Skip to content

Cyberview #6: IoT’s security vulnerabilities & upcoming regulations

This episode of Cyberview delves into the evolving world of “the Internet of Things”. IoT, or when everything from your heating system to your car are actually computers and connected via networks, has become commonplace. Press a button 50 km away to warm up your house as you drive home in what Elon Musk calls “sophisticated computers on wheels”. But this convenience comes with a catch. As these machines evolve into increasingly complex computers, the potential attack surface grows. The Cyberview team explores.

 

IoT Malware Attacks Hit a 400% Increase

So, what’s the problem with these handy IoT devices? In short: they can be hacked – easily. Designed with functionality and convenience in mind, security has taken a back seat. This low level of protection leaves users vulnerable to attack, and IoT devices have become prime targets for cyberattacks. In fact, the Zscaler ThreatLabz research team found that IoT malware attacks increased 400% in the first half of 2023 compared to 2022. 

EU Cyber Resilience Act

On a legislative level, the EU is taking this seriously. The upcoming Cyber Resilience Act (CRA) is already striking fear into the hearts of device manufacturers the world over. But for consumers, the future of IoT looks bright, or at least more secure.

If passed, the CRA “would see inadequate security features become a thing of the past with the introduction of mandatory cybersecurity requirements for manufacturers and retailers of such products, with this protection extending throughout the product lifecycle.”

This is a huge development: Device makers will have to ensure the security of their products past sale. That means regular updates, security patches, and consumer safety being higher on the priority list than ever before. It’s a big shift towards a more secure digital landscape. Smart and secure homes are the future.

US Cyber Trust Mark

While the EU is laying down the law, the US Federal Communications Commission (FCC) is planning to roll out its new “labeling program for smart devices” in 2024. The Cyber Trust Mark will be the shiny new seal of approval for cyber-secure products.

Jessica Rosenworcel, FCC Chairwoman says: “The Cyber Trust Mark will help consumers make more informed decisions about what kind of devices they bring into their homes and businesses. So when you need a baby monitor, or a new appliance, you’ll be able to look for a Cyber Trust Mark… device manufacturers are going to be able to showcase privacy and security in the marketplace by displaying this mark”.

Manufacturers will be permitted to place the seal on products only after official assessment. And though this is still a voluntary seal, i.e. manufacturers aren’t legally obliged to earn it, it’s a step in the right direction for IoT cybersecurity. If you’re in the US, keep an eye out for this logo when making future device purchases.

IoT vulnerabilities & security tips

While most IoT malware attacks are aimed at businesses (manufacturing and education are among the most targeted sectors), consumers should stay vigilant as well. There are several avenues through which attackers can infiltrate your home networks using IoT devices. Here are a few ways that you can protect yourself.

  • Default logins – ISPs and modem/router companies tend to distribute network devices with default logins. These credentials are easily accessible online. A typical username is “admin”, passwords might be basic codes like 1234 or 0000. Easy pickings for hackers – and easy for you to change.

  • Auto-update – If this feature is turned off and you miss security updates, your device will stay open to vulnerabilities longer. Turn on auto-update to avoid this. Smart devices with legacy firmware are the bread and butter of IoT hackers.

  • Separate network for IoT – Keep your devices insulated from your main home network. This acts as an effective layer of security if one of your devices is compromised.

  • Principle of least privilege – Turn off certain “smart” features that you don’t use. Why does your toaster have a camera anyway?

With new regulations taking effect this year and our own proactive security measures at home, a safer cyber future is possible for all.

Listen to the Cyberview podcast on Spotify.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

Parallels Secure Workspace vs. Apache Guacamole

How do Apache Guacamole and Parallels Secure Workspace compare?

Apache Guacamole and Parallels Secure Workspace offer a built-in RDP to HTML5 gateway, so it is no wonder these two solutions are often compared. In this blog post, I’ll examine what Guacamole is and how it compares to Parallels Secure Workspace.

Want to see how real users rate Parallels Secure Workspace and Apache Guacamole? Check our reviews on TrustRadius.

What is Apache Guacamole?

