1 Combatting Breach Fatigue Presented to MidSouth Users Group October 2015

2 The Problem at Home 63%* of all Americans say in the past year, they or someone in their immediate household received at least one message that their confidential information had been exposed in a data breach. Americans know its no longer a matter of “if” their information is compromised, but rather “when”. *US News Report; November 2014

3 The Problem at Work Information Overload 5029 data breaches were reported from * Banking/Financial sector increased to 13.8% of reported breaches in 2014* had an AVERAGE of 15 data breaches a week* New Regulations addressing Cybersecurity are CONSTANT *Verizon Security Report 2015

4 The Result Simply explained: the more breaches you are exposed to about without experiencing a direct and tangible financial consequence, the less likely you are to care or worry about the next breach, or the next one, or the one after that, to the point that data breaches won’t even be news anymore. That can result in a HUGE risk for all involved. Lorem Ipsum has two main statistical methodologies are used in data analysis which summarizes data. Recent Large Data Breaches Updated 10/2015

Give 1-2 tactical steps to take after a reported breach that your people can take to secure themselves from being a victim of a similar attack. Give Tactical Steps When a breach is publically reported, let your people know what category it is. Don’t let the news channels set the tone. Raise Awareness of Severity Like hurricane’s, breaches should fall into ranked categories. Try a 1-5 scale. Categorize Breaches Give constant reminders of information security best practices. It’s the small things that really matter. Publically catch them doing good! Reinforce the Basics 04 Combatting Breach Fatigue – Customers, Employees and the Board

6 Combatting Breach Fatigue – Information Technology Understand the cause and type of breaches, so your effort can focus where the greatest threats are. Make sure your staff knows what is affecting banks!breaches 1 Use checklists to ensure you have the basics covered consistently. It’s easy to forget things that aren’t on fire.checklists Participate in Users Groups and Peer Groups. Don’t just show up, but get involved. It helps to know you’re not alone in the battle. When completing the FFIEC Cybersecurity Self- Assessment tool, start with the Baselines first. Don’t try and tackle everything from the get-go.Baselines Remember the categorization. Not all breaches (or regulations!) are a category 5, no matter how loud someone yells Start where you are. If you wait for everything to be perfect, you’ll never begin. Taking one step is progress.

7 Causes of Breaches

8 Questions? Beth Fox