Mortgage Software Solutions Blog

Mortgage Lenders Look to MicroSecure Online Password Guidelines

mortgage lenders look to microsecure online password guidlinesBarbed wire, a chain-link fence, and a camera combine to provide a high level of security.

Microsoft reports over 10 million username/password pair attacks against their users each day. As one of the largest Identity Providers (IdPs) in the world, the company is in a unique position to recommend how to best handle cyber security.

The Microsoft user community’s updated guidance for secure password creation has been available since May 2016. Companies in the financial sector can follow Microsoft’s guidelines for password creation to ensure superior user security with their online mortgage software.

Here is the most up-to-date advice for creating secure passwords. Mortgage lenders can follow these guidelines to keep online account hackers at bay.

IT Administrators Are Responsible for Setting Password Parameters

Though users ultimately invent the password for their account, IT administrators play a role in regulating the end level of security. The parameters that a mortgage lender’s IT team sets for users will dictate how secure the resulting user passwords are.

Microsoft suggests:

  • Maintaining an 8-character minimum length requirement
  • Banning universally common passwords
  • Educating users not to mix the usage of passwords for work and non-work accounts
  • Enforcing registration for multi-factor authentication
  • Enabling risk based multi-factor authentication challenges

In the face of data collected at Microsoft’s cloud-based directory and identity management service Azure Active Directory (MS AD) login, other long-held practices in password parameter setting have been abandoned. Microsoft no longer recommends character-composition requirements and mandatory periodic password resets for user accounts.

In fact, these outdated policies were found to increase the facility of hacking username/password pairs. For example, users prompted to create new passwords frequently often default to choosing weaker passwords or making slight variations on old passwords to guard against forgetfulness.

User Tips for Creating a Unique Microsoft Password

With IT parameters in place, the ultimate creation of the password is up to the user of the online account. For mortgage companies using MS AD for their cloud-based platforms, these tips can be disseminated to loan officers to encourage cyber security within the company. In the case that a hacker gains access to a loan officer’s email, these tips can prevent the attacker from taking over other accounts.

Microsoft suggests that users:

  • Avoid re-using passwords or variations on a theme for various online accounts
  • Avoid single words (e.g. “password”) and commonly-used phrases (e.g. “mynameis”)
  • Avoid personal information that can be guessed such as pet names, favorite hobbies, or numbers from your birth date

By following these guidelines for a secure password, lenders can keep online accounts safe from cyber security events. This, in turn, protects the sensitive personal data of lending customers kept in online mortgage software platforms.

Further Recommendations for Microsoft Account Security

Beyond guidance for IT administrators and users, Microsoft offers common sense recommendations to all their partners and clients.

The tech giant’s general recommendations are to keep security information up to date, turn on two-step or multi-factor authentication (MFA), be careful of suspicious emails, avoid clicking on unfamiliar links, update all work-related computer programs and operating systems, and make sure to install and use regular antivirus applications on staff computers, tablets, and mobile devices.

With its place at the leading edge of MS AD surveillance, Microsoft has a particularly good vantage point to recommend useful and lasting guidelines for evading hackers. The recommendations offered are applicable for avoiding cyber attacks on Microsoft and other accounts with online access.

Financial institutions can protect their staff and customers by creating secure passwords and by implementing security measures like ABT’s Email Guardian designed specifically for mortgage lenders.

Image: Pexels

Topics: creating strong passwords cybersecurity mortgage industry Mortgage Lending password

ABT Leads the Digital Transformation of the Mortgage Lending Industry

ABT Leads the Digital Transformation of the Mortgage Lending IndustryA laptop on the desk of a finance professional.

There is no slowing down for mortgage lenders in 2018.

Mortgage volume in the US is expected to grow and according to National Mortgage News, lenders increasingly view technology as a way to gain a competitive advantage in the growing market.

While some lenders embrace the efficiency that technology gives to the industry, a full 29% describe technology initiatives as a “necessary evil” of the industry.

Access Business Technology, a California-based fintech company, is determined to bring the industry up to speed and usher in the digital transformation of the mortgage industry.

ABT Deploys Quality Hardware & Software

Access Business Technologies (ABT) is a fintech consultant focused on technological advancement for the finance world. The company deploys both hardware and software meant to advance the technological capabilities of their clients.

For hardware, ABT deploys the Surface Pro armed with MS Office 365 for finance professionals who need the best tools for communication and collaboration. This combo provides a quality all-around foundation for finance-focused companies looking to standardize or reduce their device inventory.

ABT is also software developer with award-winning platforms created specifically for mortgage lenders. They have an array of software solutions for lenders that are up-and-running quickly while providing a seamless work environment for staff.

By working with a fintech expert like ABT, lenders save money and get a premium setup with premium service from a single channel.

ABT Provides Secure Cloud-Based Infrastructure

Quality software and hardware are not the only considerations for ushering in an age of technology in the mortgage industry.

