Key Insights
- Strengthening foundational controls remains the most effective defense against increasingly sophisticated, fast-moving cyberattacks.
- Updating asset inventories, retiring legacy systems, and enforcing phishing-resistant MFA eliminate critical security vulnerabilities.
- Conducting routine response exercises and verifying backups ensure institutions can quickly restore operations during disruptions.
This October, a malicious cyber-attack on European grocers spoiled millions of Euros worth of frozen and refrigerated food. Hackers broke into refrigeration software and turned temperatures up to 122 degrees. While refrigeration systems may seem far removed from banking, the incident illustrates a broader vulnerability: connected systems and overlooked software can create entry points for attackers, regardless of an organization's industry.
Cyberattacks may be accelerating in pace and sophistication, but defending against them still requires a strong foundation of established security controls. For community financial institutions (CFIs), the challenge isn't necessarily knowing which protections to put in place. It is to keep established controls current, address gaps, and test whether those controls can withstand increasingly convincing and fast-moving attacks.
The challenge is that cybersecurity weaknesses can develop gradually as systems age, responsibilities change, and existing protections go untested. Even institutions with established security programs can benefit from periodically reassessing whether their foundational defenses remain effective.
Eight Steps in Back-to-Basics Cyber Defense
Recognizing the continued importance of foundational protections, the FBI launched its Operation Winter Shield to help organizations identify and address common cybersecurity weaknesses. Its recommendations offer CFIs a useful framework for assessing whether their existing defenses remain effective.
Here are eight ways CFIs can strengthen their basic cyber defenses:
1. Know what you have. Maintain an up-to-date inventory of hardware, software, cloud services, and connected devices. Identify who owns each asset, whether it is supported, and how critical it is to bank operations. Regularly check for unauthorized or unmanaged assets so they do not become overlooked security gaps.
2. Retire old equipment and systems. Pay close attention to items that no longer receive security updates, as these are particularly vulnerable to attack. You should set up an end-of-life inventory and plan for retirement and/or replacement of these old systems.
3. Strengthen anti-phishing measures. Prioritize replacing weaker authentication methodswith phishing-resistant alternatives, especially for administrator accounts and remote access.
4. Review and test backups. Be sure to keep at least three copies of critical data and store at least one offline set. Protect backups from unauthorized changes or deletion, and test that critical systems and data can be restored.
5. Limit administrator privileges. Over time, systems can experience administrator creep as increasing numbers of individuals are granted administrator authority. That can increase the risk of compromised important credentials. Regularly review the ranks of those with administrator authority and trim back so that only necessary authority remains. Set up alerts when new administrator authority is granted.
6. Hold regular security exercises. Maintain an attack response playbook with clearly defined roles. Periodically run exercises to sharpen and maintain rapid responses to attacks. Include scenarios involving executive impersonation, fraudulent payment requests, and attempts to bypass normal approvals.
7. Strengthen email security.Regularly review email filtering, authentication protocols, and protections against impersonation and malicious attachments. Assess whether these safeguards can detect increasingly convincing phishing attempts and fraudulent messages that appear to come from trusted sources.
8. Keep software and systems patched. Regularly apply security updates to operating systems, applications, and network equipment. Prioritize vulnerabilities that are actively exploited and those affecting internet-facing systems. Establish patching deadlines based on risk, test updates before deployment, and verify that patches were successfully installed.
For CFIs, strong cyber defense depends on making foundational protections a routine discipline rather than a one-time checklist. As threats evolve, maintaining established controls remains essential, even as institutions adopt new security tools. For CFI leadership, that means understanding who owns these priorities, how regularly protections are evaluated, and whether testing demonstrates that critical systems can withstand an attack. The goal is not just to have safeguards in place, but to know they work when your institution needs them most.
