clients Cybersecurity asset inventory with their risk tolerance for clients of any size company.
Section 6 – Protect – Encryption
Encryption protects the confidentiality of data by ensuring that only approved users can view the data. Other benefits include providing a means for ensuring information integrity and non-repudiation.
RSI Capability – Managed Encryption Services
We offer managed full disk encryption solutions that will install encryption and monitor your systems, giving you peace of mind that a trusted vendor partner has the ability to remotely lock, reset or “kill” the device in the event of loss or theft.
Section 7 – Protect – Employees Devices
Establish, implement, and actively manage the security configuration of laptops, servers, and workstations using a rigorous configuration management and change control process to prevent attackers from exploiting vulnerable services and settings.
RSI Capability – Managed Endpoint Services
All the managed devices connected to your network are deployed with an award-winning agent that orchestrates the monitoring and management of policy-based hardening & security auto-configuration, offering comprehensive coverage against a vast spectrum of threats.
Section 8 – Protect- Controls and Staff Training
Firms should provide cybersecurity training to determine where the skill gaps and points of risk exposure exist, and develop and deliver training in those areas.
RSI Capability – Deep, Wide, & Up to Date Training as a Vital Security Component
To protect the confidentiality, integrity, and availability of your systems, we’ve designed comprehensive on-line training programs for your employees as well as external vendors. We counter cyber-specific and cyber-enabled threat vectors every day and that field experience informs our training & security protocols.
Section 9 – Detect – Penetration Testing
Penetration testing is security testing in which assessors mimic real-world attacks to identify methods for circumventing the security features of an application, system, or network.
RSI Capability – Penetration Testing Services
RSI can simulate real-world attacks to assess our client’s external applications, network, and mobile applications vulnerabilities in addition to running independent, automated security scans encompassing the Open Web Application Security Project (OWASP) Top 10 vulnerabilities. Our network level penetration test reveals system vulnerabilities that can be easily exploited by real world attackers.
Section 10 – Detect – Intrusion
Organizations should deploy Intrusion Detection and Prevention Systems (IDPS) to identify possible incidents, log information about them, attempt to stop them, and report them to security administrators.
RSI Capability – Right Sized Intrusion Detection & Prevention Solutions
We work closely with clients to understand the risk and implement an optimal Intrusion Detection & Prevention System for their needs for all business sizes ranging from cost effective software-based IDS to enterprise-grade appliances.
Section 11 – Response Plan
Firms should establish policies and procedures, as well as roles and responsibilities for escalating and responding to Cybersecurity incidents to limit damage, assure external stakeholders, and reduce recovery time and costs.
RSI Capability – Managed Incident Response
Rely on our emergency response team to provide on-site and remote investigation of incidents, forensic analysis mitigating the impact of attacks and restoring business.
Section 12 – Recovery
Organizations should have policies in place to Contain & Eradicate Cyber threats and be able to deploy a rapid Recovery plan in the event of a breach.
RSI Capability – Thorough Containment & Rapid Disaster Recovery Services
We respond to Cybersecurity incidents with a complete suite of Data Forensics and Incident Response (DFIR) services, quickly containing a breach, limiting exposure, stemming losses and preserving evidence while executing on business continuity and disaster recovery plan.
About the Author
Download Our Cybersecurity Checklist
Prevent costly and reputation damaging breaches by implementing cybersecurity best practices. Get started with our checklist today. Upon filling out this brief form you will receive the checklist via email.