Apache Guacamole, a client-less remote desktop gateway, supports standard protocols like VNC, RDP, and SSH.

It is considered clientless because Guacamole delivers apps or desktops via HTML5 once installed on the back end. A free, open-source platform, Apache Guacamole is maintained by the Apache community.

Guacamole is a free, open-source tool with a nice fan base that includes individual users, businesses, and software companies. The latter groups may embed Guacamole in their products including VPNs and firewalls.

Does Parallels Secure Workspace rely on Guacamole?

For starters, I’ll be clear about this: Parallels Secure Workspace does not use (or build on or rely on) Apache Guacamole. The solution has its own proprietary HTML5 gateway. I frequently hear the false claim that Parallels Secure Workspace uses this open-source tool, and while this is true for several competitors in our space, it is certainly not true for our solution.

Is Parallels Secure Workspace an open-source tool like Guacamole?

No, Parallels Secure Workspace is not free nor is it an open-source tool. Rather, Parallels Secure Workspace is a commercial product. Accordingly, we provide support that includes detailed product documentation, technical support and training, commercial models for our channel partners, and more.

That’s the first big difference between Parallels Secure Workspace and the Apache product. Who will you call when you have a problem with Guacamole? What happens when security vulnerabilities are identified? And so on. Moreover, our product roadmap is very security and Zero Trust focused, with capabilities like MFA, SSL, context awareness, usage auditing, and more.

On the other hand, Apache Guacamole was hit by a severe vulnerability in July 2020. Since then, five other CVEs (Common Vulnerabilities and exposures) have been identified and reported fixed.

We have a broad channel ecosystem of certified engineers that extends globally. We also have a set of tested technology partnerships that extend and complement our perimeter.

The similarities and differences between Apache Guacamole and Parallels Secure Workspace

There are also some obvious (and less obvious) differences from the technology perspective. Parallels Secure Workspace was built with simplicity in mind. It is easy to deploy and work with for both Windows and Linux admins (the latter of which are often familiar with the open-source community and likely to be familiar with Guacamole)

Now, let’s take a deeper look into the architecture and features of both solutions:

What are the similarities between Apache Guacamole and Parallels Secure Workspace?

HTML5 gateway and protocols supported:

Guacamole supports SSH, VNC, and RDP. Parallels Secure Workspace supports RDP.

However, Parallels Secure Workspace also supports WebDAV and CiFS. Parallels Secure Workspace’s built-in reverse proxy supports web applications.

Similar features for published applications:

  • HMTL5 access (browser-based)
  • Virtual keyboard
  • Virtual (PDF) printer
  • Session sharing and session recording
  • MFA TOTP built-in, including support for RADIUS

Identical restrictions for certain applications:

Neither Guacamole nor Parallels Secure Workspace were designed for graphic-intensive applications like 3D rendering, video, or running video/voice calls.

What are the differences between Parallels Secure Workspace and Apache Guacamole?

File Server Access

Parallels Secure Workspace includes access to file servers via WebDAV or CIFS via the files section. Parallels Secure Workspace files can be opened with associated published applications.

One can also share large and small files without the need to upload the file(s) elsewhere with Parallels Secure Workspace (e.g., into a third-party cloud like WeTransfer)

Built-in reverse proxy

Parallels Secure Workspace features a built-in reverse proxy that provides access to internal web applications without needing RDP or remote desktop services.

UX

Look at Parallels Secure Workspace’s intuitiveness and user-friendly look and feel, and you be the judge.

PSW demoThe front-end workspace is very intuitive. You can access files, various applications, and desktops easily.

Multi-monitor capabilities

The multi-monitor capabilities are better developed with multiple options available in Parallels Secure Workspace.

Smart card support (in-app usage)

Parallels Secure Workspace can support the use of smart cards (e.g., eID cards) within applications (e.g. reading an eID card’s info) with its RAH (Remote Application Helper).

The RAH is the only exception to the TML5-centric story. The RAH agent must be installed on the local computers (Windows, MacOS, or Linux). In-app usage is not supported by the free Apache tool.

