Ernst Bank's Third Party and Cybersecurity Assessment

TRILOGY CONSULTING APRIL 29, 2016
TRILOGY CONSULTING
THIRD PARTY RISK MANAGEMENT
CYBERSECURITY
REGULATORY COMPLIANCE

2
Overall Agenda
Assessment Overview and Results
Cybersecurity Overview
Assessment Results
Research & Analysis
Issues Recommendation Roadmap Recommendations
Recommendations Value of the Solution Takeaways
Third Party Risk Management Cybersecurity Regulatory Compliance

3
Executive Summary
Third Party Risk
Management
Cybersecurity Regulatory Compliance
OCC Gap Analysis Questionnaire
NIST Framework Core
Assessment Questionnaire
FFIEC Control Listing
These are the findings across the three workstreams:
1. Auditing gaps in vendor
contractual agreements
2. Limited maturity in review
depth
3. Undefined roles and
responsibilities
1. Asset management can be
improved
2. Risk mitigation strategy can be
enhanced
3. Awareness and training can be
more robust
1. Operational structure and
accountability system can be
improved
2. Security controls and training
can be updated
3. Documentation and
monitoring system can be
strengthened

4
Value of the Solution to Ernst Bank
Global Presence
8 Million
Consumers
7 Million
Amount of Active Users world-
wide using online mobile
banking
1.5 Billion
Total Amount of Money
in Deposit

TRILOGY CONSULTING

6
TRILOGY CONSULTING THIRD PARTY RISK MANAGEMENT APRIL 29, 2016
Agenda
Assessment
Overview and
Results
Issues Recommendations

7
OCC 2013-29 Overview and Results
Planning Due Diligence
Contract
Negotiation
Ongoing
Monitoring
Termination
Description
Provides detail
on how the
bank will select,
assess, and
oversee a third
party
Includes a
detailed process
on how to
properly select
a third party
Contains
detailed
documentation
on each party's
rights and
responsibilities
Consists of
comprehensive
assessments of
the third party
to ensure
contract
compliance
Explains how
and why a
contract may be
ended and how
to deal with
shared property
Score Moderate Minor Minor Moderate Minor

8
100%
Results
Planning Due Diligence
Contract
Negotiation
Ongoing
Monitoring
Termination
Score Moderate Minor Minor Moderate Minor
55%
19%
7%
19%
69%
15%
16%
75%
8%
11%
6%
44%
37%
19%

9
Identified Third Party Risk Issues
Issue Recommendation
1. Update contract requirements
2. Limited maturity in review
depth
2. Develop proper ongoing
monitoring for third and
fourth parties
3. Undefined roles and
responsibilities
3.1 Define risk management
committee
3.2 Employee training

10
Recommendation One
1. Update contract requirements

11
Contract Requirements
Ernst Bank’s right to conduct annual reports for high risk
vendors and offsite reviews for low risk vendors
Ernst Bank’s right to monitor the third party’s compliance
The frequency in which the third party will submit control
audits and reports
Ernst Bank’s right to an external transfer in the event of
business disruption
Activities that cannot be subcontracted
Procedures for notifying the bank in writing whenever service
disruptions and security breaches pose a risk to Ernst Bank

12
Recommendation Two
2. Limited depth in reviewing
vendors and their subcontractors
2. Develop proper ongoing
monitoring for third and
fourth parties

13
Third Party Monitoring Process
Reports to be collected:
1. Service-level agreement
reports
2. Performance reports
3. Audit reports
4. Control testing results

14
Fourth Party Monitoring Flowchart
Identify all fourth
party providers
Assess what activities
and information are
being subcontracted
Develop a
Non-Disclosure
Agreement
Perform annual
reviews and onsite
reviews with third
party vendor
Assess changes to
fourth party's
financial situation,
insurance coverage,
etc.
Report to
Centralized
Data Repository
Is the fourth
party a high risk
vendor?
Vendor self
assessment
Collect reports
every 2-3 years
Report to
Centralized
Data Repository
Yes
No

15
3. Undefined Roles and
Responsibilities
3.1 Define risk management
committee
3.2 Employee Training
Recommendation Three

16
Define Risk Management Committee
A Risk Management Committee
Composed Of:
1. Executive and non-executive directors
2. Lawyers
3. Risk Professionals
4. IT Support Specialists
Purpose:
• Review all vendor contracts
• Perform all onsite reviews and monitoring
procedures
• Monitor Ernst Bank’s risk profile
• Define risk review activities regarding
decisions such as new acquisitions
• Report to the Senior Management

