This website uses cookies to store information on your computer. Some of these cookies are used for visitor analysis, others are essential to making our site function properly and improve the user experience. By using this site, you consent to the placement of these cookies. Click Accept to consent and dismiss this message or Deny to leave this website. Read our Privacy Statement for more.
Home   |   Contact Us   |   Sign In   |   Register
Article Library
Blog Home All Blogs

USFN Briefing Highlights Emerging REO Trends

Posted By USFN, Friday, November 14, 2025
Updated: Wednesday, November 12, 2025

By Kathryn H. Kellam (Katie), Esq.

BWW Law Group, LLC *

USFN Member (DC, MD, VA)

 

On September 16, 2025, USFN held an installment of its briefing series focusing on various emerging topics in the REO/Eviction sphere of the default industry. Both new and seasoned professionals gained valuable knowledge from the panel, which focused on national and state-based themes. The goal of the session, titled “REO/Eviction Refresher & Hot Topics Under a New Administration,” was to touch on the fundamentals of this practice area and enlighten attendees on current issues affecting post-sale processes nationwide.

 

Roy A. Diaz (Diaz | Anselmo) moderated the panel. He was joined by panelists Joe Hawk (Walentine O’Toole, LLP), Stuart Gordon (McCalla Raymer Leibert Pierce, LLP), and William R. Jarrell (Aldridge Pite, LLP). All of the panelists brought an abundance of knowledge and information to the virtual briefing space and created a plethora of opportunities for future in-depth discussions regarding the evolving post-sale landscape.

 

The panel kicked off with a discussion of legislative efforts aimed at squatters in REO properties. Legislatures across the country have passed new laws detailing expedited procedures for removing squatters from properties, which is welcome news when it comes to handling REO portfolios. Many of the new laws went into effect in July of 2025. Traditionally, laws throughout the nation have favored squatters. However, the presence of squatters blocks vacant properties from being marketed, sold, or rented in a timely fashion. Lawmakers have taken note of the delays that occur as a result of squatters, with worsening housing supply shortages in a constrained market bringing some of these issues to the forefront.

 

Vexatious Litigants are another area of recent legislative concern on which the panel focused. Repeated baseless filings by borrowers and related parties continue to delay closings and evictions in the months after a foreclosure sale. A handful of states have recently explored passing litigation to curb the problems brought on by such litigants, including the unnecessary delays and great expenses of handling lawsuits and counter-claims brought by these individuals. While only a few states have passed legislation so far, including California, Illinois, and Nevada, other legislatures are working through proposed legislation on this topic, which could serve to curb the frivolous motions, delays, and abusive tactics of vexatious litigants nationwide.

 

In order to effectively handle post-sale matters, the panel turned to a refresher of the REO and Eviction processes, focusing on post-pandemic trends and emerging compliance considerations under the new presidential administration. This discussion was well-tailored to professionals of varying experience levels, as the panel touched on the basics of what happens post-foreclosure sale and the myriad of issues that could arise at each step in the process, especially as there are lingering backlogs from pandemic and new tenant protection statutes that have been passed in many jurisdictions. The panel also addressed the evolving landscapes of the CFPB, HUD, Veterans Affairs, and the USDA, opining on what lies ahead for the agencies for the remainder of 2025 and into 2026.

 

Finally, the panel shed light on issues that arise with third party vendors assisting with REO properties and recommended best practices for their use. The panel highlighted the need for strong indemnity provisions and to ensure that vendors understand state specific limits – as a one-size-fits-all 50-state approach is often ineffective when it comes to post-sale matters.

 

As the panel noted, “[t]he REO and eviction space is being reshaped by policy, politics, and public sentiment.” Proactive strategies, good legal foresight, and staying well-informed of developments in this area of law are the keys to success in managing REO portfolios in the months and years to come. USFN continues to provide vital educational resources to help the industry meet these challenges. For more on upcoming briefings, compliance events, and digital tools—including the USFN Source platform—visit usfnevents.org or explore the member directory to connect with experts in this space.

 

Tags:  #Briefing  #REO  #USFN 

PermalinkComments (0)
 

USFN Briefing Sheds Light on HECM/Reverse Mortgages and Their Unique Legal Landscape

Posted By USFN, Friday, July 18, 2025
Updated: Thursday, July 17, 2025

By Adam A. Diaz, Esq.

