Robust cyber hygiene is the bedrock of cyber defense and resilience

The fundamentals of cybersecurity are essential to financial services firms’ security and business operations. FS-ISAC developed these 15 recommendations appropriate for all levels of cyber maturity, using a risk-based approach and Defense-in-Depth principles. Though some fundamentals are regulatory requirements, all are necessary, and will help financial services institutions at any level of cyber maturity remain secure and resilient. Click on the title for basic guidance and use the arrows for more advanced insights.

Know your network

You have to know your system to defend it – but networks are always changing. To know your network as it evolves, keep and update lists of the hardware, software, and apps attached to your system physically, remotely, and on the cloud. If others are authorized to add assets to your network, survey employees periodically to get an accurate view of your network.

Inventory

Scan the enterprise annually with various packet types to inventory the assets connected to the network. Collect data from Active Directory (AD), Single Sign-On (SSO), Multi-Factor Authentication (MFA), Virtual Private Network (VPN), Intrusion Detection Systems (IDS), Deep Packet Inspection (DPI), and Mobile Device Management (MDM) systems. Get information from vulnerability scanning tools, asset inventory lists, and purchase orders. Create a list of your servers, end-user and network devices, software, credentials, service providers, and audit logs.

Data

Assess the processes and technical controls you use to store, move, dispose of, and restore data.

User Access

Review controls regarding user account authorization (including creating, assigning, and revoking administrator and service accounts), and access privileges.

Security Processes

Identify security processes and tooling across your network infrastructure, assets, and user base, including your protocols and controls for remediation, mitigation, and resilience.

Test

Determine the security of your network with penetration testing (pentests) that identify vulnerable points in people, processes, and technology.

EDR

Use an Endpoint Detection and Response (EDR) system to monitor and record end-user/endpoint devices and activities. EDRs also help you detect and block malicious activity and give you remediation suggestions if the system is attacked.

Regularly update and patch software

The simplest, easiest defense strategy is to implement your software providers’ updates and patches. Those updates repair security holes, protect data, remove bugs, and help keep you compliant. Some updates and patches improve functionality and remove outdated features as well.

Updates

Inventory, prioritize, monitor, and test updates. Look for and remove outdated and unused software and links as well – threat actors look for expired SSL certificates, broken links, and other weak points.

Antivirus software

Enable real time detection for antivirus software. When new antivirus software is released, install it on all hosts.

Testing

Always test patches in a separate test environment that closely mimics your production environment to prove that the patch works and to determine if it interferes with your other software, hardware, or settings. For internally developed software, monitor open-source libraries and frameworks for updates.

Encrypt data at rest and in transit

Data encryption safeguards data from malware and ransomware attacks, which is especially important when working with customer names and account numbers, among other sensitive data. For data in transit, use at least WPA2 encryption on WiFi systems – every router accepts it – but if appropriate, use WPA3-Enterprise as it has stronger cryptography.

Separate Keys and Users

Keep encryption keys separate from the data, and the user roles separate from access restrictions. Consider using a key vault, which is a cloud service for storing and accessing data that should be kept secret.

Backups

Make sure all backup data is encrypted, can’t be altered or deleted (i.e., immutable), and covers the entire organization’s data infrastructure. Financial institutions can use the Sheltered Harbor format to back up data every night into an encrypted, unchangeable, and air-gapped data vault, either their own or a service provider’s (and if your institution encounters a catastrophic failure, you’ll be able to restore critical systems while you work to get back online).

Data at Rest (DAR)

Employ independent data at rest (DAR) encryption and decryption by default, with governance to validate process adherence according to regulatory requirements and sector best practices for data movement platforms, depending on jurisdiction and type of data. Data decryption should occur outside the data movement platform. Isolate platforms, especially those with opaque internal risk controls, using a defined segmentation strategy.

Restrictions

Restrict access to these platforms at the IP address level and/or mutual TLS authentication. Adopt a “known good” strategy -- including FIM, EDR, DBAM, DLP, and WAF, and ensure vendors support it -- using a least-privileged access approach. Monitor access control lists routinely.

Key Rotation

Change the keys every 90 days using NIST standards.

Use strong passwords for every employee, device, and account

Financial institutions are required to change passwords periodically, and the National Institute for Standards and Technology publication, NIST SP 800-63B Digital Identity Guidelines says, “Users should be encouraged to make their passwords as lengthy as they want, within reason. Since the size of a hashed password is independent of its length, there is no reason not to permit the use of lengthy passwords (or pass phrases) if the user wishes.“ To be on the safe side, a password should have 12 characters or more. The more random the password, the better – words found in the dictionary are easy to hack, attackers can use personal data like birthdays to steal personal information, and passwords using only letters can be cracked in minutes. And never use a personal email address as a User ID.

Change Passwords

Every 30 to 60 days, or immediately in case of a breach.

NIST Standards

Any account that requires a password -- service accounts, admin accounts, and domain admin accounts – should comply with NIST standards for developing and managing password policies. NIST also recommends creating passphrases using symbols and numbers instead of passwords.