17
Formal Training Program
Ensure employees are
adequately trained and
the people in charge
have certification to be
qualified for their roles
Ernst Bank
Certification of
Employees
• Certification for
vendor and IT
managers
• Defines roles and
responsibilities
of each position
Training
Programs for
Third Parties
• Identifies what is
expected of the
third party and
their roles and
responsibilities
• Reduce risk of
misconduct by
third parties

18
Certification of Employees
Third Party Risk
Management
Certification
Programs
Certified Third Party Risk
Professional(CTPRP)
Certified Regulatory
Vendor Program
Manager(CRVPM)
Certified Risk and
Compliance Management
Professional (CRCMP)
• Managing the vendor life cycle
• Vendor Risk Identification and
Rating
• Test and 2 day training course
• Be recognized as a professional in
the field
• Knowledge required to build,
implement, and manage a 3rd party
oversight program
• 6 hour training course
• Understand international
standards and principles in IT
risk management
• Understanding of the OCC
bulletin
• 2,800 slide course and 3 exams

19
Third Party Training Programs
• "[The] DOJ and SEC also assess whether the company has informed third parties of the company’s
compliance program and commitment to ethical and lawful business practices and, where
appropriate, whether it has sought assurances from third parties, through certifications and
otherwise, of reciprocal commitments. These can be meaningful ways to mitigate third-party risk.
(p.60-61)” –SEC
• Implementation:
• Have clear anti-bribery and third party supply chain statements in your code
of conduct as well as separate policies;
• Identify and rank the risks of third parties
• Complete appropriate risk based due diligence on the risk level of each third
party before engaging them, and continuously monitor the third parties for
any red flags (optimally using an automated system), and
• Ensure that third parties have an effective compliance program in place, and
are aware of and trained on your company’s expectations with respect to
bribery and corruption

TRILOGY CONSULTING
CYBERSECURITY

21
TRILOGY CONSULTING CYBERSECURITY APRIL 29, 2016
Cyber Security Agenda
Cybersecurity
Overview
Assessment
Results
Recommendation
Roadmap
Value of the
Solution

22
Importance to Ernst Bank
2020: $170 B
$400 M to
$500 M
Annual Cost of Cyberattacks
1.5 M $14 B
Amount the Federal
Government will spend
on cybersecurity in
2016
Cybersecurity is
growing in size
and importance
Source: New York State Department of Financial Services
Increase in cyber breaches from 2012
Of Phishing Scams are targeted at financial institutions
Of intrusions lead to account takeovers
62%
76%
46%

23
Cybersecurity Overview
Scope
• Ernst Bank requires a high-level cybersecurity awareness training program that targets employees at
every level
• Create a data flow inventory system to target areas susceptible to cyber threats
• Develop a comprehensive asset management system that inventories all systems, software,
applications, and devices used within the bank
Approach
• Risk Assessment tool needed to analyze and outline current cyber security infrastructure
• Based on assessment results develop a comprehensive plan for firm security
• NIST Cyber Security Framework outlines the guidelines and standards needed to implement a well
protected system
Solutions
• Cyber security risk assessment questionnaire rooted in the NIST Framework Core
• Visual breakdown of Ernst Bank’s cyber security risks, along with details on the scoring methodology
• Roadmap for improvement created by cyber security experts and tailored to Ernst Bank’s specific cyber
security needs

24
NIST Framework Core
Functions Purpose
Identify What assets need protection?
Protect What safeguards are available?
Detect What technologies can identify incidents?
Respond
What technologies can contain impacts of
incidents?
Recover What techniques can restore capabilities?

25
Risk Assessment Tool
25
 Each question is based off a NIST Framework Core control
 Once all five functions of questions have been filled out, the tool will generate the
results and in depth analysis of Ernst Bank
 Identify potential weak points in the current infrastructure

26
Scoring Breakdown
• The cyber security protocols, procedures, and
implementations of Ernst Bank go above and beyond industry
standards, with no major improvements necessary
1 (Minor)
• There are some areas of the cyber security system
implementation that require updates, but the majority of the
system is up to industry standards
2 (Moderate)
• Significant updates in the policies and infrastructure of the
cyber security system are required3 (Major)
• Drastic updates in the policies and infrastructure of the cyber
security system are needed urgently; even minor threats may
cause substantial damage to valuable data and assets
4 (Critical)

