Using intelligence-driven security and filling internal gaps isnecessary to defend against today's cybercriminals. That is what security experts affirmed at theCU InfoSecurity 2015 conference in Las Vegas, Nev.

“If we intend to have a shot at staying equal [withcybercriminals], we've got to do things differently,” GeneFredriksen, chief information security officer for the St.Petersburg, Fla.-based PSCU, said. “What we've been doing for thelast 20-plus years as security technology isn't working.”

Highly organized, well-funded criminal organizations areactively engaged in cybercrime activities. Many of these organizations are fundedby foreign governments, and focused on finding and exploitingweaknesses in the U.S. financial infrastructure.

As a result of their organized efforts and high levels offunding, these organizations are able to create and deploysophisticated malware at an alarming pace, Fredriksen pointedout.

Cybercriminals want to unleash the kill chain, a systematicprocess designed to target and engage an adversary to create thedesired effects. The kill chain concept has been adopted todescribe the attack and exploitation process used by computercriminals.

This is an integrated, end-to-end process, Fredriksen said, andany one deficiency can interrupt the entire process. Rather thanfocusing all cyber-protection efforts on one point (i.e. theperimeter), PSCU network and information defenses are designed tointerrupt the kill chain at multiple layers in the system.

Intelligence-driven security, Fredriksen explained, yields amuch more robust security infrastructure than traditional methodsdo.

“The whole idea of building tech walls and hoping the bad guysstay out has not worked since the city of Troy,” he said.

Erik Gustafson, president and chief technology officer at theChicago-based Xamin, said in a CU InfoSecurity presentation, “WhereI find a gap in the market is internal hardening, especially from anetwork standpoint, as well as PCs and servers.”

Gustafson recommended credit unions look at their networkstrategy and focus on the non-obvious factors that could trigger abreach.

“Most focus on only the obvious, the external pieces,” the Xaminexecutive said, adding, “Internal hardening almost always goesignored, except for at audit time.”

Xamin scans reveal between 3,000 and 8,000 instances ofvulnerabilities during onboarding. Updates to third-party software,such as Java, Acrobat and Flash, bear responsibility for 75% of theissues.

He said many organizations tell you they have proper patchmanagement, but some of the tools they used have holes in thepatching. Other vulnerabilities come from third-party hardware anda network with holes.

Credit unions also need to perform third-party audits thatinclude a hardware and software configuration review, expertssaid.

“Once a year scans/audits are no longer good enough,” Gustafsonadvised. “Don't get laser focused on just buzz words or hot topicitems. Establish a security team [internally or outsourced].”