Trustmark Corporation · NASDAQ:TRMK
Trustmark — Investor Presentation (July 2014)
55 slides from Trustmark's investor presentation, July 2014
Slide 1: Don't let your business (or yourself) become a victim of CyberCrime!
Don't let your business (or yourself) become a victim of CyberCrime!
Slide 2: Mel Channell, Trustmark Bank
Mel Channell, Trustmark Bank Sr. VP, Director of Corporate Security for Trustmark Bank A speaker at Mississippi Banker’s Association Security Seminar, MS Prosecutor’s Conference, MS Association of School Business Leaders, Private Businesses, Law Enforcement Agencies in multiple states on such to
Slide 3: Tom Garcia: InfoSight President, CEO
Tom Garcia: InfoSight President, CEO Technology & Financial Data Processing experience: 23+ years A frequent speaker on Regulatory Compliance, Security, and Technology at organizations such as: FFIEC / FDIC, NCUA, Fiserv and many State Banker’s Association Events. Founded InfoSight because of
Slide 4: What we'll cover today
What we’ll cover today The law & banking regulations Threats & the evolving landscape Hacker tools & types of attacks How a breach can hurt your organization Trustmark Bank’s security solutions Mitigation strategies & tools
Slide 5: The Law & Bank Regulations
The Law & Bank Regulations BS INFOSIGHT.
Slide 6: The FFIEC & Regulatory Compliance
The FFIEC & Regulatory Compliance The Federal Financial Institutions Examination Council prescribes uniform principles, standards, and report forms for the federal examination & uniformity in the supervision of financial institutions: FRB - The Board of Governors of the Federal Reserve System FD
Slide 7: Regulation E: The Electronic Funds Transfer Act
Regulation E: The Electronic Funds Transfer Act Regulation E, also known as the Electronic Funds Transfer Act, is a regulatory framework that addresses the electronic transfer of funds (EFTs). Enacted in 1978. It was designed to: Establish the rights & liabilities of the consumer Establish the r
Slide 8: Who's protected under Reg E?
Who’s protected under Reg E? Consumer Commercial accounts? accounts? What does it mean to be protected under Reg E? 62% of businesses do not know that their commercial account is not protected under Reg E. 39% of businesses are unsure if such a policy even exists. There is a growing need for bus
Slide 9: New MFA guidance & The Awareness Initiative
Multi-Factor Authentication New MFA guidance & The Awareness Initiative As of January 1st, 2012, Financial Institutions must meet the new FFIEC Requirements for Electronic Banking. The new guidance dictates two key customer-facing components to detect and prevent online fraud: Layered Security: Re
Slide 10: The Threats and Evolving Landscape
The Threats and Evolving Landscape
Slide 11: The evolving landscape
The evolving landscape Most people have no idea just how involved the underground black market for stolen information is. Picture an e-bay type environment with buyers and sellers who have the ability to rate each other and leave feedback about transactions. Only this online hot spot is a breeding g
Slide 12: Criminals are focused on high-value targets
Criminals are focused on high-value targets High Net Value • Low level of technical sophistication • May have a higher than average account balance Consumers • May have a higher than average transaction volume Enterprise • High average account balances • Experienced IT professionals Businesses • Hig
Slide 13: Small business attacks in the headlines
Small business attacks in the headlines It's not just small businesses at risk - schools, churches & local government agencies $22,000 $160,000 $680,000 $600,000 $117,000 $139,000
Slide 14: Mac OS attacks
Mac OS attacks 600,000 Apple computers were infected First appeared in Sept of 2011 Apple patched it in April of 2012 56% of the infected computers are in the U.S. • 20% in Canada • 13% in the U.K. An Apple Macintosh can also serve as a virus carrier to infect other Macs & Windows pcs via a
Slide 15: The Cost of Cybercrime
The Cost of Cybercrime Source: Norton
Slide 16: The Cost of Cybercrime
The Cost of Cybercrime Source: Norton
Slide 17: Hacker Tools
Hacker Tools
Slide 18: What is malware?