27
Breakdown of Functions
Each question is scored based on
the response given and the weight
assigned to its category
Overall risk is broken down and
presented function by function
Functions are given risk ratings of:
Minor, Moderate, Major and Critical
Risk breakdown graphs show the
level of risk mitigation (taller bars
equate to more secure systems)

28
Breakdown of Categories
Each framework function is broken down by category
Weak categories within each function are identified to help fix vulnerabilities within Ernst
Bank’s overall cyber security system

29
Critical Risk Categories
Control Area Description Current Controls Recommendation
Asset Management The data, personnel, devices, systems,
and facilities that enable the organization
to achieve business purposes are
identified and managed consistent with
their relative importance to business
objectives and the organization’s risk
strategy.
Inventory systems, data flows, and external
systems are not catalogued. This can result in
loosely managed software, misplaced or lost
data, or data exposure to malicious entities.
New device purchases and distributions should be catalogued
and the inventory system continuously updated. This allows
monitoring applications for weak points in the current
hardware and software infrastructure.
Cataloguing all data flows will make data more reachable and
remains within a secure and monitored environment.
Risk Management
Strategy
The organization’s priorities, constraints,
risk tolerances, and assumptions are
established and used to support
operational risk decisions.
The current system does not identify and rank
vulnerabilities based on their potential fallout.
Organizational risk tolerances are not clearly
defined and managed. This can lead to an
unsuitable amount of risk by not
implementing sufficient security measures.
Identify possible risks and consequences of assets being
comprised. Then determine the acceptable risk level and work
to minimize factors that could comprise the acceptable risk
level.
Awareness and
Training
The organization’s personnel and
partners are provided cybersecurity
awareness education and are adequately
trained to perform their information
security-related duties and
responsibilities consistent with related
policies, procedures, and agreements.
Employees are only trained in cyber security
practices when they are hired but are not
subject to continuous training. Like regular
employees, privileged users are not subject to
formal training. Users that have enhanced
access present a higher risk to key
information.
Ernst Bank needs to implement frequent training classes. The
physical hardware and software can only safeguard a network to
a certain degree, the human element is always a risk. Regular
training can help reduce the risk of social hacking. Users that
have access to more pertinent information within the data
hierarchy need to have more advanced and frequent training.
The following categories received a score of critical. Improvements are necessary immediately to bring these categories
up to NIST framework standards.

30
Major Risk Categories
30
Governance The policies, procedures, and processes to manage
and monitor the organization’s regulatory, legal,
risk, environmental, and operational
requirements are understood and inform the
management of cybersecurity risk.
Organizational policies do not always
take cyber security risk into account.
Revise current policies to place a greater emphasis on cyber
security risk. This will help increase awareness and mitigate
risk due to employee error.
Analysis Response to breaches are executed and recovery
activities are conducted.
Notifications from detection systems
are not investigated
The CIO, Senior Manager, and Cyber Security Manager
should receive text and email alerts based on the severity of
notifications. This establishes a clear path of accountability
and responsibility.
Mitigation In the case of a breach, actions are taken to
contain the event, mitigate effects and minimize
repercussions.
Response planning is not updated
based on prior incidents.
To more effectively contain and mitigate incidents, Ernst
bank must update their response plans based on a record of
prior incidents.
Communications Activities are communicated and coordinated
with internal and external parties.
Response plans are not properly
executed in the occurrence of a breach
due to a lack of defined roles and
responsibilities from employees.
A detailed plan outlining employee roles and responsibilities
needs to be created. This will help Ernst Bank employees
properly respond to a breach when it occurs.
The following categories received a score of major risk. In order to bring these categories up to NIST Framework
standards, improvements are necessary.

31
Quick Win- Coordinate a CSIRT
• Mitigate and contain all breaches until the network is deemed safe
• Develop policies and procedures for use in case of breach
• Establish reporting guidelines for employees and methods for response
planning
• Coordinate a communication network between all levels of employees and
other relevant groups.
• Clearly define roles and responsibilities for all levels of employees
• Assist in creating and maintaining a inventory system for Ernst Bank
Assemble an Computer Security Incident Response team to properly mitigate and
investigate all cyber incidents

32
Quick Win- Asset Management
User log in
Deposit mobile
check
End-to-end
encryption of
check
Sent to Ernst
Bank server
Check processed
Stored in data
center for record
retention
 Inventory all software and
hardware in place
 Develop data flow maps of the
entire Ernst Bank network
 Identify potential risks in the
systems in place
Periodically review all systems
to detect obscurities