Password Managers

Add a layer of security with password managers that encourage much stronger passwords (without driving users to write them down).

Privileged Accounts

Passwords to system-level privileges should be different from any other password held by that user, and those accounts should be audited quarterly.

Passwordless authentication

Methods that use fingerprints, proximity badges, token codes, or single sign-on systems are more secure and less complex for IT and users. If your firm is equipped to incorporate passwordless authentication, it should.

Require MFAs

Multifactor authentication (MFA) presents a big obstacle to adversaries – Microsoft studies show that accounts using MFA are more than 99% less likely to be compromised.Use MFAs on all accounts, internal and external, with no SMS push.

Help desk

Require MFAs for all interactions with the help desk voice channel.

MFA Enrollment

Require and confirm MFA enrollment for all devices, establish email alerts on all new registered devices for MFAs, require manager approval through the formal access provisioning process, and use FIDO/passkey MFA for external access. Keep the internal and external access lists separate.

Throttling

Establish MFA throttling limits.

Use a zero-trust, least privilege policy with MFA

A zero-trust policy requires validation of everyone who requests access to applications and data, every time. “Least privilege” gives only as much access as the user needs, and only to those who should have access. MFAs require two types of credentials. Tripling your barriers makes infiltrating your system much more difficult for threat actors.

Restrict services

Require phishing-resistant MFAs for all services, particularly for webmail, virtual private networks, and accounts that access critical systems, such as SaaS (Software-as-a-Service) providers. Do not use email-based MFAs.

Logins

Don’t permit anonymous logins, and monitor privileged logins for unusual activity, including geographic and IP diversity and frequency.

Privileged Accounts

Move accounts for occasional administrator access into a non-administrator user account, and audit elevated account privileges once a quarter to remove unused accounts.

Block Legacies

Block accounts that aren’t needed – often for third-party suppliers or temporary contract workers – but remain in your identity store. Blocking legacy accounts is often more effective if done in phases, such as disabling basic authentication on a per-protocol basis by applying Exchange Online authentication policies, then blocking legacy authentication via Conditional Access policies.

Use VPNs

Virtual private networks, or VPNs, encrypt data in transit. Use VPNs on all internal services. VPNs are especially important when people work offsite.

Anonymity Rules

Have rules to detect and prevent users from logging in anonymously to VPN services. Leverage known anonymous VPN IP Address categorization lists or feeds.

VPN Access

Disable or restrict internet access to your VPNs and select which devices can access VPNs at all (e.g., only corporate devices, only devices with certain up-to-date controls running, etc.).

VPN Configuration

Configure VPNs with MFAs

Use backup systems to duplicate data and system configurations

Backup systems make a copy of a computer’s state, files, data, and other information so that you don’t lose anything in case of accident or attack. You can store that data on your own local server or on a third-party remote server. Either way, backup systems are fundamental to cyber resilience and operational continuity. Financial firms can use the Sheltered Harbor format to back up data every night into an encrypted, immutable, and air-gapped data vault.

Recovery

Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a geographically separate, segmented, and secure location (e.g., hard drive, storage device, the cloud). Test the recovery plan periodically to make sure it works. Maintain backup and restoration so interruptions will be less disruptive, and your data will be retrievable.

Encrypt Backups

Ensure all backup data is encrypted, immutable (i.e., cannot be altered or deleted), and covers your entire institution’s data infrastructure.

Independent Data at Rest

Employ independent data at rest (DAR) encryption and decryption by default, with governance to validate process adherence according to regulatory requirements and sector best practices for data movement platforms, depending on jurisdiction and type of data. Data decryption should occur outside the data movement platform. Isolate platforms, especially those with opaque internal risk controls, using a defined segmentation strategy.

Develop an incident response plan specific to attack type

Incident response plans outline the security and recovery activities your institution will take before, during, and after a cyber incident, natural disaster, or unplanned outage. Plans should be formally approved by your senior leadership team in alignment with your risk management policies and compliance requirements, and updated as systems and market conditions change.

Set Roles

Establish authorities, roles, responsibilities, and procedures with a list of key personnel in senior management, the Board of Directors, cybersecurity, legal, operations, communications, HR, law enforcement, and key partners. Some firms should also include major investors and/or outside counsel in their key personnel list. Record their personal contact information – adversaries don’t always attack during business hours. All relevant personnel should participate in cybersecurity exercises.

Disconnection

If the plan includes disconnection, detail how the compromised system will be deactivated and isolated and the alternative activated. Inventory hardware, software, and critical data necessary for both approaches. Determine criteria for reconnection.

Exercise Plans

Test your incident response plans in a real-world scenario once a year to ensure they are current with your environment and to identify gaps. Exercises also build muscle memory that will make your response to an attack more effective.

Use firewalls, configured closed by default, with active blocking

Firewalls check and log all incoming and outgoing traffic for malicious material – like malware – with security rules that block threats. Configuring them closed by default prevents accidental or unknown gaps in your defenses.