Diaz Anselmo*

USFN Member (FL, IL, IN, KY, OH, WI)

 

As part of its ongoing Briefing Series, USFN hosted an informative virtual session on May 13, 2025, spotlighting the complexities of HECM (Home Equity Conversion Mortgage) loans—commonly known as reverse mortgages. The session, titled "Enforcement, Foreclosure, and Key Differences from Conventional Loans," provided a comprehensive overview of the unique characteristics of HECM loans and the legal challenges servicers and practitioners encounter when managing these products.

 

The panel featured seasoned professionals including Caren Castle (The Mortgage Law Firm), Eric Rudolphy (Celink), Adam Gross (Gross Polowy, LLC), and Eileen Papariella (Single Source Property Solutions). Each brought a wealth of experience and insight to the session, contributing to a robust discussion on the nuances of reverse mortgage enforcement and asset management.

 

The panel began by revisiting the fundamentals. A HECM is a federally insured reverse mortgage product available to homeowners aged 62 or older. It allows borrowers to access the equity in their homes without the burden of monthly mortgage payments. As the panel highlighted, this structure creates a unique servicing and enforcement environment due to the fact there are no installment payments. Key loan features include borrower age, repayment triggers (typically upon death or move-out), and restrictions surrounding occupancy and property condition.

 

One of the most nuanced areas covered was enforcement. Unlike traditional mortgages, HECMs are generally non-recourse and become due and payable upon specific "triggering events," such as the borrower’s death, the home no longer being the principal residence, or failure to pay taxes and insurance.  These trigger events are unique to HECM loans, and based on the loan documents, a notice of default is potentially not needed to begin the foreclosure process.

 

Since the majority of defaults should result from the death of the borrower, it is important to determine whether a probate is necessary to foreclose a HECM loan.  The answer, as explained, depends on the state. In some jurisdictions, like Wisconsin, a probate is required in order to obtain a party to serve.  However, in other states, such as Florida, a probate should never be filed in order to commence foreclosure.  This lack of uniformity underscores the importance of understanding state-specific probate rights and dower laws when enforcing these loans.  It is also important not to ignore a probate when it is filed.  For example, in Ohio, there are land sales through probate may be required, while others do not mandate probate proceedings.

 

The panel explored how HECM foreclosures diverge from traditional foreclosure processes. For instance, a demand letter may not be necessary in every HECM foreclosure, particularly when the loan has automatically matured. However, property status—whether vacant or occupied—affects how and when foreclosure proceedings can commence.

 

Also discussed were standing challenges, which are treated differently for HECMs compared to conventional loans. In many states, such as Florida and New York, HECM loans potentially are non-negotiable, this means the Courts may not be able to rely on the endorsement to prove standing.

 

Another legal wrinkle is the statute of limitations. The panel explained that HECMs often follow a distinct limitations timeline, particularly when successive foreclosure actions or res judicata come into play. Practitioners are advised to tread carefully, ensuring accurate date tracking and analysis of prior enforcement efforts, and to look at the facts for each case.  There is potential case law stemming from 28 U.S.C. § 2415(c), that may allow the enforcement of a loan that is passed the statute of limitations.

 

Rounding out the discussion, the panel turned its focus to REO asset management—a critical, often overlooked component of post-foreclosure HECM handling.

 

Several best practices emerged:

  • Partner with vendors who understand HECM timelines and regulatory pitfalls.
  • Obtain the most accurate initial valuation to reduce the risk of appraisal-based claims (commonly referred to as ABCs).
  • Use appraisers trained specifically on reverse mortgage products.
  • Ensure quality control reviewers are highly experienced and trained in HUD protocol.

 

Choosing REO agents and vendors who are well-versed in HECM-specific compliance and financial analysis is important, particularly when weighing Asset-Based Claims (ABC) versus Servicer-Based Claims (SBC). The goal: maximize investor recovery while adhering to HUD’s stringent guidelines.

 

This USFN Briefing reinforced that HECM loans are not simply conventional loans in reverse—they come with their own ecosystem of legal, financial, and servicing requirements. From probate complexities to appraisal practices, the stakes are high for servicers and legal professionals navigating these waters.