Otherwise, you don’t need to install other plugins or clients to work with Parallels Secure Workspace!

Security and compliance

Parallels Secure Workspace offers exciting capabilities that make your data even more secure:

  • Built-in Context Awareness capabilities based on location or IP address as context access can be turned off for a user (group), giving admins extra control and capabilities.
  • Built-in usage audit and anomaly detection that can be connected to an SIEM.
  • Single Sign-On (SSO) with SAML or OpenID Connect without sending passwords to the Parallels Secure Workspace appliance.
  • Guacamole supports SSO but uses password caching — so I believe the Parallels Secure Workspace setup is more secure.
  • SSL encryption is built-in.
  • No local data.

Here’s an overview of the Zero Trust capabilities of Parallels Secure Workspace:

PSW Zero Trust

Architecture

There are also some key differences from an architecture perspective:

Parallels Secure Workspace is delivered as a virtual appliance for simplicity and speed of deployment. Apache Guacamole requires installing multiple services or multiple docker containers, which need to be linked.

Guacamole leverages an internal translation protocol (RDP Guacamole protocol HTML5), while Parallels Secure Workspace does not use an internal protocol, which makes Parallels Secure Workspace a better, more resource-optimized HTML5 gateway.

Parallels Secure Workspace can enable HA (High Availability), so in a multi-node deployment, it can fail over between nodes if issues arise.

Parallels Secure Workspace is a multi-tenancy solution right out of the box.

The architecture is simple and non-intrusive.

PSW architecture

Parallels Secure Workspace vs Apache Guacamole

When comparing Apache Guacamole to Parallels Secure Workspace, we see a lot of similarities, but there are also many differences.

Based on my knowledge of Apache Guacamole —which might not be complete, and I don’t pretend to be a Guacamole expert —this blog post provides a deeper look into the elements our customers are most concerned with.

Interested in making the comparison yourself? Try Parallels Secure Workspace in your environment — download it now.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Parallels 
Parallels® is a global leader in cross-platform solutions, enabling businesses and individuals to access and use the applications and files they need on any device or operating system. Parallels helps customers leverage the best technology available, whether it’s Windows, Linux, macOS, iOS, Android or the cloud.

ESET Research joins global operation to disrupt the Grandoreiro banking trojan operating in Latin America and Spain

  • ESET worked alongside the Federal Police of Brazil in an attempt to disrupt the Grandoreiro botnet.
  • ESET contributed to the project by providing technical analysis, statistical information, and known command and control (C&C) server domain names and IP addresses.
  • This disruption operation was aimed at individuals who are believed to be high up in Grandoreiro’s operational hierarchy.
  • Further investigation performed by the Federal Police of Brazil led to the identification and arrest of the individuals in control of the botnet.
  • Grandoreiro has been active since at least 2017.
  • Grandoreiro targets Brazil, Mexico, Spain, and Argentina.
  • Grandoreiro can block a victim’s screen, log keystrokes, simulate mouse and keyboard activity, share the victim’s screen, and display fake pop-up windows.

BRATISLAVA, PRAGUE — January 30, 2024 — ESET collaborated with the Federal Police of Brazil in an attempt to disrupt the Grandoreiro botnet. ESET contributed to the project by providing technical analysis, statistical information, and known command and control (C&C) server domain names and IP addresses. Due to a design flaw in Grandoreiro’s network protocol, ESET researchers were also able to get a glimpse into the victimology.

This disruption operation was aimed at individuals who are believed to be high up in Grandoreiro’s operational hierarchy. The investigation by the Federal Police of Brazil led to multiple arrests. ESET researchers provided data crucial to identifying the accounts responsible for setting up and connecting to the Grandoreiro C&C servers.

Grandoreiro is one of many Latin American banking trojans. It has been active since at least 2017, and ESET researchers have been closely tracking it since then. Grandoreiro targets Brazil, Mexico, Spain, and, since 2023, Argentina.

Functionality-wise, Grandoreiro hasn’t changed very much since the last ESET Research blog post about the group in 2020. Despite that, Grandoreiro has been undergoing rapid and constant development. Occasionally, we even observed several new builds a week; for example, this has amounted to a new version on average every four days between February 2022 and June 2022.

