nucua-regulatory-compliance-banner

NCUA Regulatory Compliance

Thales’ CipherTrust and SafeNet Data Security Products help US Credit unions comply with The National Credit Union Administration's (NCUA) regulations and requirements.

NCUA Regulatory Compliance

Test

The National Credit Union Administration (NCUA) is an independent federal agency that requires U.S. federally insured credit unions to establish a security program that addresses the privacy and protection of customer records and information. NCUA conducts audits of credit unions based on principles and standards outlined by the Federal Financial Institutions Examination Council (FFIEC). The FFIEC standards call for numerous security controls, including data access controls, encryption and key management, and security monitoring.

Thales solutions can help address FFIEC standards, including:

  • Data encryption and key management
  • Access controls
  • Security intelligence
  • Regulation
  • Compliance

Access rights administration

According to FFIEC1:

Financial institutions should have an effective process to administer access rights. The process should include:

  • Assigning users and devices only the access required to perform their required functions,
  • Updating access rights based on personnel or system changes,
  • Reviewing periodically users' access rights at an appropriate frequency based on the risk to the application or system ...

Encryption and key management

FFIEC also notes:

  • Encryption2

    Financial institutions should employ an encryption strength sufficient to protect information from disclosure until such time as the information's disclosure poses no material threat. …. Decisions regarding what data to encrypt and at what points to encrypt the data are typically based on the risk of disclosure …. Encryption may also be used to protect data in storage. The implementation may encrypt a file, a directory, a volume, or a disk.

  • Encryption Key Management3

    Since security is primarily based on the encryption keys, effective key management is crucial. Effective key management systems are based on an agreed set of standards, procedures, and secure methods that address Source: ISO 17799, 10.3.5.2

Security monitoring

In addition, FFIEC offers guidelines for security monitoring.4

Financial institutions should gain assurance of the adequacy of their risk mitigation strategy and implementation by:

  • Monitoring network and host activity to identify policy violations and anomalous behavior;
  • Monitoring host and network condition to identify unauthorized configuration and other conditions which increase the risk of intrusion or other security events;
  • Analyzing the results of monitoring to accurately and quickly identify, classify, escalate, report, and guide responses to security events; and
  • Responding to intrusions and other security events and weaknesses to appropriately mitigate the risk to the institution and its customers, and to restore the institution's systems.

1 http://ithandbook.ffiec.gov/it-booklets/information-security
2 Ibid
3 Ibid
4 Ibid

Thales can help credit unions comply with NCUA regulations through:

  • Data discovery and classification
  • Data access control
  • Encryption and tokenization (pseudonymization) of data at rest
  • Encryption of data in motion
  • Encryption key management
  • Keeping and monitoring user access logs
  • The use of hardware security modules for executing encryption processes and protecting encryption keys

Data Discovery and Classification

The first step in protecting sensitive data is finding the data wherever it is in the organization, classifying it as sensitive, and typing it (e.g. PII, financial, IP, HHI, customer-confidential, etc.) so you can apply the most appropriate data protection techniques. It is also important to monitor and assess data regularly to ensure new data isn’t overlooked and your organization does not fall out of compliance.

Thales’ CipherTrust Data Discovery and Classification efficiently identifies structured as well as unstructured sensitive data on-premises and in the cloud. Supporting both agentless and agent-based deployment models, the solution provides built-in templates that enable rapid identification of regulated data, highlight security risks, and help you uncover compliance gaps. A streamlined workflow exposes security blind spots and reduces remediation time. Detailed reporting supports compliance programs and facilitates executive communication.

Strong access management and authentication

Thales Access Management and Authentication solutions provide both the security mechanisms and reporting capabilities organizations need to comply with data security regulations. Our solutions protect sensitive data by enforcing the appropriate access controls when users log into applications that store sensitive data. By supporting a broad range of authentication methods and policy driven role-based access, our solutions help enterprises mitigate the risk of data breach due to compromised or stolen credentials or through insider credential abuse.

Support for smart single sign on and step-up authentication allows organizations to optimize convenience for end users, ensuring they only need to authenticate when needed. Extensive reporting allows businesses to produce a detailed audit trail of all access and authentication events, ensuring they can prove compliance with a broad range of regulations.

Protection of sensitive data at rest

The CipherTrust Data Security Platform is an integrated suite of data-centric security products and solutions that unify data discovery, protection, and control in one platform.

  • Discover: An organization must be able to discover data wherever it resides and classify it. This data can be in many forms: files, databases, and big data, and it can rest across storage on premises, in clouds, and across back-ups. Data security and compliance starts with finding exposed sensitive data before hackers and auditors. The CipherTrust Data Security Platform enables organizations to get complete visibility into sensitive data on-premises and in the cloud with efficient data discovery, classification, and risk analysis.
  • Protect: Once an organization knows where its sensitive data is, protective measures such as encryption or tokenization can be applied. For encryption and tokenization to successfully secure sensitive data, the cryptographic keys themselves must be secured, managed and controlled by the organization. The CipherTrust Data Security Platform provides comprehensive data security capabilities, including file-level encryption with access controls, application-layer encryption, database encryption, static data masking, vaultless tokenization with policy-based dynamic data masking, and vaulted tokenization to support a wide range of data protection use cases.
  • Control: The organization needs to control access to its data and centralize key management. Every data security regulation and mandate requires organizations to be able to monitor, detect, control, and report on authorized and unauthorized access to data and encryption keys. The CipherTrust Data Security Platform delivers robust enterprise key management across multiple cloud service providers (CSP) and hybrid cloud environments to centrally manage encryption keys and configure security policies so organizations can control and protect sensitive data in the cloud, on-premise and across hybrid environments.
  • Monitor: Finally, the enterprise needs to monitor access to sensitive data to identify ongoing or recent attacks from malicious insiders, privileged users, APTs, and other cyberthreats. CipherTrust Security Intelligence logs and reports streamline compliance reporting and speedup threat detection using leading Security Information and Event Management (SIEM) systems. The solution allows immediate automated escalation and response to unauthorized access attempts and provides all the data needed to build behavioral patterns required to identify suspicious usage by authorized users.