33
Quick Win- Routine Employee Training
Send out phishing tests through a randomized selection system to
track effectiveness of employee training
Have privileged users attend upper-level training seminars
Contract an outside firm to provide monthly cyber security training

34
Implementing Employee Training
Management Training Guidelines
Additional monthly training on data security
and new potential threats
Outline risks associated with higher access
based on standings within company
Evaluate effectiveness of breach reporting
system and how to respond if a breach is
suspected
Employee Training Guidelines
Discuss essential cyber security practices to
implement in the workplace
Conduct monthly training about new
potential phishing scams and attacks
Define policies and guidelines on reporting
possible breaches

35
Value For Ernst Bank
Ernst Bank’s cyber
security system will be
strengthened by
implementing quick
win solutions
Ernst Bank cyber
security will be aligned
with NIST Framework
standards
Ernst Bank employees
will be more aware of
potential cyber security
threats

TRILOGY CONSULTING
REGULATORY COMPLIANCE

37
TRILOGY CONSULTING REGULATORY COMPLIANCE APRIL 29, 2016
Project Overview
Research & Analysis Recommendations Takeaways

38
Regulatory Compliance Timeline
2/1 2/15 2/29 3/14 3/28 4/11 4/25
Construct Project Timeline
Prepare a Control Listing From FFIEC IT Booklets
Draft a Workflow for Regulatory Compliance Department
Establish a Risk Rating Scale & Scoring Methodology
Execute a Gap Analysis & Develop a Mapping Matrix
Define Remaining Questions for Compliance Controls
Develop a Risk Assessment Tool
Send Assessment Tool to Ernst Bank for Completion
Analyze Results From the Risk Assessment Tool
Prepare and Present Final Presentation

39
Operations
Outsourcing
Information Security
Management
Research
Goal: Develop a regulatory compliance program to proactively identify,
evaluate and manage compliance with regulatory requirements.
Federal Financial
Institution Examination
Council (FFIEC)
• Formal US
Government
interagency body
• IT Examination
Handbook InfoBase

40
Analysis
28%
28%
20%
24%
Risk Breakdown
Minor Moderate Major Critical
2.29 2.43
2.75
Quality of Controls Likelihood Impact
Risk by Type
2.20 2.50
1.67
3.00
Information
Security
Outsourcing Operations Management
Risk by FFIEC Category
Ernst Bank has moderate risk

41
Key Findings from Risk Tool
Current State Recommendations
improved
1.1 New hierarchy
1.2 New workflow
1.3 Block system
can be updated
2.1 Training program and
notification system
strengthened
3.1 Centralized data repository
and benchmarking

42
Recommendation 1.1: Hierarchy
Senior
Management
Team
Leaders
Team
Managers
Analyst
Teams
Management
Legal
Information
Security
Outsourcing
Operations
Team Leaders
• 1 Domestic & 1 Foreign leader
Team Managers and Analyst Teams
• 1 for each main location of Ernst Bank
Finding 1: Operational structure and accountability system can be improved

43
Identification
Risk discovery
Analysis
Benchmark
Classification
Block system
Mitigation
Risk resolution
Monitoring
Continuous
evaluation
Achieves optimal operational efficiency and maximum compliance levels
Recommendation 1.2: Workflow

44
Block
A
• Urgent
Block
B
• Near-
Immediate
Block
C
• Distant
Central
Data
Repository
Recommendation 1.3: Block System
Block B Example:
Central Securities
Depositories (CSD)
Regulation
Block A Example:
Dodd-Frank Title IV
Block C Example:
Potential Regulations

45
Recommendation 2.1: Training
• Security Updates
• Online Training Portals
Frequent E-Blasts to
all Employees
• Security Awareness Training
• Compliance Focus
Awareness and
Procedural Training
• New Workflow System
• Recommended Hierarchy
Security
Responsibilities
Reorganization
Finding 2: Security controls and training can be updated

46
Regulations enter central data repository
Create industry benchmarks
Calculate internal metrics
Compare metrics to benchmarks
Finding 3: Documentation and monitoring system can be strengthened
Recommendation 3.1: Data Repository

47
Implementation Considerations
improved
1.1 New hierarchy
1.2 New workflow
1.3 Block system
• Hiring of additional staff
• Training program
can be updated
2.1 Training program and
notification system
• Training program
strengthened
3.1 Centralized data repository
and benchmarking
• Virtual and physical data
repository system
• Calculating metrics
Findings Recommendations Implementation