Infrastructure also affects staffing. How can mortgage companies attract the best talent?

Flexjobs, a resource for remote workers, reports that workplace flexibility is becoming more important. From 2014 to 2017, the number of people who quit a job due to lack of flexibility has doubled.

Cue the new standard for business: the cloud-based work environment.

The cloud-based platforms that ABT offers to the world of fintech are a major solution to the increasingly remote work environment. Clients who migrate to the cloud don’t need to worry about scaring away talented finance professionals who demand flexibility.

Though the cloud is a relatively new requirement for finance companies, ABT has ensured that security is a first priority. ABT, with its finger on the pulse of the mortgage industry, has focused their fintech developments on cyber security and ensuring that data breaches are not a danger for their clients.

ABT provides cloud-based protection for Office 365 email from being hacked. ABT also provides a host of safeguards including multi-factor authentication, phishing protection on email, as well as encryption and security programs for lost or stolen devices.

ABT is the Mortgage Industry Tech Expert

With hardware, software, cloud-based infrastructure, and cyber security covered, ABT has set a new bar for fintech in financial institutions.

The push to remain at the cutting-edge of mortgage technology comes from an understanding of the industry. ABT knows that a quality tech setup gives lenders the ability to provide the best quality of service to customers.

ABT’s drive to develop quality solutions earned the company classification as a Microsoft Gold Level Partner. As a trusted developer for Microsoft solutions and the experience of deploying Office 365 in the mortgage industry, ABT is digitally enabling a newly mobile generation of mortgage workers.

Through integration and device support, ABT allows mortgage lenders to work even more flexibly and productively.

At the forefront of fintech, ABT hopes to continue the trend in the United States of increasing mortgage volumes by continuing to accelerate the industry along a full path of digital transformation.

To find out more about how ABT empowers financial professionals by using technology to transform the way they work, check out the Access Business Technologies blog.

Image: Unsplash

Topics: mortgage software integration multi-factor authentication cybersecurity mortgage documents security cloud storage productivity mortgage business data warehousing mobile technology Consumer Finance Protection Bureau Compliance Audit cloud-based data Housing Market Mortgage Lending

4 Ways Loan Management Software Improves the Mortgage Experience

4 Ways Loan Management Software Improves the MortFinancial management software makes everyday interactions smoother for mortgage lenders.

Mortgage software has relied on legacy infrastructures and paper processes for far too long.

In almost every other sector, interactions between banking institutions and customers have moved online.

Web-based transactions for commerce are increasing annually. In 2017, global e-retail sales amounted to 2.3 trillion U.S. dollars and projections show a growth of up to 4.48 trillion U.S. dollars by 2021.  As retail transactions migrate away from brick-and-mortar, the rest of the banking world plays catch up.

In the mortgage world, loan management software offers lenders high-tech solutions to keep them on the cutting edge of the finance world.

Here are the 4 ways that loan management software improves the mortgage experience.

  1. Centralized Access to Document Management

Cloud-based domain services store data on the cloud instead of on a localized server. This gives mortgage companies access to business-critical data from virtually anywhere. Office PCs, employee-owned laptops, and even mobile devices can capitalize on business opportunities anywhere that lenders are interacting with clients.

Loan management software like MortgageWorkSpace (MWS) offers a “portal” or single point of entry to all employees with internet access.

Users can synchronize their user settings and application settings data to the cloud, providing a unified experience across their devices and reducing the time needed for configuring a new device.

Lenders prefer the speed and breadth of information that online-based software provides. When lenders have quick access, customers get quick responses and customer service is perceived as fast and convenient.

Not only does this portal make remote work possible, but it keeps things secure as the mortgage industry embraces the remote working environment.

  1. Improved Security for Client Data

This single point of access protects company assets through multi-factor authentication, ensuring that data remains secure.

Further cyber security measures are managed using Windows Defender, an anti-malware component that keeps intrusions at bay for all devices joined to the MortgageWorkSpace network.

With MWS, there is a cloud-based firewall protecting the devices joined to your lending company’s network as well.

When security events do happen, this software gives the company the ability to remove company data from a mobile device or PC via remote access. This means that even if an employee’s device is stolen, the mortgage software keeps sensitive personal and financial information safe from hackers. 

  1. Effortless Compliance

Running parallel with cyber security, this software handles compliance regarding data security without needing to purchase, integrate, or maintain separate compliance software. MSW has what the industry calls “built-in” compliance features.

Other compliance issues faced by the mortgage industry are included in MSW. Documentation, record keeping, document expiration, and record retention are all features of this platform. This means that lenders using this software are always prepared for an audit without the last-minute scramble.

 In comparison to wider umbrella software, this platform is specifically built and maintained by developers who know the mortgage world.