What is malware? Malware is a general term for malicious software or files that are harmful to a computer. Malware includes computer viruses, worms, Trojan horses, and spyware. Malware is designed to: • Steal sensitive data, such as credit card numbers or other personal information • Gather informat
Slide 19: Types of Malware
Types of Malware Trojan horses A Trojan horse is a program which seems to be doing one thing, but is actually doing another. A Trojan horse can be used to set up a back door in a computer system so that the intruder can gain access. Viruses A virus is a self-replicating program that spreads by inser
Slide 20: Types of Malware
Types of Malware Spyware When installed on your computer, may send you pop-up ads, redirect your browser to certain websites, or monitor the websites that you visit. Some extreme, invasive versions of spyware may track exactly what keys you type. Rootkits Software that can be installed by an attacke
Slide 21: The ZeuS Trojan
The ZeuS Trojan The Zeus Trojan is widely recognized as the “de facto” malware in the world of online banking fraud – estimated to be responsible for about 90%of banking fraud worldwide. Since becoming commercially available in the black market, Zeus is almost a commodity, with numerous malware auth
Slide 22: Where does malware come from?
Where does malware come from? You need to be aware of the 10 most common ways malicious code reaches your private network. 1. Email Attachments – before opening, ensure that attachments you receive are legitimate 2. Portable Media – any device that can store information can support malicious content
Slide 23: Where does malware come from?
Where does malware come from? 6. Instant Messaging Clients – especially if unpatched, they allow hackers to upload or download files through holes in the client software. 7. New Devices and Peripherals – although it’s rare, mobile phones, digital photo frames, etc. can be compromised during manufact
Slide 24: Types of Attacks
Types of Attacks
Slide 25: Types of Attacks
Types of Attacks Web-based attacks such as fake antivirus malware and SEO poisoning are the biggest threat to data security today. And the explosion of mobile devices and social networking only increases your exposure to risk. There are many ways to steal your data. Here are just a few: Man-in-the
Slide 26: Social Engineering: The Ultimate Con
Social Engineering: The Ultimate Con Social engineering is the human side of breaking into a corporate network. Social engineering involves gaining sensitive information or unauthorized access privileges by building inappropriate trust relationships with insiders. Social engineers manipulate people
Slide 27: How can malware hurt my organization?
How can malware hurt my organization?
Slide 28: How can it hurt me and/or my company?
How can it hurt me and/or my company? Internal Cost Activity External Consequences & Costs Detection Information loss or theft Investigation & Escalation Business Direct, indirect & opportunity costs Disruption Containment associated Equipment with cyber crimes Damage Recovery Revenue Loss Ex-Post R
Slide 29: What is corporate account takeover?
What is corporate account takeover? Electronic funds transfer fraud Corporate account takeover is a type of fraud where thieves gain access to a business’ finances to make unauthorized transactions, including transferring funds from the company, creating and adding new fake employees to payroll, and
Slide 30: Preventing fraud
Preventing fraud What regulators & banks are doing to prevent fraud In an effort to protect both consumers and businesses from financial fraud, the Federal Financial Institutions Examination Council (FFIEC) has implemented and will continue to establish new security guidelines for financial institut
Slide 31: How do I protect my business?
How do I protect my business? The best way to protect against corporate account takeover is a strong partnership with your financial institution. Work with your bank to understand security measures needed within the business and to establish safeguards on the accounts that can help the bank identify
Slide 32: Our Security Solutions
Trustmark Our Security Solutions
Slide 33: The "Layered Approach"
The “Layered Approach” Because no single solution can ensure online security, we have developed a layered security approach Minimum Password Lengths: Must now be a minimum of eight (8) and a maximum of twelve (12) characters in length with one (1) numeric or alphabetic character required. RSA Pa
Slide 34: The "Layered Approach"
The “Layered Approach” Additional security options: Wire Dual Control - Prevents a single user from creating, then initiating or transmitting a wire transfer. A wire in the amount of $100,000 or more initiates a phone call from Trustmark to complete the transaction. ACH Dual Control - Prevents a
Slide 35: Secure Online Banking
Secure Online Banking Device Identification, also referred to as device fingerprinting, uses various techniques to identify devices and authenticate users. It’s a reliable way to recognize you by the specific PC you are using. Device Identification looks for: IP Address User-agent string, which
Slide 36: ACH/Wire Enhanced Security
ACH/Wire Enhanced Security Secondary Approvals of Wire and ACH transmissions: One employee may create a Wire transaction while the other employee must login to approve and submit the transaction. We accommodate ACH Dual Approval on an as request basis. Secondary request of password on Transfers:
Slide 37: What are my responsibilities as a customer?
What are my responsibilities as a customer?