The operator still has to interact manually with the compromised machine in order to steal a victim’s money. The malware allows the following actions:

  • Blocking victims’ screens
  • Logging keystrokes
  • Simulating mouse and keyboard activity
  • Sharing the victims’ screen(s)
  • Displaying fake pop-up windows

“ESET automated systems have processed tens of thousands of Grandoreiro samples. The domain generation algorithm (DGA) that the malware has used since around October 2020 produces one main domain per day, and it is the only way Grandoreiro is able to establish connection to a C&C server. Beside the current date, the DGA accepts a huge static configuration as well,” says ESET Researcher Jakub Souček, who coordinated the team that analyzed Grandoreiro and other Latin American banking trojans. “Grandoreiro is similar to other Latin American banking trojans mainly via its obvious core functionality and in bundling its downloaders within MSI installers.”

Grandoreiro’s implementation of its network protocol allowed ESET researchers to take a peek behind the curtain and get a glimpse of the victimology. Grandoreiro’s C&C servers give away information about victims connected at the time of the initial request made to each newly connected victim. By examining this data for more than a year, we conclude that 66% were Windows 10 users, 13% used Windows 7, Windows 8 represented 12%, and 9% were Windows 11 users. Since Grandoreiro reports unreliable geographical distribution of its victims, we refer to ESET telemetry: Spain accounts for 65% of all victims, followed by Mexico with 14%, Brazil with 7%, and Argentina with 5%; the remaining 9% of victims is located in other Latin American countries.. We also note that in 2023, we saw a significant decrease of Grandoreiro’s activity in Spain, compensated with increased campaigns in Mexico and Argentina.

For more technical information about Grandoreiro, check out the blog post “ESET takes part in global operation to disrupt the Grandoreiro banking trojan” on WeLiveSecurity. Make sure to follow ESET Research on Twitter (currently known as X) for the latest news from ESET Research.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

How to overcome the barriers of multi-cloud: MSP edition

MSPs often adopt a multi-cloud strategy, leveraging a mix of public cloud vendors like AWS, Azure, and Google Cloud to deliver a diverse range of managed services. These services include virtual applications and desktops, backup, disaster recovery, and data security. 

A multi-cloud approach can help enhance performance and optimize costs by allowing MSPs to select the best cloud platform to deliver solutions their clients need and avoid vendor lock-in. This fosters growth and enables MSPs to navigate a challenging environment more effectively as the managed service provider industry shifts and evolves.

MSPs face a myriad of technical challenges while navigating multi-cloud environments. These challenges span from managing and administrating multiple environments to addressing technical skill gaps, impacting the operational efficiency of MSPs in delivering their services.

See how Parallels RAS can help your MSP adopt an effective multi-cloud strategy and more!

The Benefits of integrated multi-cloud for MSPs

Empowering service delivery

1. Enhancing service offerings. Integrating multi-cloud environments allows MSPs to cherry-pick the best-of-breed capabilities from different cloud providers, enhancing their end-to-end managed services.

2. Cost optimization. Multi-cloud setups enable dynamic load balancing across different providers based on pricing and workload demands. MSPs can shift workloads to a cloud provider with the most cost-effective pricing.

3. Flexibility and scalability. By harnessing a multi-cloud approach, MSPs can boost agility and scalability as per customer requirements. Multi-cloud solutions can maximize resources by spreading workloads across platforms and minimizing the risk of service disruptions and improving overall reliability.

4. Compliance and security. Compliance requirements play a vital role in the choice of vendors, as different cloud providers may offer specific certifications or regulatory requirements catering to a range of client needs. Moreover, multi-cloud environments improve cybersecurity by diversifying risk across multiple platforms, mitigating the impact of potential breaches or downtime while meeting various customers’ security requirements for different types of data.

The complexities of multi-cloud environments

1. Differentiation of cloud services. Variations in interfaces, tools, and functionalities across cloud providers create hurdles in achieving seamless communication across multi-cloud platforms. These complexities intensify when integrating or synchronizing data and applications across multiple cloud environments for multiple organizations.