Developed by California-based ABT, the company is an industry leader and watches the horizon for mortgage legislation that will affect their product’s performance. Lenders using MSW can be sure their software is not only up-to-date with compliance but that it will on boarding the most important finance trends as they happen.

  1. Integration Builds Capacity

Though compliance features are built-in, the platform remains flexible so that your lending company can utilize applications that give a competitive edge.

The Mortgage BI (business intelligence) dashboard powered by Microsoft gives unrivaled visibility to company data. This leads to data-based business decisions that improve the bottom line.

Analysis isn’t limited by this platform’s own BI capabilities though. MSW is vendor neutral so it integrates with loan origination systems, CRMs, Saas apps, on-premises networks, and plenty of proprietary software that makes business run more smoothly.

The days of paper-heavy processes for buying houses are numbered.

Developers are producing these sophisticated platforms that make the mortgage process better.

New financial management software is cloud-based, safe, and expandable. Customers can now enjoy a seamless experience thanks to platforms that give mortgage lenders speed and flexibility in their work.

Good software means agile lenders, which in turn means happy customers.

Does your mortgage company have outstanding software that improves this end-to-end experience?

MortgageWorkSpace is the award-winning business solution that mortgage lenders need. Learn more by visiting ABT.

Image: Unsplash

Topics: mobile device security email security data security phishing multi-factor authentication Business Intelligence cybersecurity Mortgage BI mortgage documents cloud storage productivity mortgage business mortgage industry cloud-based data Housing Market Mortgage Lending disaster recovery MBA

How to Protect Your Devices from Bad Guys

how to protectA businessman takes his work laptop home.

What exactly happens when a company device gets stolen?

Imagine that Richard is a loan officer for a mortgage company. He is behind on email and decides to take his work laptop home over the weekend. After a few hours at a coffee shop, he gets up to use the restroom. Two minutes later when Richard returns, the laptop is gone.

Are the files on Richard’s computer safe? If Richard has remote access to company systems, will there be a data breach? Can the thief access all of Richard’s accounts and client information? What exactly is at risk here?

Keeping Data Safe from Hackers

Stolen laptops are more common than you might think.

Kensington reports that over 70 million cell phones are lost each year and one laptop is stolen in the US every 53 seconds.

The laptop thief’s hope is that he can gain access to all the passwords and sensitive information contained in the device. Selling stolen data is profitable; the device itself is not actually the most lucrative part of the theft. Getting a corporate device would be like hitting the jackpot then, right?

Well, it all depends on what kind of data protection measures the company has in place. For financial institutions dealing with sensitive personal data on a daily basis, it’s important to have a system with the most cutting-edge cybersecurity features in place.

MortgageWorkSpace, a platform that won HousingWire’s Tech100 Lending category for 2018, is one such system.

With MortgageWorkSpace protection, Richard’s stolen machine will remain on lock-down and safe from hackers.

The Windows Operating System on Richard’s computer has a program that encrypts system and user files on the device called BitLocker. The laptop also uses Windows Defender Credential Guard, a security program that uses virtualization to isolate sensitive files and keep unauthorized people from accessing that system data.

In Richard’s case, the thieves have no choice but to wipe the machine and lose all the data.

Great. Richard’s data is safe, but it’s all lost. What is he supposed to do about work?

Getting Back to Work

Richard still needs access to his files and the computer programs that he uses every day to do his job.

To make sure that Richard can return to work, MortgageWorkSpace has an advanced continuity feature called “lost device re-provisioning.” This means that when Richard’s device is reported stolen, the system shuts down his previous portal and passwords. When he authenticates his identity on a new machine, he will have all the same data from his previous machine and full access to work-critical programs.

This is the beauty of a cloud-based system like MortgageWorkSpace. All the system files are located in the cloud and not on Richard’s local machine. He doesn’t lose even a single day of work because of his missing computer.

MortgageWorkSpace uses Richard’s corporate credentials and multi-factor authentication to identify that Richard is not one of the sneaky hackers and he is back into the system on a different computer.

Richard’s company has other strict security options to choose from. For the authentication process, the company can require a user-created PIN to identify him as an employee. Some modern companies are even switching to biometric identification like fingerprint and facial recognition technology rather than PIN numbers, which can be guessed.

Whether low-tech or high-tech, the key is to have multiple authentication steps that are difficult for hackers to duplicate so that sensitive system data remains hidden from the prying eyes of laptop thieves.

More importantly, Richard’s company doesn’t experience a system-wide data breach. Forbes Magazine reports that nearly 41% of the data breach events from 2005 to 2015 were due to lost and stolen devices.

Thanks to technology, Richard’s customers’ information is safe and the company’s reputation remains intact. That’s what’ the most advanced security system has to offer the mortgage industry. . While the security gates are keeping the bad guys out, people like Richard can stay productive and customers can stay safe.

For financial institutions, this type of lost device re-provisioning feature is essential for business continuity.