Slide 38: My Responsibilities as a Bank Customer
My Responsibilities as a Bank Customer While we can provide protections to prevent the Business Online Banking service from being compromised, the customer must be responsible for protecting the security of their own information and PC. “The Customer shall be solely responsible for protecting agai
Slide 39: Fraud Alert Services
Fraud Alert Services Solutions designed to help reduce the risk of fraudulent activity on your business account
Slide 40: Positive Pay
Positive Pay Benefits • Ability to make pay or return decisions on Checks that are not identified in your Issued Check File • Helps to prevent operating losses and time-consuming fraudulent check handling, research, and reconcilement Features • Ability to review and decision suspect items on the
Slide 41: ACH Alert
ACH Alert Benefits • Helps to prevent operating losses from unauthorized Automated Clearing House (ACH) debit transaction activity • Provides control and visibility through a simple online user interface Features • Notification via email or text of suspect items by 9:00 am CT – with up to six em
Slide 42: Fraud Alert Services
Fraud Alert Services Trustmark Customer Experiences • Columbus Light & Water • ACH Alert stopped an ACH debit transaction from posting against his account • “I am officially a believer.” Mike Bernsen, Comptroller, Columbus Light & Water • Warren Paving • Positive Pay prevented a fraudulent $900 ch
Slide 43: Fraud Alert Services
Fraud Alert Services Bundles ACH Alert and Positive Pay together, providing the customer with a more comprehensive suite of services to protect their accounts Customers should also monitor account activity frequently through TrustNetWeb to identify suspicious transactions Combined with prudent
Slide 44: Cyber Insurance
Cyber Insurance What is Cyber Insurance? Cyber insurance is an insurance product used to protect businesses from Internet-based risks, and more generally from risks relating to information technology infrastructure and activities. Risks of this nature are typically excluded from traditional commerci
Slide 45: Cyber Insurance
Cyber Insurance Benefits of Cyber Insurance: Increases cyber security by encouraging the adoption of best practices. The security requirements used by cyber insurers are also helpful. Since insurers will be required to pay out cyber-losses, they have a strong interest in greater security, and th
Slide 46: Mitigation Strategies & Tools
Mitigation Strategies & Tools
Slide 47: How do I protect my business?
How do I protect my business? It is important to protect your cyber environment just as you would your cash and physical location. Use appropriate tools to prevent and deter unauthorized access to your network and periodically review these tools to ensure they are up to date. Encrypt sensitive data
Slide 48: How do I protect my business?
How do I protect my business? Create a secure financial environment. Dedicate one computer exclusively for online banking and cash management activity. This computer should not be connected to the business network, have email capability, or connect to the Internet for any purpose other than online b
Slide 49: How do I protect my business?
How do I protect my business? Partner with your bank to prevent unauthorized transactions. Talk to your banker about programs that safeguard you from unauthorized transactions. Positive Pay and other services offer call backs, device authentication, multi-person approval processes and transaction li
Slide 50: How do I protect my business?
How do I protect my business? Pay attention to suspicious activity and react quickly. Look out for unexplained account or network activity, pop ups, and suspicious emails. If detected, immediately contact your financial institution, stop all online activity and remove any systems that may have been
Slide 51: Some Quick-and-Easy Takeaways
Some Quick-and-Easy Takeaways 1. Don’t share your User IDs and Passwords with others 2. Change your passwords often (at least every 60 days) 3. Use strong passwords 4. Never click the box to “remember” passwords 5. Do not allow access to social networking sites on your business computers 6. Secure t
Slide 52: Some Practical Tools To Consider
Some Practical Tools To Consider Intrusion Prevention System (IPS) Host IPS Internet Content Management Email Content Management Email Encryption Endpoint Security & File/Data Encryption Anti-Virus Software Patch Management Solution
Slide 53: What We Covered Today
What We Covered Today The law & banking regulations Threats & the evolving Landscape Hacker tools & types of attacks How a breach can hurt your organization Trustmark Bank’s security solutions Mitigation strategies & tools
Slide 54: How Can InfoSight Help? Complementary Security Posture Assessment
How Can InfoSight Help? Complementary Security For a copy of the slides, Posture Assessment contact Seminars@InfoSightInc.com Other InfoSight Services: Network Health & Performance Monitoring Services Download your Managed IT & Security Services Security Awareness Training & Education Programs
Slide 55: Corporate Treasury Services
Corporate Treasury Services Trustmark National Bank 855-731-0243 CorporateTreasuryServices@Trustmark.com