2. Management and automation. Managing workflows and automation processes across various clouds can be challenging. MSPs often require monitoring and optimization tools to effectively manage deployments, resources, and configurations.

3. Cost optimization. Managing costs across multi-cloud environments poses a significant challenge for MSPs. Different cloud providers have varying pricing structures, making estimating and managing expenses a complex challenge. The management and allocation of customer billing processes across multiple organizations adds an additional layer of complexity.

4. Technical efforts for setup and operation. The deployment and operation of cloud architectures demand substantial technical resources, both in terms of time and cost. Developing the technical skills to maneuver and manage across different clouds amplifies this challenge, impacting the ability of MSPs to provide cost-effective and comprehensive multi-vendor solutions.

Parallels RAS: Addressing Multi-cloud challenges for MSPs

Parallels RAS emerges as a pivotal tool for MSPs seeking to overcome the issues of multi-cloud environments, streamline operations, and mitigate complexities for managing multi-cloud setups, simplifying administration by enabling centralized management.

Parallels RAS can be deployed across multiple public clouds including AWS and Azure and in on-premises data centers, all managed from one single admin console or single pane of glass.

1. Simplified integration. Parallels RAS offers a unified interface, streamlining the integration of disparate cloud infrastructure services. A single management console minimizes the efforts required by MSPs for deployment, management, and administration, particularly in multi-vendor environments. All of this is made easier through a single license model, without the need for additional complex add-ons.

2. Technical skills and training. Parallels RAS minimizes the demand for specialized cloud-specific technical skills. Its user-friendly interface empowers MSPs to efficiently manage multi-cloud environments without extensive upskilling, retraining, or hiring efforts. What’s more, Parallels RAS includes technical training free of charge for all partners, reducing technical barriers and facilitating smoother integration and operation.

3. Facilitating transition. Parallels RAS aids in the transition from single-cloud to integrated multi-cloud setups. Its capabilities enable seamless migration of workloads and services, crucial for MSPs wanting to adopt a multi-cloud approach or switch vendors, avoiding vendor lock-ins.

4. Increased security. Parallels RAS adds to the security advantages of centrally managed published resources with extra layers of protection such as 2FA/MFA and smart card access, client policies, and granular filtering.

As managed service providers look to multi-cloud deployments and solutions, Parallels RAS emerges as a critical partner, empowering MSPs to overcome technical barriers and deliver seamless, value-driven services within multi-cloud environments. Discover how Parallels can empower your MSP!

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Parallels 
Parallels® is a global leader in cross-platform solutions, enabling businesses and individuals to access and use the applications and files they need on any device or operating system. Parallels helps customers leverage the best technology available, whether it’s Windows, Linux, macOS, iOS, Android or the cloud.

Why is cybersecurity compliance challenging for financial institutions?

Have you ever thought about what it would be like to open a bank? 

Arguably, today it’s easier than ever to start a new bank. The popularization of internet banks and online banking means you no longer need ATMs, hard currency, vaults, physical branches, tellers, or security guards.

So why isn’t everybody just doing it?

It’s the regulations.

To run a bank, you’ll need to navigate a multifaceted, regularly shifting environment where regulations, laws, and standards are complex, demanding, and sometimes contradictory. Right off the bat, this requires a non-trivial effort to understand the legal intricacies, nuances, and ramifications of compliance.

Then, you’ll need to spend time and money ensuring the right tools and processes are put in place to ensure compliance with all requirements.

Let’s examine the many cybersecurity compliance hurdles financial institutions face.

Stringent cybersecurity regulations #

Imagine Huxley Credit Union is coming to a web browser near you. Here’s what you must comply with for cybersecurity if you start a local credit union doing business only in the United States:

This cornerstone regulation mandates financial institutions, including credit unions, to implement security measures to protect non-public personal information (NPPI) of members. The Federal Trade Commission (FTC) Safeguards Rule under GLBA sets specific security standards and incident reporting requirements.

