NEW YORK—Credit unions were offered “lessons in protecting the online channel” by the former CIO of the White House.
Theresa Payton, who served under President George W. Bush, told the PSCU MoPRO meeting here her goal is to get credit unions prepared for “what’s getting ready to happen. I want to empower you to do something different. It’s my belief the reason we keep having the biggest, baddest breach every year for each of the past five years is that we’re not doing something right”
Theresa Payton at PSCU MoPRO meeting.
Payton cautioned credit unions to be realistic and realize that data breaches are “when” and not “if” events, and that the real challenge lies in reacting to the damage. She said the average time that “bad guys are in a network” is approximately 219 days, but that most organization’s IT teams only retain logs for 90 to 120 days, and when they are destroyed the evidence is, as well.
While many organizations talk “zero tolerance” of cyber-attacks, the reality is it’s impossible, she said. Payton cited a Bloomberg study of banks, utilities and phone carriers, and found that if those industries attempted to eliminate 90% of the threats, it would cost approximately $45 billion a year. That figure is nine times the funds budgeted for such protection.
“So we can not spend our way out of this. It requires designing for the human, and not the system. We’ve missed it. We’ve designed for the system all along,” she said.
Payton, who showed a video of military teams trying to react to a cyber-attack in a test—all of which failed—said she has taken three lessons away from her career in banking and at the White House, which she defined this way:
- Creative and innovative approach.
- Safety nets (because humans happen).
- Neighborhood Watch.
Creative & Innovative Approach
At the White House, she said hat when it came to dealing with the human aspect, it found the “Blackberry Happy Meal” to be an effective strategy. That came about after Payton said she noticed there was often a long delay before government workers notified the White House of a lost Blackberry. Her team investigated and discovered three reasons:
- The language drilled into people during training, specifically being prosecuted “to the fullest extent of the law,” sacred people.
- The training briefing was designed for compliance, not for the human, and came with a 45-minute session and a large binder. While it still had to distribute the binder, it boiled the training session to five minutes. And that’s where the Blackberry Happy Meal was introduced. Employees were given a clear Zip-Lok bag with their Blackberry, a business card stressing two points (call us if you lose your Blackberry and if you’re traveling, the Blackberry may not need to travel with you), and White House swag, such as pens and M&Ms. “The unexpected benefit was yes, people called us earlier to let us know of lost Blackberries, but people from other offices saw this and that created Blackberry Happy Meal envy. So people started calling and asking for a security briefing.”
Safety Nets
Safety Nets, said Payton, are all about knowing an organization’s assets. “Breaches happen. Don’t let it be a total disaster. Be thinking about what does your data architecture look like and where you’re putting a lock?’
Neighborhood Watch
To illustrate this point, Payton drew on Marvel Comic’s “Fantastic Four.” The Fantastic Four: C-Suite plus the board. The Invisible Woman is customer/member service, marketing and communications. The Human Torch are the business units and customers. And The Thing is Data Security.
“Make sure to get the whole team involved,” she said. “This is not an IT problem, this is a team sport. You will lose if only your IT team is thinking of security. Who’s voice needs to be heard in the room at all times? The members. And your member relations and marketing teams are usually the closest.”