Businesses protected by MortgageWorkSpace don’t need to worry when a company laptop or mobile device is stolen.  Contact us to learn more about cloud-based mortgage and cyber security solutions.

Image: Unsplash

Topics: DeviceGuardian mobile device security mobility mobile workforce mortgage company security financial data security phishing multi-factor authentication cybersecurity security cloud storage productivity mortgage business mortgage industry Housing Market Mortgage Lending

2018 Changes in Banking Technology Part II

blog pic 3Finance customers turn to mobile banking technology.

New technology continues to change the banking landscape.

For mortgage lenders, finance technology or “fintech” startups are competing to attract lending clients.

Smartphone-obsessed customers are more mobile than ever and the number of banking platforms has exploded. With 46% of consumers using only digital channels for their banking, the way that customers handle their finances is taking a huge shift.

Here are 3 more ways that new technology is changing the banking industry in 2018.

  1. Cybersecurity

Cybersecurity in the financial industry is experiencing a worldwide crackdown in response to infamous missteps in 2017.

Last year was rough. Large businesses from Uber to Equifax came clean with the public about record-breaking customer data breaches.

As a result, new regulations concerning finance-related cybersecurity have made it onto the books in the United States, Europe, and the United Kingdom. Stricter regulations even include naming and shaming in the public forum. For example, starting in 2018 the Financial Conduct Authority requires UK banks to publish data on how many complaints and security breaches they have encountered throughout the year.

Formerly held accountable by regulatory bodies within the banking industry, now financial institutions will be facing not only federal law but public opinion. With leaders like the EU, the UK, and the US taking the lead, other world markets are sure to follow.

High-tech options in identification and recognition are hitting the market as a way to shore up security. Biometric security and voice verification software are in development and beta testing. The new measuring stick for basic security begins at multi-factor authentication.

Mortgage lenders at any level would be smart to take notice and sort out their cybersecurity issues. The only other option is to risk having their name added to the growing list of internationally untrustworthy companies in the eyes of consumers.

  1. Mobile Investing

Another new technology on the market takes investment consultations out of the local branch and drops it right into the investor’s pocket.

A full 82% of 18 to 24-year-old smartphone owners say they use mobile banking exclusively. 

Feeding the demand for putting banking applications onto mobile devices like smartphones and tablets, fintech is making lending and investing more accessible than ever.

This new wave of mobile finance is letting millennial do-it-yourselfers have all the control by using plain language and visuals to explain financial terms. Bankers are replaced by explanatory screens and animations. Investment apps even let new customers dip their toes in the investing game by allowing customers to have a “practice run” before dealing with actual money.

Small-scale investment companies are reshaping the barriers to entry by allowing new investors to get in the game for as little as £250 in the UK. These game changers are coming about due to aims of open banking legislation strategies for reducing monopolies.

This new family of mobile investing apps offers greater control than traditional banks over their mobile-based portfolios, even allowing customers to pick and choose investment baskets based on trending labels like “socially responsible tech”.

  1. New Technologies

Beyond cybersecurity and innovation in mobile investing technology, there is a host of newly-developed niche finance technologies hitting the market.

Robo investing automates the risk appetite assessment process.

Full integration of voice assistants are popping up. Capital One partner Alexa can now tell customers their account balances and spending habits after a night out.

Though historically skeptical towards bitcoin and cryptocurrency, credit giant Mastercard changed their tune in 2018 and announced open support for virtual currency in the Asian-Pacific market.

It’s too early to predict which of these new technologies will have staying power and which ones just won’t stick, but they all have one thing in common. They all work on the basis of a hybrid platform that combines human and computer-based tools to carry out financial services.

These new integrations of technology into the banking world are already changing the way that consumers approach banking.

With 2018 is primed to be the year that tech saturates the finance industry, mortgage lenders and other traditional finance institutions have no choice but to take notice.

Join us at the cutting edge of technology with regulation-compliant cyber security, remote device access, and more. ABT equips mortgage lenders with the tools for success in a digital world.

Image: Unsplash

Topics: mortgage regulations mobile technology mortgage industry partnerships Consumer Finance Protection Bureau Compliance for Mortgage Companies Compliance Audit job opportunity Trump Administration Mortgage Lending

What Technology Is Changing In Banking For 2018

blog pic 4In the future, financial information and programming will be increasingly available on-the-go.

The old days of purely brick-and-mortar banks are over.

Mobile banking is the preferred platform as global smartphone use skyrockets and our preference for handheld interaction grows.

In 2011 only 10% of the world’s population used a smartphone. By 2018, that number has reached over 36% penetration.

From traditional commercial banks to finance technology or “fintech” startups, the banking industry is competing in an all-out sprint towards digital progress.

Here are 4 ways that technology is changing the banking industry in 2018.

  1. Open Banking

Open banking is a phenomenon being pushed by regulatory bodies around the world.

