This document summarizes a discussion on data protection for credit unions. It introduces the moderator and peer panelists, who work in credit union IT. The agenda includes discussing the increasing complexity of IT environments and data growth, compliance requirements, data loss threats, and methods to protect data. Technologies mentioned that can help include backups, determining recovery time objectives, onsite vs offsite storage, cloud storage, and site replication. The discussion emphasizes the need to identify all data to protect, have multiple recovery points, ensure data is encrypted and unattended, and out of region in accordance with compliance. Questions from attendees were taken at the end.

1. DATA PROTECTION
FOR CREDIT UNIONS
A Peer Supported Discussion
October 20, 2016

2. MEET YOUR MODERATOR
Lee Bird, President, Btech
Btech specializes in affordable, managed IT
security services for credit unions.
Btech works with over 120 credit unions throughout the United
States. Btech helps credit unions meet compliance goals by
implementing and managing security services.

3. John Lockie, AVP of Infrastructure and Security
Caltech Employees FCU
Rick Menjivar, Chief Information Officer
Chaffey FCU
PEER PANELISTS

4. Credit union landscape
Data loss threats
Methods to protect data
Compliance
Technology choices
Q&A
AGENDA

5. Increasing
complexity of IT
environments
Hyper-growth
of data and
applications
Protection of
electronic member
information
Compliance
requirements for
data
retention/destruction
CREDIT UNION LANDSCAPE

6. Accidental Deletion
Viruses, Malware, Ransomware
Natural Disasters – Storms, Floods, Fires
Power Outages
Hardware Failures
WHAT CAUSES DATA LOSS?

7. Determine RTO (Recovery Time Objective)
Define RTO for all data
Use the appropriate data protection technology based on the required RTO
Protect all data
1.
Determine Onsite vs. Offsite Requirements
Onsite for DR’s or data loss where site is still available
Offsite for DR’s where access to data center isn’t possible
“Out of the region” – Compliance requirements
HOW SHOULD I START PROTECTING DATA?
2.

8. WHAT DO I NEED TO KNOW ABOUT COMPLIANCE?
NCUA Rules –
Do you know them?
Encryption of
electronic member
information
Measures to protect
against destruction,
loss or damage of
member information
Regularly test the key
controls, systems
and procedures of
the InfoSec program
Gramm-Leach-Bliley
Act (GLBA)

9. DO THESE TECHNOLOGIES COVER ALL
MY DATA PROTECTION NEEDS?
Challenges with these technologies

10. • Regularly scheduled backups
• Unattended
• Multiple Copies of the same data
• Multiple retentions over a
pre-defined period of time
- Daily, weekly, monthly,
annual retentions
POINT-IN-TIME BACKUP

11. Slow
WHAT ABOUT BACKING UP TO TAPE VERSUS DISK?
CHALLENGES WITH TAPE
Tapes need to be
replaced annually
Transfer of tapes off-site
Are they out of the region? The
cost for an offsite storage vendor
Security
How many people are
touching my tapes?
Tape audit
All tapes must be accounted
for, all the time, otherwise
must report possible loss of
member information.

12. • Cloud for DR if region is affected
• Cloud so that protected data is out of the region
• Site replication or CDR for low RTO
• Can have a local copy for quick recovery
WHAT DOES CLOUD BACKUP BRING TO THE TABLE?
vs.
PUBLIC PRIVATE

13. • Identify all data to be protected
• Break down data recovery into RTO’s
• Have multiple data points for recovery
• Data must be out of the region
• Data must be encrypted
• Solution must be unattended – What does this mean?
SUMMARY: WHAT ARE DATA
PROTECTION “MUST-DOs” FOR CREDIT
UNIONS?

14. QUESTIONS FROM ATTENDEES

15. We created a quick checklist for you
to get a real Data Protection Score
IS YOUR DATA PROTECTED?

16. RESOURCES
Compliance Datasheet Comparison Card
All attendees will receive resources in a follow-up email
Data Protection Checklist

17. THANK YOU!
Lee Bird, President, Btech
221 E. Walnut Street, Suite 138
Pasadena, CA 91101
626-397-1045 | leebird@btechonline.com