48
Roadmap
People
(2 Months)
Hire analysts underneath
team managers
Management
(1 Month)
Hire team managers at
each data center
Training
(7 Months)
Block system, notification
system and third party
training
Benchmarks
(4 Months)
Metrics are calculated to
measure compliance
Data Repository
(3 Months)
Implement data
repository to store
relevant compliance data

49
Value of Solutions
Cost savings and
increased revenue
Lower
risk
of
noncompliance
Higher
reputational
excellence
Scalability
Employee
efficiency
Customer
satisfaction

TRILOGY CONSULTING
QUESTIONS

TRILOGY CONSULTING
APPENDIX

52
Classifying High Risk Vendors
Foreign sub-contractors
Number of 4th parties involved
Critical activities
Volume of financial transaction processed

53
A Challenging Landscape
Foreign Corrupt
Practice Act (FCBA)
UK Bribery Act
Gramm-Leach-Bliley Act
12 CFR Part 30 of the OCC
The Bank Service Company Act
OCC Bulletin 2013-29
CFPB Bulletin 2012-03
Notice of Deficiency
The OCC may request a compliance plan
to be submitted under it’s “enforceable
guidelines” under the 12 CFR Part 30. If
the bank fails to do so, it may face civil
monetary penalties.

54
Penalties for Non-Compliance
Situation:
• A major bank outsourced
identity protection
products to customers but
violated CFPB and FTC
acts
Situation:
• A credit card company
outsourced two vendors
who violated several acts
Result:
• $6.15 Million in
Reinstitution
• $80 Million in Civil
Penalties
Result:
• $144.5 Million in
Reinstitution
• $43.7 Million in Civil
Penalties

55
Third Party Risk Management Program
Structure
Board of Directors
Internal Audit
Governance
Enterprise Risk Committee Bank Management
Legal & Compliance
Risk Management Committee
IT Support Specialist Risk Professionals
Executive & Non-Executive Directors
Business Unit
Third Parties
Subcontractors
Third Line of Defense
Second Line
of Defense
First Line of Defense

56
Overview of Assessment Tool
Planning
Due diligence
and third-
party selection
Contract
negotiation
Ongoing
monitoring
Termination
Qualitative OCC gap analysis
Assessment tool sections refer to the five stages of
the vendor management life cycle

57
Employee Certification
• Certified Third Party Risk Professional (CTPRP) recognition validates expertise,
provides professional credibility, recognition, and marketability of an individual
• Shared Assessment Program, which developed CTPRP, has been setting the
industry standard for targeting vendor risk since 2005. It constantly strives to
streamline the risk assessment process and to develop faster, cost efficient ways
to conduct assessments
• CTPRP professionals will demonstrate an understanding of TPRM including:
• Managing the vendor life cycle
• Vendor Risk identification and rating
• Knowledge of the fundamentals of vendor risk assessment, monitoring, and management
• Requirements:
• Attend the Shared Assessments Program CTPRP Workshop
• Successfully pass the Shared Assessments CTPRP Examination
• Hold a minimum of five years experience as a risk management professional, in a
position(s) that demonstrates proficiency in assessment, management and remediation of
third party risk issues

58
Item Member
Non-
Member
Workshop &
Exam
$695 $795
Annual
Maintenance
Fee (Year 1 & 2)
$75 $75
CTPRP
Renewal Fee
(Year 3)
$149 $149
Corporate
Discounts
Discount
Amount
5-25 registrants 10%
26-50 registrants 15%
51+ registrants 20%
Certification Program Pricing

59
CTPRP Programs
• Amount of Certifications per year ~ 4 vendor managers and 4 IT
managers
• Cost of certification ~ $5,724 one time cost
• Renewal fees ~
• $600 for years 1 and 2
• $1,192 for year 3
• Cost of third party failure ~ $1.3 million to $35 million
• Certified managers will then hold 1 week long training sessions with
employees so they are better involved in the process
• Minimal cost because managers will be the ones holding the training
sessions
• Value added to all members of the organization

60
Recommendation
Line of Defense Model can fuel Ernst Bank’s performance by:
Reducing gaps in risk coverage
Reducing business confusion in dealing with risk
Reducing layers of redundant controls
Reducing complex and inconstant reporting