Lawmakers in the EU, UK, and the US have all passed legislation that takes personal financial data out of the hands of the banks and returns control to consumers.

The EU’s Payment Services Directives (PSD 2007 and PSD2 2015) will be fully implemented this year.

Together the PSDs regulate financial service providers by requiring transparency about consumer rights and the banks’ obligations to the public. They also require banks to free up customer data for third party access, limiting the power of the bank that gathered it.

The EU regulations coincide with the “Open Banking revolution” in the United Kingdom that intends to make banking more competitive for increased consumer protection. The UK also made it mandatory for all banks to provide third-party access to customer financial data using open API technology at the start of 2018.

In the wake of the Equifax data breach on the other side of the Atlantic, the United States made their move towards stricter regulations beginning in 2017 with the state of New York. US laws are focused on cybersecurity and consumer protection via speedy cyber attack reporting and increased government oversight of consumer data mishandling.

The proximity of these launch dates mean that traditional banks around the world face new technology-based limitations. Open banking and cyber security requirements leave the door open for tech-savvy challengers with a spotless reputation for safeguarding the public.

  1. RegTech

Another technology changing global banking in 2018 is regulation technology or “RegTech”.

RegTech is the umbrella term for software tools specifically designed to streamline regulatory compliance.

In the EU, RegTech has been using guidelines from the 2004 and 2011 Markets in Financial Instruments Directives (MiFID) as well as the General Data Protection Regulation (GDPR) of 2014.

Newly developed RegTech takes new 2018 regulations into account and eliminates duplication issues and insufficient data storage signposting.

Due to increased regulation, the adoption of these programs across the industry will determine which finance organizations move ahead and which ones get stuck hitting every legal bump in the road.

If implemented well, RegTech has the potential to significantly reduce risk, speed up compliance management, and control bank costs despite increased accountability.

  1. Robo Advice

“Robo advice” is the term for technology that does traditionally human jobs in investment banking.

In the past, investment managers evaluated a customer’s financial situation, communicated investment options, assessed risk appetite, handled portfolios according to client preferences, and relayed information about performance back to the investor.

Robo advice is the software and algorithms that provide these services digitally and accessibly on mobile devices like smartphones and tablets.

Millennials aged 22-37 prefer to work with apps and digital information over commercial banks. The demographic has a do-it-yourself attitude and shows an aversion to traditional banking institutions that have steered them into crushing student debt.

In fact, 75% of American millennials report trusting a financial product from a fintech company. Almost half of millennials in the US with investments report being aware of robo-advisors, while a full 11% currently use a robo-advisor exclusively.

With a frictionless user experience, robo advice may become the new norm.

  1. New Technology

In the UK, financial services newcomers are edging out traditional banks. Startup lenders like Iwoca in the UK are touted as the “future of small business lending” by using software algorithms to make credit decisions and having quick loan turnaround thanks to fintech.

By using all-digital or hybrid platforms combining human and algorithmic tools to reach customers, other digitally-native finance startups are slated to follow their lead.

Whether it’s anti-monopoly Open Banking APIs, intelligent RegTech software to handle compliance, or the growing preference for robo advice over human interaction, technology is making huge waves in the global banking industry this year.

As the digitally-native generations grow, traditional financial institutions scramble to expand their digital offerings while fintech startups flourish and join the market.

Join us at the cutting edge of technology with regulation-compliant cyber security, remote device access, and more. ABT equips mortgage lenders with the tools for success in a digital world.

Image: Visual Hunt

Topics: millennials cloud storage mortgage business mortgage regulations mobile technology mortgage industry Consumer Finance Protection Bureau Compliance Audit job opportunity cloud-based data Trump Administration Housing Market Mortgage Lending

Know Your Cyber Security Reporting Obligations

Know Your Cyber Security Reporting Obligations

New laws dictate how finance companies report security issues.

New York’s recent crackdown in state cybersecurity laws marks true reformation in the finance industry.

14 pages of detailed regulations fully outline the new accountability measures at Wall Street’s epicenter.

The regulations compel close to 10,000 financial institutions and 300,000 insurance licensees to put consumer protection before their corporate reputation for the first time in US history.

From a minor system access attempt by hackers all the way up to a full data breach, the new law saddles financial institutes with direct accountability to the state and implements a new standard in reporting for all mortgage loan servicers, banks, credit unions, and insurance companies.

For finance companies wondering how to conduct business in this new reality, here is a guide to the reporting obligations of New York’s new cybersecurity law

Governing Bodies

The first step of understanding the new obligations is to get familiar with the regulatory bodies of New York’s finance world.

The main authority on the new regulation is the New York State Department of Financial Services (DFS).

In the past, financial institutions were regulated via voluntary frameworks and reported externally to DFS in few situations with undefined parameters.

