November 11, 2011 7:41 PM
Posted by: David Schneier
assessment,
Audit,
compliance,
GLBA,
hack,
hacker,
NCUA,
phish,
phishing,
red flags,
red flags identity theft,
regulatory,
Regulatory Compliance,
scam,
smish,
smishing,
vish,
vishingThis is something akin to my annual public service announcement (PSA) for anyone who has cash-on-hand, a bank account, an investment account or perhaps even a piggy bank: As long as you have money there's someone out there right now scheming to try and take it away from you.
I'm having that...
April 8, 2010 2:24 PM
Posted by: David Schneier
cyber security,
id theft,
information security,
password,
password theft,
phish,
phishing,
Regulatory Compliance,
scam,
Security,
security awarenessLast month I blogged about a phishing attempt that landed in my inbox. The email account belonged to someone named Rebecca Keen who I had never heard of before (or so I believed at the time). As I was finishing writing that post, I received a follow-up email from the same person indicating...
March 2, 2010 8:18 PM
Posted by: David Schneier
email,
fraud,
GLBA,
phish,
phishing,
Regulatory Compliance,
scam,
scammer,
Security,
spam,
theftI received an email from Rebecca Keen this morning asking for help. You see, Rebecca took an unexpected trip to the UK and while there lost her wallet and all of her financial resources and was hoping I could help. She asked if I could float her a temporary loan of $1,540 so she could settle...
February 5, 2010 3:57 AM
Posted by: David Schneier
Audit,
GLBA,
information security,
NCUA,
phish,
phishing,
Regulatory Compliance,
risk,
risk assessment,
Security,
security testing,
social engineeringConsider this post to be something of a (banking) community service announcement.
It's February 2010, do you know when the last time was that your organization conducted a social engineering exercise?
I come across instances almost all of the time where financial institutions have obvious...
September 10, 2009 4:16 AM
Posted by: David Schneier
assessment,
Audit,
phishing,
Regulatory Compliance,
social engineeringThe recent news about a social engineering exercise gone awry serves as a lesson on how not to conduct these kinds of tests. An information security firm had sent a credit union NCUA-branded media to install in order to test if the employees would react...
May 20, 2009 7:31 PM
Posted by: David Schneier
Audit,
FDIC,
FFIEC,
fraud,
GLBA,
NCUA,
phishing,
Regulatory ComplianceMy practice has been busy lately helping a number of clients catch up on required tasks before their scheduled exams (it's a case of the old "if it wasn't for the last minute nothing would ever happen" philosophy). And in authoring some of our reports we're identifying issues and gaps that are in...