Protection of sensitive data in motion

Thales High Speed Encryptors (HSEs) provide network independent data-in-motion encryption (Layers 2,3 and 4) ensuring data is secure as it moves from site-to-site, or from on-premises to the cloud and back. Our HSE solutions allow customers to better protect data, video, voice, and metadata from eavesdropping, surveillance, and overt and covert interception—all at an affordable cost and without performance compromise.

Protection of cryptographic keys

Luna HSMs from Thales provide a hardened, tamper-resistant environment for secure cryptographic processing, key generation and protection, encryption, and more. Available in three FIPS 140-2 certified form factors, Luna HSMs support a variety of deployment scenarios.

In addition, Luna HSMs:

  • Generate and protect root and certificate authority (CA) keys, providing support for PKIs across a variety of use cases
  • Sign your application code so you can ensure that your software remains secure, unaltered, and authentic
  • Create digital certificates for credentialing and authenticating proprietary electronic devices for IoT applications and other network deployments

Related Resources

Secure your digital assets, comply with regulatory and industry standards, and protect your organization’s reputation. Learn how Thales can help.

SafeNet Trusted Access Brings Security to Authentication and Access - Product Review

SafeNet Trusted Access Brings Security to Authentication and Access - Product Review

Product review of SafeNet Trusted Access. Explore the options of authentication security that STA offers, to bridge the MFA, SSO and access management worlds in a single, well-integrated package. Discover how your business can bring security to access management.

Thales Converged Badge Solutions - Solution Brief

Thales Converged Badge Solutions - Solution Brief

In today’s ever increasing digital world, protecting critical data and ensuring the identity of those accessing data is essential. The standard measures once thought to be strong enough are simply insufficient when compared to the sophistication and persistence of today’s...

Compliance Requirements for American Financial Services Organizations

Compliance Requirements for American Financial Services Organizations - eBook

This eBook covers some of the most important regulations affecting Financial Services organizations in the United States and how Thales cybersecurity solutions help meet requirements for risk management, data privacy, access management and much more. Included regulations:...

Thales CipherTrust Data Discovery and Classification

Thales CipherTrust Data Discovery and Classification - Product Brief

The crucial first step in privacy and data protection regulatory compliance is to understand what constitutes sensitive data, where it is stored, and how it is used. If you don't know what sensitive data you have, where it is, and why you have it, you cannot apply effective...

CipherTrust Transparent Encryption - White Paper

CipherTrust Transparent Encryption - White Paper

Enterprise digital transformation and increasingly sophisticated IT security threats have resulted in a progressively more dangerous environment for enterprises with sensitive data, even as compliance and regulatory requirements for sensitive data protection rise. With attacks...

CipherTrust Transparent Encryption - Product Brief

CipherTrust Transparent Encryption - Product Brief

Safeguarding sensitive data requires much more than just securing a data center’s on-premises databases and files. The typical enterprise today uses three or more IaaS or PaaS providers, along with fifty or more SaaS applications, big data environments, container technologies,...

The Key Pillars for Protecting Sensitive Data in Any Organization - White Paper

The Key Pillars for Protecting Sensitive Data in Any Organization - White Paper

Traditionally organizations have focused IT security primarily on perimeter defense, building walls to block external threats from entering the network. However, with today’s proliferation of data, evolving global and regional privacy regulations, growth of cloud adoption, and...

The Enterprise Encryption Blueprint - White Paper

The Enterprise Encryption Blueprint - White Paper

You’ve been tasked with setting and implementing an enterprise wide encryption strategy, one that will be used to guide and align each Line of Business, Application Owner, Database Administrator and Developer toward achieving the goals and security requirements that you define...

Luna Network HSM

Luna Network Hardware Security Module - Product Brief

Secure your sensitive data and critical applications by storing, protecting and managing your cryptographic keys in Thales Luna Network Hardware Security Modules (HSMs) - high-assurance, tamper-resistant, network-attached appliances offering market-leading performance and...

Unshare and Secure Sensitive Data - Encrypt Everything - eBook

Unshare and Secure Sensitive Data - Encrypt Everything - eBook

Business critical data is flowing everywhere. The boundaries are long gone. As an enterprise-wide data security expert, you are being asked to protect your organization’s valuable assets by setting and implementing an enterprise-wide encryption strategy. IT security teams are...

High Speed Encryption Solutions - Solution Brief

High Speed Encryption Solutions - Solution Brief

Networks are under constant attack and sensitive assets continue to be exposed. More than ever, leveraging encryption is a vital mandate for addressing threats to data as it crosses networks. Thales High Speed Encryption solutions provide customers with a single platform to ...

Other key data protection and security regulations

GDPR

Regulation
Active Now

Perhaps the most comprehensive data privacy standard to date, GDPR affects any organization that processes the personal data of EU citizens - regardless of where the organization is headquartered.

PCI DSS

Mandate
Active Now

Any organization that plays a role in processing credit and debit card payments must comply with the strict PCI DSS compliance requirements for the processing, storage and transmission of account data.

Data Breach Notification Laws

Regulation
Active Now

Data breach notification requirements following loss of personal information have been enacted by nations around the globe. They vary by jurisdiction but almost universally include a “safe harbor” clause.