This podcast is brought to you by bankinfosecurity.com. Bankinfosecurity.com is your source for the news and views, shaping security and risk management within the finance space. Now that the FFIC guidance is official, how different is the final draft from the draft we saw circulated in December, and if changes between the two versions do exist, what does that mean for financial institutions that have already made strides to initiate compliance? Hi, I'm Tracy Kidn with Information Security Media Group.
I'm here today with Julie McNally, a financial fraud analyst with ITay Group, who shares her first impressions about the new guidance. Julie, given that the guidance was just issue today, none of us has had a great deal of time to pour over too many of the details. But it does seem from a quick overview that I've done that regulators have provided more details about layered security, as well as device identification. Did you feel the same way?
And if so, could you explain a little bit about some of the differences you see there, as well as some of the other things that stand out when you compare the two documents? Yes, looking at the two documents, layered security seems to have received the most attention in the six month timeframe that has passed since the preliminary guidance was released to the final guidance. And I think that that's critical, because that really was a cornerstone of this guidance and its improvements over the 2005 guidance. They provided a much more detailed explanation of what constitutes layered security and some recommendations of what types of technologies constitute a layered security approach.
But frankly, I was a little surprised that we have had over six months since the preliminary guidance was leaked. And comparing the two versions, apart from the changes to the layered security section, and a change in which a recommendation that institutions consider multi-factor authentication was moved from the retail banking section to the business banking section, which makes much more sense there, there's been remarkably few changes between the two copies, and it seems like this shouldn't have taken six months to finalize. And so when we think about maybe some of the changes that could have been included, one of the things that we noted earlier was the omission of any reference to mobile. Do you feel that mobile is still something that the regulators probably should have broached?
You know, I absolutely think that it's something that they should have broached more directly. Specifically, when you consider that the final guidance actually states the 2005 guidance's definition of high risk transactions remains unchanged. That is, electronic transactions involving access to customer information or the movement of funds to other parties. So by that definition, mobile could be interpreted to be encompassed within this guidance, although the entirety of the guidance from then on just refers to the online channel.
And while some of the mitigation techniques that they refer to are equally applicable between the two channels, some of them are not applicable to the mobile channel. So I think that this actually creates confusion, and that's something that they're going to need to address very soon. And what about the fact that this guidance is going to take effect in January? Does it seem like a relatively short timeline for institutions?
It's a very short timeline, particularly when you take into account the fact that hitting mid-October to early November, we're going to be hitting banks' lease periods. And so this does not give banks much credit unions, much time at all, to require technology in place. I think that we'll potentially see banks lobbying for an extension to that, because it's just not a feasible timeframe. And do you think, though, in defense of the regulators, that perhaps their perception as well, this guidance has been out there in draft form for several months, and perhaps they're assuming that institutions have already begun to move forward with steps to comply?
Well, I don't think that that's a fair assumption, since there's been no indication that the final draft was going to be consistent with the preliminary draft. Now, it's been my position for a while that banks should be in credit unions should be going down this path anyway, just because of the threat environment. And I think a lot of institutions, particularly the larger ones, already have a lot of this stuff in place. But for those that don't have this in place, you know, essentially having three to four months to deploy technology to open and compliance, just isn't reasonable.
And so what advice can you offer, Julie, to financial institutions who are downloading this and taking a look at it and doing a comparison between what they've implemented and what the new guidelines are calling for, and looking at this compliance deadline of January 2012, what steps should they be taking? What does this mean? Well, the first thing that they will be doing is mapping, because what does the guidance say that we have to have versus what do we have today? What is the delta?
How do we address the delta in the next three or four months? So we'll be seeing a lot of resources deployed against that. I think we'll also be seeing folks contacting whatever lobbying organization that they belong to, to communicate to the regulators that, you know, just based on business practices and financial services, a six-month window is not reasonable and that this deadline should be extended a few months. It doesn't have to be a year, but just enough time to get past those winter freezes and to get the requisite technology deployed.
Overall, I think that this guidance is a big improvement over what we had out there, the 2005 guidance, it has a lot more prescriptive recommendations, and for those institutions that didn't have these protections deployed, it will help them put in place a technology environment and a policy-based environment that can help defend them against the very real threats that are out there, particularly in the whole Silicon Channel. And what about the role that vendors might play here? Julie, we've heard a lot from the vendor community about steps that they think institutions should take. How much can institutions lean on the vendors or look to them to help push along some of this since they do have a short timeline to work with?
The vendor community can be very helpful in this. This is their bread and butter and to the extent that they can bring to their technologies, can share information about how their technologies can contribute to a layered approach. Yeah, I think vendors or institutions can really rely on the vendors expertise. Some vendors will have point solutions, some will have a more complete range of solutions that can help address the layered approach, and the institutions just really have to understand how those solutions map into the threat vectors to determine what layers are appropriate.
You want to make sure that you're not deploying redundant layers and leaving a glaring hole in the threat environment that you're exposed to because you haven't deployed the right layers. Is there anything else, Julie, that you'd like to share about the guidance as it relates to authentication or any of the things that we've talked about in the past? At first glance, again, I think that it lists the appropriate technologies that should be considered the appropriate policy-based approaches that should be considered. The large financial institutions have a lot of this stuff already, but this will help bolster some of the smaller institutions that we're maybe waiting on this guidance before pulling the trigger.
Right. I'd like to thank you for your time again today, Julie. Thank you, Tracy. Again, we've just heard from Julie McNelly of ITay Group.
For information security media group, I'm Tracy McNally. This podcast has been brought to you by bankinfosecurity.com. For more interviews, breaking news, research, and educational webinars, please visit www.bankinfosecurity.com.