Community Bank & Credit Union
Cyber Defense Kit.

The US government will continuously scan your public-facing internet addresses and email you a weekly report of every exposed service and known vulnerability, the same view an attacker gets, in your inbox first. Financial services is one of the nation's critical infrastructure sectors, so you qualify. Zero effort after enrollment.

1. Email vulnerability@cisa.dhs.gov with the subject line "Requesting Cyber Hygiene Services". Say you are a bank or credit union (critical infrastructure, you qualify).
2. CISA replies with a service request form and acceptance letter. Fill them in and list your public IP addresses (your ISP can confirm the full range).
3. Scanning usually begins within about three business days; your first report arrives within roughly two weeks, then weekly.
4. Treat every "Critical" or "High" finding as a work order. Anything touching remote access, a VPN, or a public web application gets fixed that day.

Contact: vulnerability@cisa.dhs.gov · details at cisa.gov/cyber-hygiene-services

This is how small institutions actually get breached. One afternoon of unglamorous work removes the attack paths behind most account-takeover and ransomware incidents.

1. Inventory every way in. List every method anyone uses to reach your systems from outside: VPN, RDP, TeamViewer/AnyDesk, vendor remote support, port forwards on the firewall. Ask each vendor directly: "How do you connect when we call you?"
2. Turn on MFA everywhere it exists, and make it phishing-resistant where you can: email, VPN, the admin consoles for online and core banking, wire/ACH origination, cloud services, and your own bank accounts. Admin access to money movement without MFA is the finding that ends careers.
3. Kill exposed remote access. Remove firewall port-forwards pointing at internal systems; uninstall any remote-access tool no one can explain. Rebuild legitimate needs properly (identity-based access, Tier 3 / CIS 6).
4. Change every default and reused password into a password manager (per the VCRI Starter Kit). Enforce least privilege: no one keeps admin rights "just in case."

Tip: that inventory becomes the seed of your asset list (CIS 1) and your access-review (CIS 5).

Business email compromise runs on spoofed domains. SPF, DKIM, and DMARC let receiving mail servers reject email that forges your bank's domain, protecting your customers and staff from fraud sent "from" you. It is free, and it is increasingly an examiner expectation.

1. Publish an SPF record listing the servers allowed to send as your domain, and enable DKIM signing in your mail platform (Microsoft 365 / Google Workspace both document this).
2. Publish a DMARC record starting at p=none with reporting turned on, so you can see who sends as you before you enforce.
3. Read the reports with a free analyzer (for example URIports or dmarcian's free tier), fix any legitimate senders, then move to p=quarantine and finally p=reject.
4. Do the same for every lookalike or parked domain you own, so no one can register a near-match and spoof it.

Why it is urgent: a spoofable domain is the raw material for wire-fraud emails aimed at your customers and your own staff.

Shodan is the search engine attackers use to find exposed systems. A one-time membership lets you put a standing watch on your own addresses: the day something of yours is exposed to the internet, you get an email. It complements the CISA scan with instant alerts.

1. Create an account at shodan.io and buy the one-time membership (~$49; they run frequent $5 sales).
2. At monitor.shodan.io, add your public IP range and enable all alert types.
3. Search Shodan for your institution's name and town. Anything of yours already listed goes to the top of today's list.

Contact: monitor.shodan.io · route alerts to two people, not one.

The single highest-value control for a community institution, and it costs nothing but discipline. Most wire losses are not a hacked system, they are a legitimate operator tricked into sending money. Dual control plus an out-of-band callback breaks the fraud even when the email looks perfect.

1. Dual control on every wire and ACH batch above a low threshold: one person initiates, a different person approves, in the system, never by email.
2. Out-of-band callback for any new or changed payee or instruction: call back on a known number from your records, not a number in the request. This defeats business email compromise.
3. Train the frontline that urgency and secrecy ("the CEO needs this wire now, do not tell anyone") are the fraud, not the exception.
4. Write it as a one-page procedure, have the board adopt it, and test it in the tabletop below.

If a fraudulent wire goes out: report to the FBI's IC3 Financial Fraud Kill Chain immediately (ideally within 72 hours, for larger domestic wires) at ic3.gov, fast reporting is how funds get frozen and recovered.

Institutions that survive ransomware are the ones with tested, offline backups. Veeam's free edition covers 10 machines, enough for the servers that matter at most small banks.

1. Download Veeam Backup & Replication Community Edition from veeam.com and install it on a dedicated machine, not one you are backing up.
2. Back up, in priority order: domain controllers, file servers, the systems that hold loan and deposit records and documents, and any on-premises application servers.
3. Follow 3-2-1: three copies, two media, one offline. The offline copy can be USB drives rotated weekly, the off-rotation drive unplugged in a drawer or offsite. Ransomware cannot encrypt a disconnected drive.
4. Put a monthly 30-minute test on the calendar: restore one file, boot one machine's backup, and log it. An untested backup is a hope, not a plan, and the log is gold at exam time.

Note: confirm your core/online-banking provider's own backup and recovery commitments in writing; this covers what you run. Open-source alternatives: Duplicati, restic.

CISA scans you from outside; this scans from inside, where a phished laptop or a flat network does the damage.

1. Nessus Essentials (tenable.com) is free for up to 16 addresses, usually enough for a branch's core IT segment. Install on an office PC or VM and scan monthly.
2. Greenbone / OpenVAS (greenbone.net) is free and open-source with no address limit, more setup effort, no cap.
3. Work Critical findings first; most fixes are "install the update" or "turn off the unused service." Keep the reports, they document your vulnerability-management program.

