Risk Management Solutions

If the only reason your credit union currently has a business continuity plan is because it is a regulatory requirement then the plan is likely not as detailed as it should be. Business continuity plans are too important to your credit union's operations and the long-term success of your credit union to overlook it as just checking off a box for your regulator.

There are so many options in the financial services industry that your credit union can’t afford to have an issue that disrupts services to your members.

Often times, credit unions don’t have the time or expertise on staff to thoroughly create their own business continuity plan. But whether your credit union has a dedicated team in place or not, it is highly recommended that credit unions with a plan have a third party review the plan to provide an unbiased review and opinion.

Our staff can be this resource. And with over ten years of experience on staff dealing with disaster recovery and business continuity planning for credit unions, you can feel comfortable that your credit union will be prepared for any issue that may arise in the future.

A solid business continuity plan should be able to quickly recover your systems to continue operations or have contingency plans in place to continue your operations off-site or remotely in the event you experience a disruption of service.

It only takes one issue that impacts your members for them to start looking for another provider down the street. Because let’s face it, the lives of your members don’t stop when your services go down – even if it’s due to circumstances beyond your control. To your member, it’s your credit union’s fault that their mortgage payment may be a week late or they can’t withdraw money from the credit union for the vacation they are leaving for that day.

So it is very important to take a business continuity plan seriously, and not look at it as just a regulatory requirement/suggestion.

Credit union professionals historically wear many hats. And many institutions don’t have the time or expertise on staff to thoroughly create their own business continuity plan. Because each credit union runs their operations a little differently, you shouldn’t have to settle for a plan that is based on a template.

That’s why Vizo Financial can create a customized business continuity plan for your credit union that makes sure all of your unique operations are taken into account.

Call trees often breakdown and should not be relied upon to notify your employees of essential information. Our employee notification system can notify employees of important information quickly by multiple means of contact, including email, home phone, and cell phone. You can even create groups of employees for specific notifications that don’t affect all staff, and track your employees’ responses.

Let's say you find out you've had a data breach. What do you do?

If you haven't developed a plan for how your credit union will deal with incidents, now is the time to act. A data breach is a serious and costly issue that could lead to fines and other expenses related to member notification, credit card replacement, lawsuits, etc.

But data breaches aren't the only type of incident your plan should worry about. What if you have a broken water pipe that is leaking into your computer room? Or you lose internet connectivity or phone service for an extended period of time?

The experienced staff at Vizo Financial can walk you through the scenarios, questions, planning, and documentation needed to develop an incident response plan specific to your credit union so you are prepared in the event you experience an issue, while also keeping you in compliance with industry regulations related to incident response.

At Vizo Financial, we are familiar with issues that credit unions are facing. We know your resources and finances are limited, and that your time is valuable. That's why we've developed a reasonably priced product that can be tailored specifically for your credit union.

Trying to resolve an incident is not the time to "wing it." Let us help you develop a proper plan to make sure your credit union is ready for potential incidents.

Know exactly how your systems' vulnerabilities could impact your credit union with our penetration testing.

A more in-depth version of a vulnerability scan, our penetration test allows you to see the consequences of a skilled attacker exploiting your systems weaknesses as we simulate an attacker by making controlled attempts to exploit vulnerabilities on target systems.

Our penetration test results provide deeper insight into the actual business risks of vulnerabilities that are present on your system and show how an attacker can exploit the vulnerabilities on your network and use the compromised machine to gain access to sensitive member information.

This test helps to clearly identify the actual risk the vulnerabilities on your network pose to your overall infrastructure.

Penetration testing provides your institution with regulatory compliance on the following guidelines:

• GLBA – Section III.C.3 12 CFR Part 364 Appendix B.
• NCUA – IS&T Questionnaire IT-IDS/IPS, Section E, 34 and 35; IT – Penetration Test Review, Section A, B, C,6-7, and 8c; IT – Servers, Section C, 19-21.t

People are the weakest link in the day-to-day management of an organization's network security. Our social engineering testing examines the security awareness and best practices of your employees and suppliers.

One of the main reasons credit unions are successful is their staff's willingness to provide top-level member service. Not only do you train your staff to be courteous to members and try to assist them with their needs, you generally hire people that possess these helpful traits by nature.

Criminals recognize this and prey on your staff's willingness to "help."

Depending on your needs, we can offer social engineering testing either remotely or on-site providing an accurate representation of your employees' security awareness.

Types of Social Engineering Testing

Off-site testing includes a wide range of attacks using email and phone calls designed to compromise company policy and access confidential information.

On-site testing includes attempts at gaining physical access to the premises, obtaining records, files, equipment, sensitive information, network access and more. Even though each engagement has unique characteristics, the testing is always conducted in a strictly professional manner.

Social engineering testing provides your institution with regulatory compliance on the following guidelines:

• GLBA – Section III.C.3
• NCUA – IS&T Questionnaire IT – Penetration Test Review, Section 6G

Attackers are always looking for ways into a financial institution’s systems to gain access to the sensitive information that they possess. Being a small credit union doesn’t exclude you from the potential of an attack. In fact, many criminals actually target small financial institutions specifically; knowing they are less likely to devote the necessary resources to prevent attackers.

A vulnerability scan is an automated process that scans the computers, servers, printers, and other devices connected to your institution’s network.

Our scanning service scans your systems and looks for known security gaps and holes in your network. The system will then generate a report prioritizing the remediation efforts based on the severity of each threat and the relative risk that your credit union assigns to each of your assets.

Vulnerability scanning provides your institution with regulatory compliance to the following guidelines:

• GLBA – Section III.C.3 12 CFR Part 364 Appendix B
• NCUA – IS&T Questionnaire IT-IDS/IPS, Section E, 34 and 35; IT – Penetration Test Review, Section A, B, C, 6-7, and 8c; IT – Servers, Section C, 19-21

Attacks against vulnerabilities in web-based application software continue to be an increasing trend. Application software that does not properly validate user inputs, or fails to sanitize user inputs by filtering out unneeded, malicious characters, could be vulnerable to a remote attack.

Attackers can inject specific exploits, including SQL injection attacks, buffer overflows, cross-site scripting, and click-jacking of code to gain control over vulnerable machines. This can lead to a compromise of your internal network with your public web applications providing an open door directly from the internet to your sensitive member data.

Performing regular web application testing and following up with the removal or mitigation of the vulnerabilities bolsters your layered network security strategy and provides an excellent control against a potential network data breach.

Our team tests your web applications for potential vulnerabilities, helping to ensure the security of your most critical business interfaces.

Web application testing is designed to meet all regulatory requirements, and fully evaluates the security of your applications, whether they have been deployed or are in the development stage.

Contact us today to make sure your web application is not an open door for criminals to access your members' sensitive data.

Wireless internet access is becoming commonplace in most businesses. And credit unions are no different. Whether you offer Wi-Fi access to your members while they are in the branch or only have it available for staff to test systems from outside of your main network, many credit unions now have a wireless system in place at their institution.

This poses separate security issues than just your main network itself.

A wireless security audit analyzes your wireless security configuration, wireless infrastructure, and attacks against your wireless network to establish how well your wireless network is protected from an attack.

Our comprehensive wireless security audit assesses your wireless networks, devices, and countermeasures to ensure you are protecting your organization from potential intruders.

Through our team’s experience and knowledge, we can also demonstrate the impact a successful wireless network intrusion can have on your credit union.