Under the new law, DFS established immediate authority by requiring a DFS-issued cyber security Certificate of Compliance as a basic prerequisite for operating a financial company. This gives DFS the ability to discipline non-compliant companies by revoking their certificate.

Beyond DFS, the regulation stipulates the creation of internal positions for officers to interface with DFS on behalf of the company. This requirement pushes aside ineffective industry-based governing bodies in favor of a direct link.

Mortgage companies must designate a Chief Information Security Officer (CISO) for in-house enforcement of company security procedures. The CISO reports in writing annually to the company’s board and will be held personally, legally responsible in the event of a breach at the agency.

Reporting Obligations

The final piece of accountability addressed in the new law is a reexamination of security reporting.

A “cybersecurity event” is any attempt of unauthorized access private consumer information. In order to mitigate the effects of a security event, financial institutions need to disclose data loss when it happens. This gives consumers sufficient time to take protective action such as changing passwords or putting a hold on a compromised credit card.

In practice though, finance companies endeavor keep data hacks under wraps. They prefer to save face and avoid losing consumer confidence.

In September of 2017, the Equifax data breach made international headlines. Though not the largest, it is considered the worst data breach in US history due to the sensitive nature of personal data that was accessed.

Despite being aware of the situation, Equifax spent five weeks running corporate damage control before disclosing the leak. The company initially underreported the number of affected consumers as 2.5 million instead of the actual 145.5 million people whose private data was stolen.

This failure to disclose the full extent of the damage infuriated the public.

Lawmakers vowed to protect consumers against this type of cover-up. With Sen. Elizabeth Warren (D-Mass.) at the helm, this is how the new regulations were written into law.

No More Cover-Ups

Now, the superintendent’s office places a strict time cap on security breach announcements. A company has no more than 72 hours to report any event that has a “reasonable likelihood of materially harming the normal operations” of the company. 

Since Equifax’s disregard for public safety, the law now stipulates that a data breach report is no longer the jurisdiction of the local supervisory body. Instead, reports of data loss go up the chain of command straight to the New York Superintendent’s office.

With a quicker turnaround time, consumers can be alerted quickly and efficiently through official channels about the breach.

Though basic requirements of the law have already gone into effect, the state of New York did allow time for mortgage companies to learn the law and implement it piece by piece.

According to the roll-out dates of the law, companies are required to be legally compliant with specific sections of the law on March 1 and September 3, 2018. The end of the full two-year transitional period and full compliance will be enforced by March 1, 2019.

For comprehensive compliance guidance and other cybersecurity solutions and, contact us.

Image: Visual Hunt

Topics: cyber security mobile security mobile device security email security cybersecurity security mortgage industry Trump Administration Housing Market Mortgage Lending 23 NYCRR Part 500 NYSDFS

How New York’s Latest Cyber Security Law Will Impact You

sgfhj.jpgNew cyber security laws in New York mean strict accountability for businesses.

Cyber security is on the brink of an unprecedented crackdown in New York.

The finance industry is preparing for a new normal that looks vastly more stringent than before.

Part reaction to consumer outrage and part finger-pointing to the market for accountability when it comes to data breaches, the regulation titled Cybersecurity Requirements for Financial Services Companies (2017) is a broad re-draw of the rules by the state regulator.

In a country where the sector has historically played fast and loose with handling missteps, all eyes are watching to see how quickly it can adapt to the new normal.

As everyone settles in for the ride, industry insiders are already forming hypotheses about how far this new regimentation will reach.

Laying Down the Law

The new law outlining consumer data security measures in New York State is the first of its kind in the United States.

Officially released in March of 2017 with a built-in year of lag time, the enforcement date has arrived. As of Thursday February 15, 2018 enforcement is in full effect.

Financial institutions are expected to have stepped up their game in safeguarding computer systems and the sensitive information stored inside. A full guide to the highly prescriptive requirements can be found here.

The end goal is to avoiding security breaches by making businesses sufficiently fearful of repercussions. If they do foster an environment that allows for future problems or leaks of personal data, the stakes are high.

Who the Law Affects

The current law has been interpreted to include all banking, insurance, lending, and mortgage brokerage firms that are operating in New York. Every company under that heading will be held to the new standard.

This means that entities must get in gear to assess their actual and potential cybersecurity risks and make a solid plan to mitigate them.

The good news for IT departments is that due to the highly detailed guidelines about policy and the use of technology to patch up the security gaps, they have rather exact instructions to follow.

Beyond State Lines

At first glance, companies outside of New York might assume they have been spared from the harshest regulations in the country. After a closer look, it seems imminent that the change will have a wide-ranging impact.

Going forward, consumers will rely on their financial institutions to keep personal data safe. Not only are the expectations high, but the safety net sets the stage for demanding the same in other states.

Mortgage companies across the country are targeted by hackers due to the quantity of information and the quality of its use for fraud purposes. Companies outside of New York in the same industry should brace for the arrival of comparable laws on their home turf.  