 

USFN continues to provide vital educational resources to help the industry meet these challenges. For more on upcoming briefings, compliance events, and digital tools—including the new USFN Source platform—visit usfnevents.org or explore the member directory to connect with experts in this niche space.

 

Copyright © USFN 2025

USFNews_July 23

 

*Denotes firm is a 2024 USFN Award of Excellence recipient.

Tags:  #Briefing  #HECM  #ReverseMortgages 

PermalinkComments (0)
 

USFN Briefing Explores New FinCEN Rules on Real Estate Transactions

Posted By USFN, Wednesday, April 9, 2025

By JaVonne Phillips, Esq.

McCarthy & Holthus, LLP*

USFN Member (AZ, AR, CA, CO, ID, NV, NM, OR, TX, WA)

 

The real estate industry will soon be hit with yet another new requirement that, at the moment, will require significant additional work for handling certain residential property transactions.

 

As discussed at the USFN Briefing held on March 25, 2025, regarding the new Financial Crimes Enforcement Network (FinCEN) rule, panelists from law firms and Auction.com provided insight regarding the key provisions of this rule.

 

The new FinCEN rule, which will go into effect on December 1, 2025, is aimed at enhancing transparency by requiring reporting of extensive information related to the sales of United States residential properties to domestic and foreign third-party entities or trusts. The goal is to attempt to prevent these types of transactions from being a haven for money laundering, terrorist funding, and other illicit activities.

 

The requisite reporting includes the nature of the funds provided to purchase the properties. Sales subject to this rule must involve cash-related considerations such as cashier’s checks and money orders. Financed real property transactions were excluded from the reporting requirement given the existing safeguards involved.

 

The applicable residential properties currently include, but are not limited to, single-family homes, condominiums, townhomes, and mixed-use buildings. The rule also applies to vacant or unimproved land upon which the transferee intends to build up to four residential structures.  Determining such intent may be only one of many possible challenges with attempting to comply with this rule.

 

The rule requires the gathering of information about the sellers as well as the individuals associated with buying the property for the entity or trust. Such information includes names, addresses, and copies of forms of identification such as driver’s licenses and passports. If multiple individual buyers are involved, then the ones with a 25% or more interest or with a substantial ownership interest must be reported. Note that if an entity purchasing the property is a shell company—100% owned by another entity, then research must be conducted until there is identification of the actual beneficial owner for owners for reporting. The time and expense associated with this task will undoubtedly be significant.

 

In order to satisfy the reporting requirements a form must be completed. In its current state it has been estimated that the proposed form has no less than 111 data fields with up to 70 of those fields involving information that is not typical of real estate transactions. The time and expense that will be associated with gathering the required information may be another concern regarding the rule. For instance, some of the required information is confidential. Additionally, buyers or potential buyers may not be willing to provide such information. Further, issues could arise if the buyers do not cooperate with providing any or all of the required information.

 

In any event, the reporting requirements must be satisfied by the last day of the month of the real estate transaction or 30 days after the real estate transaction takes place, whichever is later. The collected information must be securely stored for five years. The ability to timely gather and/or store the required information may present another challenge to those required to report.

 

There are exceptions and exemptions to the reporting requirements related to legal entity and trust purchasers to whom the FinCEN rule does not apply. The rule does not apply to low-risk transfers due to death, divorce, easement transfers, and transfers to a bankruptcy estate. Also, the rule will likely be inapplicable to judicial foreclosures which have court oversight. Trusts for estate planning purposes are also not subject to the rule. Transactions that occur pursuant to section 1031 of the Internal Revenue Code which regards using funds from a sale to buy another property are also exempt. At the moment, there are no blanket exceptions for attorneys despite the attorney-client privilege.

 

Considering the enhanced responsibilities described thus far, it may beg the question, “Who is responsible for the required reporting?” Those handling the closing and settlement services of the applicable real estate transactions appear to be undisputed primary reporters. However, in the default servicing world regarding sales pursuant to the non-judicial foreclosure process, the responsible parties seem to be less clear. In general, it may be the party responsible for recording the deed. Assessment in this regard will require a review of the applicable state’s cascade since not all states have the same process. The importance of communication between the relevant, involved parties cannot be stressed enough so that the reporting requirement does not fall through the cracks due to a lack of agreement and understanding regarding who will conduct the reporting. An option that might be helpful for those to whom this rule applies is that a reporter may be designated; however, it must be on a transaction-by-transaction basis. The ability to obtain a blanket designation is not currently permitted.