Scope: your own IT network only. Never actively scan a provider-hosted platform without written authorization.

A vulnerability scanner tells you a service might be weak. These tools help answer the sharper question: is it actually exploitable from where an attacker stands? They turn a long list of "criticals" into the short list that truly matters, on the systems you own.

1. Nuclei (github.com/projectdiscovery/nuclei) runs a large, community-maintained library of templates that check for specific, known-exploitable conditions against your public addresses and web apps. Fast, scriptable, and it tells you which known issue is live, not just that a port is open.
2. OWASP ZAP (zaproxy.org) is a free web-application scanner (DAST). Point it at a web app you operate, a marketing site, a customer portal you host, to find injection, authentication, and session flaws before someone else does.
3. Start with ZAP's passive scan and Nuclei's safe template sets; graduate to active checks only in a test window, with change management, and with monitoring watching.

Going further: the Metasploit Framework (CIS 18) validates exploitability hands-on; treat it as a tool for an authorized tester, internal or hired, not a routine scan.

The FFIEC retired its Cybersecurity Assessment Tool on 31 August 2025. There is no mandated replacement, but examiners now expect you to assess against an established framework. Two free ones are built for exactly this.

1. CRI Profile (cyberriskinstitute.org): the financial-sector framework, free, maps to NIST CSF, FFIEC, and more. The most direct CAT successor for a bank or credit union.
2. NIST CSF 2.0 and CISA's Cross-Sector Cybersecurity Performance Goals are the other FFIEC-named options; the CIS Controls (mapped below) are a concrete, tool-backed way to execute them.
3. Credit unions: the NCUA's ACET was CAT-based and is affected by the same sunset; confirm current NCUA guidance and use the CRI Profile or NIST CSF 2.0 in the interim.
4. Miss the CAT's maturity charts? The free BeaconScore renders your result as an examiner-style report with baselines derived from the FFIEC CAT, plus a maturity radar and a domain heatmap, the familiar CAT-style view, free, now that the official tool is retired. It is the fastest way to hand your board and your examiner something that looks like what they are used to.

Keep the artifact: your completed self-assessment plus the BeaconScore examiner-style report and your scan logs are the exam story that you run a real program.

Two hours walking through "a wire went out to a criminal" or "the servers are encrypted", often the first time operations, IT, lending, and management talk through the same emergency. CISA and FS-ISAC both publish ready-made packages with facilitator scripts.

1. Download a CISA Tabletop Exercise Package from cisa.gov (ransomware or business-email-compromise scenario), and ask FS-ISAC about its member exercises.
2. Invite the president, operations, whoever does IT, lending, and your core/IT provider. Walk the scenario and capture every "wait, who calls whom?"
3. Write the one-page result: who declares an incident; who calls the FBI/IC3, the Secret Service, your regulator, your insurer, and FS-ISAC; and your customer-notification path. Print it, the plan must survive the network being down.

During an incident: report@cisa.gov · 1-844-SAY-CISA · ic3.gov · plus your regulator and FS-ISAC.

This is the "tripwire" function: file integrity monitoring plus host intrusion detection. An agent on each critical server watches the files, registry keys, and accounts that should almost never change, and alerts the moment they do, exactly how you catch an intruder who already has a foothold. Wazuh is the actively developed successor to OSSEC and adds log collection and alerting; OSSEC is the lighter original if you want minimal footprint.

1. Install the Wazuh server (wazuh.com) on a dedicated VM, then deploy the agent to your highest-value hosts: domain controllers, file and application servers, the wire/ACH workstation, and any server holding customer records.
2. Turn on file integrity monitoring for the directories, binaries, and registry keys that should not change day to day, and enable the rules for new admin accounts, failed logins, service changes, and ransomware-like file activity.
3. Prefer OSSEC (ossec.net) if you want a lean, server-only HIDS/FIM; add AIDE (aide.github.io) on Linux hosts for simple, classic tripwire-style integrity checks.
4. Weekly ritual (30 min, calendared): review integrity alerts, new accounts, and authentication failures. Screenshot the dashboard into a running log, that trail is gold for auditors, examiners, and any future incident.

Note: Wazuh also satisfies much of CIS 8 (audit log management) for the hosts it covers.

One quiet PC plugged into a mirror port on your core switch, running free, open-source software. It listens to a copy of your traffic, it cannot touch operations, and gives you intrusion detection, full network visibility, and an automatic asset inventory: the architecture commercial products charge five figures a year for.

 INTERNET ── FIREWALL ── CORE SWITCH ────────── branch PCs, servers
                             │ ░ SPAN/mirror port (copy of traffic)
                             ▼
                       ┌───────────────┐
                       │  SENSOR BOX   │  NIC 1: sniffing (no IP address)
                       │  Security     │  NIC 2: management (dashboards)
                       │  Onion        │
                       └───────────────┘

Hardware (~$800-1,500): a small server or mini-PC with 8+ cores, 32 GB RAM (64 GB if budget allows), a 1-2 TB SSD, and at least two Ethernet ports. Refurbished business hardware works fine.

1. Configure a SPAN/mirror port on your core switch to copy all traffic, and cable it to the box's sniffing NIC (the sniffing NIC gets no IP address).
2. Install Security Onion (securityonionsolutions.com), the free, open-source monitoring distribution. One install gives you Suricata (intrusion detection), Zeek (traffic analysis), full packet search, and dashboards, and it integrates Wazuh from the tier above.
3. Baseline week: let it run, then review the asset list with your IT lead. "What is that device?" is the whole point.
4. Weekly review (30 min): top alerts, new devices, authentication failures, anything talking to somewhere it should not. Log it.