Out-of-state entities with branches in New York should have a response as well, even before their own states begin drafting something similar.

In fact, other states are already following suit. Colorado and Vermont introduced their own measures within months after the NY regulation was put in place.

Vermont’s law names “securities professionals” as the intended subjects of its tighter regulations. Without specifying banks, the use of this broad term leaves the door open for enforcement with entities that may not previously fall under the state’s traditional regulation agencies.

As a global financial hub, even entities doing business in New York should consider getting the jump on re-assessing their policies as a continuity plan.

Beyond the Finance World

The effect of intensified scrutiny over cyber security practices will logically spill over to third-parties who work in the finance world and businesses who directly manage cyber security for the industry.

Fortune magazine goes one step further, predicting that ripple effect will go well beyond the financial industry. It could cover security events by any business that stores personal data “from point-of-sale to payroll providers.”

After that, it seems the industry shake-up will likely bleed into any major industry that houses consumer data using any sort of technology. These days, companies who aren’t keeping customer information in a computer system are few and far between.

The only thing the industry seems sure of is how this trend in accountability will not be contained by state lines or by industry.

In the early days of this new law’s enactment, the extent of this chain reaction is yet to be seen.

Over the next fiscal year, New Yorkers will lead the way, with countless gazes focused on them for cues of how to adapt.

ABT’s cloud-based portal MortgageWorkSpace adds banking level security to email, servers, PC’s and mobile devices in the mortgage industry. Contact us to learn more.

Image: VisualHunt.com

Topics: Compliance Due Diligence cyber security mortgage company security financial data security cybersecurity mortgage business mortgage industry Consumer Finance Protection Bureau Compliance for Mortgage Companies Compliance Audit cloud-based data Mortgage Lending 23 NYCRR Part 500 NYSDFS network safety

Business Data Security and Multi-Factor Authentication

 240_F_122590781_AfHycyjOI0sOqepiZ1DQVBYkZsH7qlRr.jpg Get an extra level of security with multi-factor authentication or MFA.

Each year, cybersecurity gets more complicated.

According to anti-virus developer Panda Security, the amount of malware created by cybercriminals is predicted to grow exponentially with each passing year.

Companies have to face the reality that a security breach has a serious impact on business.

To avoid the distress of company-wide damage control and a PR nightmare, it’s best to make sure security is in good shape.

Real Business Impact

For some businesses, consumer data handling is the main issue.

Financial institutions such as banks and mortgage companies are often targeted by hackers because they house the most personal information.

With major security failures like the Equifax breach of 2017 making international news, the finance industry’s cybersecurity worries are real.

More is at stake than information. A data breach can mean sales losses and a tarnished reputation that lasts for years.

From fines to fraud, there are monetary repercussions as well.

So what is the fastest way to tighten security on cloud-based and traditional networks?

Multi-Factor Authentication

Data breaches in single-factor authentication systems often exploit the system login credentials or passwords of users.

Multi-factor authentication or MFA is a group of security measures that go beyond the traditional password in order to correctly identify a person for system access.

MFA is becoming more prevalent in the financial industry. This kind of authentication was adopted by the Payment Card Industry Data Security Standard (PSI DSS) in February of 2017 and was listed as a standard for the mortgage industry in the State of New York in the same year.

Multiple factors mean heightened levels of information that only the user can provide.

These factors can be a number of different security measures. A “soft token” is when security software generates a one-time-use passcode sent to the user’s mobile device. This type of authentication can also be executed with a text message, phone call, or an email with a hyperlink.

Other factors run the gamut from predefined security questions to biometric identifiers like fingerprints or facial recognition software.

Only the correct user knows the information or is in the circumstance to receive the passcode, so using MFA means only the approved user is given access.

The Modern Office

Another issue with security is the modern office environment.

There are a growing number of remote workers. Employees want access to work-related applications from outside the office.

In this mobile workforce, employees are moving off of network-approved computers and onto personal or public machines. It’s up to the IT department to facilitate their work and make sure they go through a heightened level of security checks.

MFA is an authentication strategy that allows IT to deliver this level of remote access. It solves the problem of identifying recognized employees while maintaining a solid defense against intruders.

User Experience

The final consideration when implementing cybersecurity measures is user experience.

With higher scrutiny comes a higher level of annoyance by the employee at having to prove their authorization.

IT staffers need to balance security measures with user convenience.

One development that improves this balance is “adaptive” MFA. This security technology evaluates the risk factor of the user and then adapts the number of factors required for entry to the system.

An employee using a company-issued laptop at a café with an IP address across the street from headquarters is considered a low-risk access attempt. This situation does not require extra security measures.

On the other hand, if someone is trying to gain access on an unrecognized device in a location where the company doesn’t have an office (e.g. employee is attempting to do work on her tablet while vacationing in Bali) then the number of factors required will be at the maximum level. The employee jumps through some hoops, but with an understanding of why.