 

It will be important to educate and train relevant staff in order to ensure compliance with this FinCEN rule. A failure to comply may result in a $5,000 fine for each day of the violation, up to five years of imprisonment, and/or additional fines for willful violations or patterns of negligent activity. As part of an effort to avoid consequences it may be worthwhile to always exercise good faith, and diligent efforts toward obtaining the required information in the event that there are obstacles such as a lack of buyer cooperation. Other challenges with compliance may occur in jurisdictions where the winning bidder differs from the vesting party; therefore, compliance to the extent possible might be helpful in avoiding negative consequences.

 

This rule is subject to ongoing changes which may provide hope for less burdensome requirements. For example, days before the USFN Briefing on this topic FinCEN changed another recently implemented rule regarding Beneficial Ownership Information (BOI) reporting to create an exemption for domestic reporting companies and their beneficial owners. Therefore, a similar change could be enacted with respect to the FinCEN rule discussed in this article. A change such as this one would provide welcome relief for the foreclosure realm. Time will tell so this rule should be closely monitored through its December 1, 2025, effective date.

 

Copyright © USFN 2025

USFNews - April 16, 2025

 

* Denotes firm is a 2024 USFN Award of Excellence recipient.

 

 

Tags:  #Briefing  #FINCEN 

PermalinkComments (0)
 

USFN Briefing examines 3 new loss mitigation options and their impacts in bankruptcy

Posted By USFN, Wednesday, September 25, 2024

By Travis Menk, Esq.

Brock & Scott, PLLC *

USFN Member (CT, NC, RI, AL, FL, GA, KY, ME, MD, MA, MI, NH, NJ, OH, PA, SC, TN,   VT, VA)

 

During USFN’s Sept. 10 Briefing, New Loss Mitigation Options and Bankruptcy Impacts, a discussion featuring four Creditors’ attorneys and a servicer internal legal counsel highlighted the new last chance waterfall options recently implemented by the VA, FHA, and the USDA, and each program’s respective impacts on debtors and creditors in bankruptcy. Each of these programs, while created with the intent to assist borrowers with new options in light of the high-interest rate environment, opens the door to a host of potential issues in the realm of bankruptcy. This Briefing gave a basic educational overview of each of the three programs and detailed the considerations and impacts on current bankruptcy processes and forms that will need concentrated attention by debtors, creditors, and trustees alike to eliminate potential challenges throughout the bankruptcy process.

 

The Veteran’s Affairs Servicing Purchase Program – U.S. Department of Veterans Affairs

 

Marcy J. Ford, Partner at Trott Law, began the presentation with an overview of the VA’s last chance waterfall option known as VASP. This program provides for a loan modification significantly below market interest rate with a 30-to-40-year term option and may require a three-month trial period. Ford noted that if the debtor is involved in an active Chapter 13 case, VASP will not be considered while the case is pending unless the Chapter 13 was filed during a trial period, in which case court approval is required to finalize the modification. It was noted that in jurisdictions which do not typically require court approval, this court approval would likely still be necessary based on the specific VA requirement in this situation. Ford also noted that if the borrower is in an active Chapter 7 case and applies for loss mitigation, VASP will not be an option until the case is closed. However, it was noted that if the debtor files for bankruptcy during the trial period, VASP finalization goes on hold until the bankruptcy case is closed.  Emphasis was placed on the case having to be closed and that having stay relief or the trustee filing a report of no distribution would be insufficient. Ford also noted that caution should be given about advising debtors to dismiss their cases based on the potential to get VASP eligibility.  A question asked of the panel was how to proceed with VASP as it relates to bankruptcy court mortgage modification/mediation orders, and it was surmised that these bankruptcy court modification/mediation programs could not supersede the rules set by the VA, and, as such, the court would be unable to force VASP as an option during the case.

