MERRITT ISLAND, Fla.—To help prevent threats to the country’s infrastructure, Information Sharing and Analysis Centers (ISACs) have been in place since the terror attacks of Sept. 11, 2001. But not until recently has there been an organization focused on the specific cyber intelligence needs of credit unions.
As CUToday.info previously reported, the National Credit Union Information Sharing and Analysis Organization (NCU-ISAO) has been formed for that purpose, founded by two credit unions—BCU in Vernon, Ill., and Founders Federal in Lancaster, S.C.—and PSCU in St. Petersburg, Fla.
ISAOs differ from ISACs in that they are focused on the needs of a specific business segment. ISAOs were authorized by presidential order last year.
"This is the first operational and threat intelligence sharing organization dedicated wholly to credit unions,” explained Gene Fredriksen, executive director of the NCU-ISAO and VP, CIO at PSCU. “The network of ISACs today are very effective, and they provide valuable information that credit unions can use to get out ahead of cyber threats and defend against them,” he said.
More Usable Intelligence
But what they don’t do, he added, is filter that cyber intelligence to make it more usable for CUs.
“And because security/IT staff at credit unions are small, just a few people at even the bigger shops, these ISAC information feeds can seem like you are drinking out of a firehose,” said Fredriksen. “There are literally hundreds, sometimes thousands, of vulnerabilities that come out every day.”
Fredriksen emphasized that the focus of NCU-ISAO is to pass onto credit unions actionable threats.
“We want to help credit unions laser focus on the cyber threats that are extremely relevant to them,” he said.
Gene Fredriksen
Fredriksen said NCU-ISAO is a member of the International Association of Certified ISAOs (IACI), and says it leverages a private sector-led global cyber threat intelligence infrastructure working in collaboration with government (U.S. DHS, etc.), headquartered at the Global Institute for Cybersecurity & Research (GICSR) Global Situational Awareness Center at NASA/Kennedy Space Center.
Fredriksen emphasized that often threats to credit unions are not the large ones that the Financial Services ISAC (FS-ISAC) focuses on.
“Some of the real threats to the smaller CUs may be the phishing scams or social engineering—more targeted attacks rather than high-profile cyber threats,” he said.
ISACS Doing Good Job
Fredriksen explained that after 911, the U.S. government signed a presidential directive to create threat information and analysis centers for each of the country’s critical infrastructures, such as healthcare and financial services.
“These ISACS have done really good job of focusing on cyber security and sharing threat information by sector,” Fredriksen said. “The Financial Services Information Sharing and Analysis Center done has done a great job relative to banks and credit unions, insurance companies . . . That has all been well and good. But now that now that this arena has matured a bit, we see that not everyone in financial services has the same needs when it comes to cyber intelligence.”
Fredriksen gave the example of large national banks that are often affected by a national or even global cyber threat, as contrasted with credit unions, where the geographical footprint is often at the community level.
“And because the information sharing needs for credit unions encompass more than just cyber threats, the NCU-ISAO will also support innovative, member-driven initiatives around benchmarking, process improvement, and regulatory strategies."
Fredriksen said that the executive leadership of NCU-ISAO will be comprised of technology and security leaders from credit unions across the country, as well “executive sponsors,” staff from companies that serve credit unions.
Fredriksen said that PSCU is currently the only executive sponsor and that more executive sponsors are expected to soon join. He emphasized that the larger the group becomes the stronger it gets, estimating that NCU-ISAO will have 300 to 400 active CU members by the end of the year.
“The power of this organization comes from the input,” said Fredriksen. “So the larger we become the better it is for everyone in credit unions.”