RASP

Firewalls don’t mitigate every vulnerable application. Reinforce security with a Runtime Application Self Protection (RASP) solution.

IP Source Routing

Set firewalls to block traffic containing IP source routing information. Attackers use them to build packets that bypass network security controls, and benign usage is rare.

Train employees on their role in cybersecurity

Security is everyone’s job, so teach employees how to safeguard your systems. In particular, emphasize their role in thwarting phishing scams, because adversaries typically target people, not systems. Generative AI can create scams without the telltale grammatical errors, so teach staff to think in terms of behavior – “would this person make that request?” – along with standard red flags like overly urgent language, requests for payment or personal information, notices of “suspicious activity or log-in attempts,” or claims of account problems.

Reporting

Make reporting suspicious activity easy. Your email system may even permit you to pin a reporting button on the top ribbon.

Passwords

Teach employees why passwords matter to every level of cybersecurity, how to draft strong ones, why it’s necessary to change passwords often – and that passwords should never be written down.

Keep a log of system activity

Logs collect, process, and analyze data from programs and applications. That’s crucial information in an attack – you’ll be able to spot the problem faster and mitigate it sooner. That data also helps you improve your system’s performance and is necessary in compliance reporting.

Policies

Set retention and indexing policies that accord with your firm’s regulatory requirements. Some log software automates compliance reporting, as well as operational performance, resource allocation, and cybersecurity information.

SIEM

Aggregate logs in a Security Information and Event Management (SIEM) system to get contextual information about users, assets, and vulnerabilities, identify and prioritize threats, and spot suspicious activity.

EDR

Use an EDR to record end-user/endpoint devices and activities, increase visibility into incidents, and conduct incident data searches (as well as alert triage and malicious activity detection and containment).

Use secure configuration management

Configuring systems, hardware, software, and apps according to your regulatory requirements and business operations reduces vulnerabilities and helps maintain compliance (default settings are often too permissive for financial services institutions). Monitor and revise configurations so that they remain effective as your business functions and services evolve. You can find thousands of publicly available OS and app security configuration checklists from NIST’s National Checklist Program, and the ISO offers guidelines for configuration management.

Disable

List all the components in the system, and disable unnecessary functions, settings, and services. Disable any auto-run feature that allows file execution without authenticated users, and authenticate users before allowing them system access.

Baseline Security

Define baseline or standard security specifications and monitor deviations. Change baseline configurations as necessary to increase security or to conform to new regulations. Analyze the security implications of configuration changes and document those that are implemented.

Close Firewalls

Configure all firewalls closed by default.

Audit

Periodically scan for missing patches, misconfigurations, use of default accounts, unnecessary services, etc.

Environments Configuration

Configure development, production, and quality assurance environments identically, but with different credentials for each.

Cloud Configuration

Cloud configurations define, maintain, and safeguard your workload and data on cloud servers. Security configurations – such as rules regarding access, firewalls, and permissions – should be set in collaboration with the cloud service provider. Best practices include requiring separate subnets, MFA, least-privilege access, network security groups (in Azure), and regular audits.

Incorporate application security controls

Apps open new threat vectors that adversaries can use to breach your system. The security controls that protect your system should be used for each app singularly. You have more control over the software development lifecycle (SDLC) for apps developed inhouse -- particularly coding, data storage, and authentication -- but you can reduce risks associated with third-party apps by monitoring how your app vendors delete, create, or change user IDs, how they store and transmit data, and that their activities conform to the agreed-upon service.

Updates

Install app software updates and patches as they become available.

User Access

Control access to sensitive data by limiting, monitoring, and logging all user access to your apps, including those of vendors.

Education

Train employees on app security, especially the potential for social engineering attacks conducted through apps.

Harden your API controls

APIs (Application Programming Interfaces) are a kind of software that allow you to share and receive data -- within your institution and with other organizations -- across servers that couldn’t otherwise communicate. The two most common types of APIs are REST (which use HTTPS and token-based authentication) and SOAP (which has certain security features built in). But because APIs transmit such sensitive data, threat actors target them with various attack methods, such as man-in-the-middle (MITM) or distributed denial-of-service (DDoS) attacks.

Vulnerabilities

Look for specific weak points or risks, such as SQL injections, and use rate limits to protect API backends. Use security tokens to authenticate and control system access. Throttle and set quotas to limit the speed and amount of data that can be transferred through the API. Monitor for software updates, patches, and API drift.

OAuth, OpenID Connect

Use Open authorization (OAuth) and OpenID Connect (OIDC) so that information is only transferred to users with verified tokens or credentials.

API Gateway

Insert an API gateway between the client and the backend to authenticate traffic.

Encryption

Use encryption protocols appropriate to the API, such as TLS for REST APIs. Require signatures to ensure that only authorized users decrypt and modify your data.

Additional Resources
Join Our Member-Driven Intelligence Community Be where trust meets action, proactively defending the security of your firm and the global financial system
Become a Member →