 

The FHA Partial Claim + Payment Supplement Program – U.S. Federal Housing Administration

 

Maria Tsagaris, Partner at MRLP, continued the presentation with an outline of FHA’s last chance waterfall option known as the FHA Partial Claim + Payment Supplement program. Servicers must implement this program by January 1, 2025. Tsagaris detailed that borrowers will be eligible for an amount up to 30% of the outstanding balance of the loan for a combination of a partial claim to bring the account current with the remaining available balance divided over 36 months to act as reduction to the monthly payment amount up to 25% of the payment. The remaining balance after the partial claim piece is given to the creditor to bring the account current is to be held by the servicer as a separate custodial account that cannot be comingled with any other funds. The creditor is permitted to take funds out of the custodial payment supplement account and apply them to the account when the debtor pays the creditor the reduced monthly payment amount. The partial claim plus the payment supplement amounts will become an interest free second lien on the property pursuant to the recorded security instrument, which will come due when the first mortgage is paid or refinanced or upon the sale of the property.

 

Tsagaris mentioned that for the debtor to be eligible for this program, they had to indicate that they could maintain the payment and had to sign a note, security instrument, and payment supplement agreement. In addition to an annual accounting to both HUD and the borrower, 60 to 90 days prior to the end of the 36-month period, the creditor would need to provide a detailed annual report as to the status of the payment supplement account. It was also noted that at 36 months and 1 day, the program will automatically terminate, and any remaining payment supplement funds had to be refunded to HUD. The program would also terminate in the following scenarios: request of the borrower, modification, foreclosure, short sale, or deed in lieu. 

 

Tsagaris noted a couple of the mechanics set forward by the program. The program requires 30-day default reports on each of these accounts but failure to make an ongoing payment does not terminate the program. The program also sets forth detailed instructions for the requirements and responsibilities of servicers regarding the transfers of loans that are involved in the program. Finally, Tsagaris also noted that servicers will receive a $1,750 payment supplement incentive for completion of the program. Full details of the program can be found in Mortgagee Letter 2024-02.

 

Alice Whitten, Internal Legal Counsel for Wells Fargo, when asked, stated that the incentive of $1,750 likely did not cover the cost to fully implement this program, as it has been described as one of the most complex programs to implement at the servicer level. A discussion among the panelists then ensued about whether industry members were getting too concerned about the impacts of these programs given that these were last chance waterfall options only available if all other waterfall options failed. The discussion focused on the fact that if interest rates remain high, precluding other loss mitigation waterfall options from being viable, these three programs and their impacts would likely be seen more often than naught. Given that thought process, the Briefing turned to the bankruptcy impacts of the FHA Partial Claim + Payment Supplement Program. 

 

Patrick Hruby, Senior Associate at Brock & Scott, PLLC, highlighted these impacts and many of the best practices that creditors, creditor’s attorneys, and trustees have been working together on to facilitate integration of this program into bankruptcy. Hruby presented a proposed 410A with disclosures regarding the debtor being in the program, the effects of the program on the ongoing payment, and the expiration date of the program for the debtor. He also noted suggested revisions to Part 3 of the 410A of the proof of claim for missed payments and corresponding unreceived monthly principal reductions. He also suggested revisions to Part 4 to account for the reduced ongoing payment amount due to the monthly principal reduction. Hruby also noted that for jurisdictions utilizing GAP Payments or administrative arrears, the payment supplement portion is going to want to be shown in Part 3. Hruby also noted that post bankruptcy entrance into the FHA Partial Claim + Payment Supplement Program would necessitate an amended proof of claim and a payment change notice. Also, payment change notices will need to be carefully drafted to note the full payment amount and the amount due from the borrower due to the payment supplement.  

 

The payment change notice information issue brought to the forefront that communication needs to be as clear as possible on all documents in bankruptcy with respect to this program in order to avoid any unintended consequences and potential inquiries from the trustees and U.S. Trustees/Bankruptcy Administrators. At the end of the 36-month payment supplement period or if the program is terminated, it was noted that a payment change notice will have to be filed to show the elimination of the monthly payment supplement. On the topic of program termination, it was noted that if the debtor modifies the loan, the program will be terminated. As a result, it was noted that creditor’s counsel will need to look closely at the plan for modifications or cramdowns that would terminate the program and object appropriately. Consequently, debtor’s attorneys should also be aware if their debtor client is in one of these programs and to shape the debtor’s plan accordingly so as not to inadvertently terminate the program. Finally, it was also noted that the handling of annualized payments in Chapter 12 cases would present some interesting and unique situations with respect to default reporting and payment supplement distribution.