TRILOGY CONSULTING
CYBERSECURITY
APPENDIX

62
Sample Question Weighting

63
Minor Categories
In these categories, Ernst Bank has the foundation of a secure system as defined by the NIST framework.
These categories are of extremely low risk to Ernst Bank and do not require adjustment at this time.
Business
Environment
The organization’s goals and objectives are
comprehended to its full potential by the
company. Using these identified goals and
objectives the company is able to identify the
necessary performance measures needed to
mitigate risk.
mission, objectives, stakeholders, and activities
are understood and prioritized; this information is
used to inform cybersecurity roles,
responsibilities, and risk management decisions.
The organizations goals and objectives
are fully comprehended and outlined.
Ernst bank has identified the
performance measures to mitigate risks
and it is clearly understood and
prioritized within the company.
No recommendation is needed at this time.
Maintenance Software and hardware maintenance is properly
preformed as outlined by company policies and
procedures.
Software and hardware maintenance is
performed frequently by Ernst Bank.
Detection Processes Detection processes and procedures are
maintained and tested to adequately and timely
be aware of anomalous events.
Current detection processes in place
meet NIST framework standards and
are frequently tested and updated.

64
Moderate Categories
In these categories, Ernst Bank meets the standard guidelines as defined by the NIST framework. These categories pose an intermediate
level of risk to Ernst Bank and while they may need improvement, the investment to improve these areas is not necessary at this time.
Access Control Data access is permitted to authorized
users, processes, transactions and
hardware on the network.
Data access is satisfactorily authorized
amongst users, processes and transactions
on a network.
Currently meets requirements.
Data Security Data is properly managed and protected
in order to maintain privacy, and security
of information
Data is satisfactorily managed and
protected in order to maintain privacy and
security of information
Security Continuous Monitoring Network is monitored at intervals to
identify potential cyber security threats
and verify that the network is protected.
Network is satisfactorily monitored at
intervals to identify potential cyber security
threats and verify that the network is
protected.
Recovery Planning Recovery processes in the event of a
breach are in place and incorporate past
breaches
Recovery processes are in place in the event
of a breach. Incorporation of past breaches
as reference is not frequently incorporated
Use of past breaches can help teach Ernst
Bank ways to identify vulnerabilities in its
network and be more prepared in the case of
a repeat event.
Information Protections, Processes, and
Procedures
Policies in place identify roles, and
responsibilities amongst employees and
the procedures in place protect the
network and data assets
Policies in place identify roles and
responsibilities amongst employees.
Employee training on cyber risks in
minimal.
More frequent employee training on cyber
risks is needed.

65
Roles at Ernst Bank
CEO will have final approval on any major changes to the cyber security
system. He or she will assess the plan in accordance with all other parts
of the business to determine the resources available to implement the
change.
CIO will take the idea from the senior manager and work in tandem
with the CCO as well as other officers, such as CFO, to assess the level of
change required in the plan as well as the cost/benefit analysis.
Senior Managers will utilize the experience of cyber security managers
and third party risk assessment teams to determine the best way to
implement updated policies and infrastructure.
Cyber Security Managers will work on completing the questionnaire to
to identify potential flaws in the system. They will assist in development
and implementation of the newly designed cyber security system.

66
Wrongful Activity From Cyber Intrusions
This is a breakdown of the wrongful activity resulting from cyber intrusions within financial institutions.
With this information, Ernst Bank can prepare for the impact of a cyber security breach
Account Takeovers,
46%
Identity Theft, 18%
Telecommunication
Network
Disruptions, 15%
Data Integrity
Breaches, 9%

67
IT Intrusions at Financial Institutions
This is a breakdown of the most common IT intrusions affecting financial institutions. With this information, Ernst
Bank can focus their attention on the most common cyber threats in order to protect themselves
Malware, 22%
Phishing, 21%
Pharming, 7%Botnets, 7%
Other, 43%

68
Monetary Losses from Cyber Threats
0% 20% 40% 60% 80%
Customer Reimbursements
Audit & Consulting Services
Deployment of Detection Software,
Services, & Policies
Loss of Consumer Business
Damage to Brand Reputation

Ernst Bank's Third Party and Cybersecurity Assessment

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Ernst Bank's Third Party and Cybersecurity Assessment

Similar to Ernst Bank's Third Party and Cybersecurity Assessment (20)

Recently uploaded

Recently uploaded (20)

Ernst Bank's Third Party and Cybersecurity Assessment