Banking and Financial Services

Q: What cybersecurity regulations must banks comply with?
A: Banks need to follow several important regulations and standards. A key law is the Gramm-Leach-Bliley Act (GLBA), which requires financial institutions to have a written information security program and protect customers’ private financial information. Banks must also comply with the PCI DSS standards if they handle credit and debit card transactions – this ensures cardholder data is securely processed and stored. In addition, U.S. banks are subject to regulatory guidance from bodies like the FFIEC (Federal Financial Institutions Examination Council), which provides detailed cybersecurity guidelines that examiners use during IT audits. Other regulations can apply based on the bank’s location and activities: for example, New York’s Department of Financial Services has its own cyber rules, and banks with overseas clients may need to follow the EU’s GDPR for data privacy. Ensuring compliance often involves implementing specific controls (encryption, access logs, etc.), regular audits, and reports to regulators to demonstrate that the bank’s IT security measures meet all required standards.

Q: How can we keep up with evolving cyber threats in the banking sector?
A: Keeping up with fast-evolving threats is indeed challenging for banks. The best approach is to establish a proactive, ongoing security program. This includes continuous monitoring of your networks and systems for any anomalies or intrusion attempts, often through security operations centers or managed security services that watch traffic 24/7. Staying updated on threat intelligence is also important – banks often subscribe to intelligence feeds or participate in information-sharing groups (like FS-ISAC, the Financial Services Information Sharing and Analysis Center) to learn about new cyberattack tactics targeting the financial industry. Regularly updating and patching your software and systems is critical, as many attacks exploit known vulnerabilities – having a rigorous patch management schedule will close those doors to attackers. Another key aspect is ongoing employee training: the threat landscape changes quickly with new phishing scams or fraud schemes, so staff should receive up-to-date training (at least annually, if not more frequently) on how to spot and report suspicious activities. Finally, many banks choose to partner with cybersecurity experts or managed IT providers (like Entre) to augment their in-house capabilities. These specialists focus on tracking the latest threats and can quickly implement new defensive measures or technologies as needed, ensuring the bank isn’t caught off-guard by emerging risks. Combining internal vigilance with external expertise helps a bank stay one step ahead of cyber threats.

Q: Why is multi-factor authentication important in banking?
A: Multi-factor authentication (MFA) is considered a best practice in banking security because it significantly reduces the risk of unauthorized access to sensitive accounts and systems. Banks handle vast amounts of confidential data and high-value transactions, making them prime targets for phishing, credential theft, and brute-force attacks. A password alone is no longer sufficient protection—passwords can be stolen, guessed, or leaked. MFA adds an additional layer of defense by requiring users to verify their identity through a second factor, such as a mobile app code, text message, or biometric method like fingerprint or facial recognition. Even if a password is compromised, an attacker is unlikely to succeed without access to this second factor.

Modern banking security goes beyond static MFA. Leading institutions are now deploying Conditional Access (CA) policies, which analyze contextual factors—such as location, device health, and user behavior—to decide whether to allow, deny, or challenge a login. For example, logging in from an unfamiliar location or an unmanaged device might trigger additional verification or be blocked altogether. This adaptive approach reduces unnecessary friction while tightening security where it matters most.

In addition, desktop-level MFA enforcement adds another critical layer of protection. Rather than limiting MFA to cloud-based services, Entre helps banks require MFA when logging into Windows desktops—especially important for branch workstations, teller systems, or high-privilege accounts. This prevents unauthorized access from within the network and closes common security gaps in shared or on-premise environments.

MFA, CA, and desktop enforcement together form a robust, modern access control framework that protects both internal banking operations and customer-facing platforms like online and mobile banking. These controls are now widely recognized by regulators and required under frameworks such as GLBA, PCI DSS, and FFIEC guidelines—making them not only best practices but compliance necessities.

Q: Should a bank outsource its IT and cybersecurity, or keep it in-house?
A: This is a common question for banks, especially smaller community banks or credit unions. The decision depends on the bank’s resources and needs, but there are strong arguments for outsourcing certain IT and security functions. Many banks choose to outsource to a qualified managed IT services provider in order to leverage specialized expertise and round-the-clock support that would be expensive to maintain with a small in-house team. By outsourcing, a bank can gain access to a whole team of IT professionals (with diverse skills in cybersecurity, networking, cloud, etc.) at a fraction of the cost of hiring those roles internally. This team can handle daily IT operations, monitor systems 24/7, and rapidly respond to incidents – capabilities that are especially valuable if the bank doesn’t have its own full-scale IT department.

Outsourcing can also help a bank stay current with technology and compliance. An external provider like Entre will be very familiar with banking regulations and security standards, and we continuously update our tools and knowledge to meet those requirements. That means the bank benefits from modern, up-to-date defenses and can remain **“audit-ready” without having to train internal staff on every new development. However, outsourcing doesn’t mean giving up control or oversight. A good IT partner will work closely with your bank’s leadership to make sure services align with your policies and business goals, and you’ll still define the security policies and risk appetite.

That said, some larger banks with extensive resources do maintain in-house IT/security teams for greater direct control, sometimes supplemented by consultants for niche areas. For many small to mid-sized banks, the hybrid approach is common: keep a small internal IT staff for strategic oversight and user support, but outsource the heavy lifting of infrastructure management, cybersecurity monitoring, and complex compliance tasks. This way, the bank’s team can focus on strategic projects and customer service while the external experts handle the technical complexity behind the scenes. In summary, outsourcing can be very beneficial by providing expertise, scalability, and cost efficiency, but each bank should assess its specific situation. The priority is ensuring that whoever manages the IT and security – internal staff, external provider, or a mix – is qualified to protect the bank’s operations and data effectively.