This anti-money laundering (AML) and cybercrime prevention law requires credit unions to establish AML programs, conduct customer due diligence, and monitor transactions for suspicious activity. Robust cybersecurity measures are vital for effective AML compliance.

(Not to be confused with CISA, the DHS agency.) This law encourages the sharing of cybersecurity threat information between private sector entities and the federal government. While not a direct compliance requirement, credit unions may participate in information-sharing initiatives to enhance their cybersecurity posture.

The NCUA issues regulations and guidance related to information security and cybersecurity for credit unions. Credit unions must follow NCUA guidelines to ensure the security of member information and avoid regulatory enforcement actions.

Credit unions may be subject to state-specific data breach notification laws, which require prompt disclosure of security incidents involving personal information. Examples include Massachusetts’s 201 CMR 17.00 or New York’s 23 NYCRR 500. Failure to comply with these laws can lead to penalties imposed by state regulators.

Industry standards and frameworks #

There are other frameworks for the industry that apply as well:

If a credit union processes credit or debit card transactions, it must comply with PCI DSS requirements to secure cardholder data and payment systems. Non-compliance can lead to fines imposed by payment card networks.

While not a regulation, the FFIEC CAT provides a framework for self-assessing cybersecurity preparedness. Credit unions using the CAT demonstrate proactive adherence to best practices.

This is a voluntary framework for managing cybersecurity risks. Implementing relevant parts of the framework can improve a credit union’s overall cybersecurity posture.

To recap, all the above are just for cybersecurity. There will be other regulations to consider for the rest of the business — each with their own requirements and standards to meet.

Compliance is ongoing — and regulations change #

Setting up tools and systems to ensure compliance isn’t a one-and-done event either.

Compliance is a continuous process. And to make matters worse, regulations change — with the updated versions imposing new or altered requirements. For example:

  • 2021: Clarifications on multi-factor authentication (MFA) and risk assessments.
  • 2020: Updates on incident response, encryption, and vendor management.

  • 2020: Version 4.0 released with updated requirements for encryption, logging, and vulnerability management.
  • 2019: Updates in version 3.2.1 on incident response and service provider controls.

Ongoing amendments and interpretations focusing on cybercrime prevention and suspicious activity monitoring.

The cost of falling behind #

Failing to keep up with regulatory changes can have substantial material impacts, alongside the reputational damage.

In 2023, OneMain Financial Group paid a $4.25 million fine pursuant to a consent order to settle alleged violations of NYDFS’s Cybersecurity Regulation (23 NYCRR Part 500). These included improperly storing passwords and not sufficiently managing risk from third-party data storage. Even though the regulation became effective in 2017, the consent order cited violation as late as 2021, indicating a significant failure to keep up with regulatory changes.

Regulatory language is open to interpretation #

Different interpretations of the language used in regulations can lead to additional costs or unexpected penalties.

Real-life example: Interpreting requirements

In 2003–2004, I led numerous secured email projects to help bring institutions into compliance with a new regulation. In particular, we had to ensure that all email communication between the company and its customer was secured.

All but one of my customers interpreted the regulation to mean they had to authenticate the recipients. It took additional cost and effort to maintain a database of email addresses and passwords, and support the forgotten password and password reset functionalities, but was deemed necessary.

There was one exception among my customers who interpreted the regulation more minimally. This company believed that the payload had to be encrypted in transit, but no more. Hence, we implemented a one-click, passwordless envelope.

I’m not aware of what’s happened since then. If it turned out that they were never in violation due to this interpretation, then many other institutions spent more time, effort, and cost than necessary for compliance.

How to define ‘material’? #

More recently, the Security and Exchange Commission (SEC) released an update stating:

“The new rules will require registrants to disclose on the new Item 1.05 of Form 8-K any cybersecurity incident they determine to be material and to describe the material aspects of the incident’s nature, scope, and timing, as well as its material impact or reasonably likely material impact on the registrant. An Item 1.05 Form 8-K will generally be due four business days after a registrant determines that a cybersecurity incident is material.”

How an institution interprets ‘material’ can materially impact cost and effort (pun intended).