Conclusion

Data breaches are happening at the enterprise level at an alarming rate. A watchdog organization called Breach Level Index estimates that every second, an average of 57 records are stolen.

Employees are moving towards a more mobile work environment with wide geographic distribution.

For companies who handle consumer data, implementing MFA is simply one of the most effective ways to crack down on security violations and keep up with the modern workplace.

Businesses that use the MortgageWorkspace management software by ABT are protected by multi-factor authentication and a host of other cybersecurity measures. Contact us to learn more.

Topics: social networking safety phishing multi-factor authentication cloud storage mortgage business Compliance for Mortgage Companies Compliance Audit cloud-based data Housing Market Mortgage Lending

Solid Steps to Safeguard Against Meltdown and Spectre

ghjfj.jpgTwo defects threaten computers and devices released on the market since 1995.

Meltdown and Spectre are the names given to two newly-discovered bugs terrorizing computers around the world.

At the sound of such unnerving names, it’s hard for security folks at enterprise-level companies to control the panic.

While protocols for dealing with these threats are still on the drafting board, there are solid steps that companies can take to protect themselves.

What are Meltdown and Spectre?

In early January of 2018, the tech world was rocked by the discovery of two colossal security flaws that affect almost every computer and smart device on the market since 1995.

First announced on January 3rd, the bugs’ initial discoveries are being attributed to Jann Horn at Project Zero, a Google-based program for security analysis.

These two separate flaws were simultaneously being probed and announced by a handful of security experts from around the globe. As bits and pieces came out about the exposures, the gravity of the situation became clearer.

Both Meltdown and Spectre exploit weakness in the CPU of most current machines and all their predecessors dating back to 1995.

Since both faults affect major brand-name processors, it means that desktops, laptops, mobile devices, and servers all contain the defects.

The spooky truth is that they affect a majority of computers in use today.

How They Work

Often linked due to the widespread nature of both flaws and the fact that they were discovered around the same time, they do not work in the same way.

The first defect, Meltdown, is named for what it does to affected devices. It sort of ‘melts’ the wall between applications and the machine’s OS and makes it a devastating entryway for hackers.

The second issue, Spectre, is a named for the process from which hackers are able to steal information—namely ‘speculative execution’.

Speculative execution is the technique whereby your device records your computer activity in an attempt to predict future actions. This process helps your device execute tasks quickly, but the records contain sensitive usage information that shouldn’t fall into the wrong hands.

The name also refers to an apparition, which is fitting since companies don’t want intruders ghosting around their private information.

Meltdown affects Intel processors while Spectre affects three kinds of CPU chip: Intel, AMD, and ARM.

Using these newly discovered gateways, popular tech forum Bleeping Computer says, “Malicious program can steal passwords, account information, encryption keys, or theoretically anything stored in the memory of a process.”

Vendors React

In response to the potential devastation, the tech community has seen a wave of security advisories and patches to deal with the bugs.

At the pace that vendors are trying to get information out, some have produced conflicting stories: While AMD maintains that its CPUs have a near zero risk of vulnerability, Microsoft quickly pushed out a patch for AMD devices that has caused computers to stop working.

In the haste to calm the masses, it seems some solutions come with problems of their own.

Beyond the CPU

Browsers are also vulnerable due to these glitches.

Safari came out with a patch in December of 2017 while Microsoft just released patches for IE and Edge. Microsoft announced that Windows 10 is safer to use than older versions, but did not provide further details.

After other vendors bumbled, Google reneged on a patch that was promised for January 23rd. Google’s Chrome browser and OS patch came out Friday the 2nd of February, over a week late.

Adding yet another layer to this confusing frenzy, Anti-Virus programs may be incompatible with some systems (notably Microsoft) so don’t go AV-crazy just yet.

In order to be proactive, here are three solid steps you can take to make sure your company is protected.

  1. Assess Your Risk

Guidelines for action from patches to future fixes are available at each vendor’s site. Your company can build a customized response based on vendor-specific information.

  1. Follow Instructions

Take the recommended steps to mitigate any security risks that would leave your company vulnerable.

A smorgasbord of vendors, from Amazon to Cisco, has released advisories to protect their clients and business partners from dangerous activity.

It’s up to your company’s security team to follow instructions based on the software and hardware that your system uses.

  1. Hold Out for More Information

Unfortunately, these bugs were publicly announced recently. The scramble to provide permanent answers is on.

The best thing to do after the initial patch scare is to await further details and instruction from the tech security community.

Businesses protected by ABT’s monitoring service Network Guardian receive monthly reports detailing security threats. Contact us to learn more.

Image: VisualHunt.com

Topics: mortgage documents mortgage business mortgage industry cloud-based data Mortgage Lending disaster recovery malware network intel spectre meltdown network safety