A bank may expose itself to fines or penalties with a stricter interpretation of ‘material’. While with a looser interpretation, it may end up doing unnecessary work.

Unfortunately, regulatory deadlines typically apply to large swathes of institutions simultaneously. So you can’t wait to see how the agency judges your peers and then act accordingly.

Customer expectations shape what’s viable #

Even when — or especially when — financial institutions are expending significant effort on compliance, they mustn’t lose sight of the fact that their primary purpose is to service customers.

Borrowers and depositors come from all walks of life, with varying levels of tech-savviness and tolerance for hurdles to accessing and moving their money.

Compliance could be easier if banks could put more onus on customers. But if a bank required a retinal scan for each online banking login, customers would offboard in droves.

Following regulations would be less complicated if banks could spend a longer period undertaking certain processes. But if a bank took three weeks to vet a digital transfer, they would lose out to their speedier competitors.

Even the data doesn’t make it easy to comply #

Complying with these various regulations and requirements would be challenging enough if each bank had just a single database. But that is not remotely the case.

Financial institutions deal with millions, even billions of records, typically spread across several databases and systems: countless customers, accounts, transactions, financial instruments, and internal operations.

Transaction data, in particular, stands out as a data type with extremely high velocity. This makes it difficult to conduct any sort of real-time monitoring that regulations may require. Monitoring is made even harder given that the data is often unstructured (e.g. email messages) or binary (e.g. uploaded screenshots or Microsoft Word documents).

Compounding the problem, financial data often comes from legacy systems. Compliance when working with legacy data from legacy systems becomes drastically more difficult.

Real-life example: Making sense of Kafkaesque legacy data and systems

Several years ago, I was building a secured messaging system for a bank. They had three different types of global unique identifiers (GUIDs). (Yes, I realize that those aren’t truly GUIDs, but that’s what they called them.)

Even further back in time, the three different types of GUIDs had been pulled into a single denormalized table. A customer could have one, two, or three of these GUIDs, in any combination!

My code had to painstakingly examine other fields to see which GUID to use for which purpose, and to extract data from other systems. To make things more Kafkaesque, the GUIDs were called TBP, CIF, and UWN, and no one could tell me what the acronyms stood for.

Exchanging data with (many) third parties #

Let’s not forget that it’s not just the data stored in-house that needs managing in a compliant way. Banks are also responsible for ensuring data security and compliance when data is shared with or handled by third parties.

Here is a non-exhaustive list of third parties that banks typically interoperate with:


ACH Network, Zelle, Fedwire, Real Time Payments (RTP), Visa Direct, Mastercard Send, SWIFT, SEPA, CHIPS, TARGET2, Visa, Mastercard, American Express, Discover


The Clearing House Payments Company (CHIPS), Depository Trust & Clearing Corporation (DTCC), National Clearing House (NCH)


Fiserv Cardholder Verification Value (CVP), Early Warning Services (EWS), Riskified, Accertify


Moody’s Analytics, S&P Global Market Intelligence, LexisNexis, Dun & Bradstreet


Experian, Thomson Reuters, Finastra, Regulatory Reporting Services (RRS)


Bolero International, Marco Polo Trade Finance Network, Traxys


Microsoft Azure, Amazon Web Services (AWS), Google Cloud Platform (GCP), Core banking platforms (e.g., FIS, Jack Henry)


Coinbase, Gemini, Circle

Ensuring cybersecurity compliance #

From keeping up with changing regulatory requirements to meeting customer expectations, and from deciphering ambiguous meanings to unpacking legacy data, cybersecurity compliance is a complex challenge for financial institutions.

They face a huge array of complicated and continually evolving regulations, laws, and standards on cybersecurity. Ensuring compliance with these requires a comprehensive and robust security program, including tools and processes to generate periodic reports or disclosures, processes to remediate any violations, and the staff to make it all happen.

And while all of this costs time and money, the costs of non-compliance — either through fines or cybercrime — are considerably heftier.

All of this is why you won’t, after all, see Huxley Bank in a web browser near you any time soon.

Try runZero for free

Find out what’s connected to your network in less than 20 minutes.

Start trial

Join our team

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.