 

Lance Olsen, Partner at McCarthy Holthus, LLP, continued the discussion of the impacts of this program in bankruptcy focusing on payoff statements, motions for relief, and consent orders. As an initial note, Olsen mentioned that relief would, in theory, be needed to record the second mortgage even though he had not seen a ton of referrals for relief to record other standard partial claim mortgages, unlike creditor’s attorneys in other parts of the country. Olsen continued by noting that under the program, if the creditor is asked for a payoff involving a loan in the partial claim + payments supplement program, the creditor will have to give a payoff for both the original loan and the second position lien partial claim + payment supplement balance. A discussion among the panelists explored whether these two payoffs should be done in two separate payoff quote letters or combined into one letter with the two separate payoffs included.  In addition, Olsen noted that creditors with motions for relief and in consent orders need to make sure to be very detailed and clear with additional disclosures and information in those motions and consent orders including, but not necessarily limited to, the total amounts owed, the reduced payment amounts owed, and the payment supplement amounts owed to the creditor as a result of the debtor failing to make the reduced payments to the creditor.

 

The Payment Supplement Account Program – U.S. Department of Agriculture

 

Ford finished up the Briefing by giving details on USDA’s last waterfall option, the USDA Payment Supplement Account Program. Ford stated that while this program is similar to FHA’s Partial Claim + Payment Supplement program, the programs differ in that this program utilizes an advance from the servicer and not a partial claim. As such, a second lien is not placed on the property and an additional note and mortgage are not signed. This program became effective July 24, 2024, with a goal to achieve an ongoing payment reduction of 25% for up to three years and would require three trial payments. Ford noted that no bankruptcy guidance has been presented by the USDA and so, as a result, it does not appear that an active bankruptcy would interfere with the implementation of this program.

 

The Briefing generated a significant number of audience questions. One question related to the timing of the recording of the partial claim. It was noted that the FHA instructions required the partial claim to be recorded in five days, which the bankruptcy practitioners noted would be difficult given motion timeframes in bankruptcy court, and, as a result, the motions may need to be filed as soon as the partial claim + payment supplement option is offered to attempt to comply with this requirement. Another question raised was whether any of the participants had faced any issues with a Trustee in a Chapter 7 bankruptcy saying the partial claim cannot be executed or recorded by the debtor, as the property is not part of the bankruptcy estate. Hruby indicated that he had courts in Ohio which have refused to approve partial claims, as they felt it interfered with the reaffirmation process, but none of the other panelists indicated they had any similar issues.

 

Each of these three programs are complex, with numerous details and nuances that will present challenges for debtors, creditors, courts, trustees, and counsels to navigate within the tides and winds of the bankruptcy process. Each bankruptcy practitioner and creditor should familiarize themselves with these programs and the impacts on bankruptcy in order to best insulate themselves from potential problems that could result if details are not thoroughly thought through.

 

Watch a recording of this Briefing and be sure to register for USFN’s next complimentary Briefing – Show Me, Insurability & The Road Ahead for REO Properties – on Oct. 15 at https://www.usfnevents.org/briefings.html.

 

 

Copyright © 2024 USFN

USFNews - Oct. 2, 2024

 

* Denotes firm is a 2023 USFN Award of Excellence recipient

Tags:  #Briefing  #lossmitigation 

PermalinkComments (0)
 

Mitigating Risk by Segmenting and Separating Data – Network Security Architecture Explained

Posted By USFN, Thursday, February 15, 2024

By Alexander Craddock and NateBraun

NetDirector

USFN Associate Member

 

With the latest generation of phishing and social engineering assisted by the newest AI technologies, information security is more important than ever for small businesses. According to the Acronis Cyberthreats Report, H2 2023, AI-enhanced phishing attacks affected over 90% of organizations surveyed and resulted in a 222% increase in email attacks in 2023 when compared to the same time period in 2022.

 

This risk is especially great for any business dealing in PII (Personally Identifiable Information), financial data, or legal – for the default servicing industry, this is the triple threat that makes security a high priority across the organization. One of the best strategies to ensure data security is data segregation.

 

The goal is to ensure that only the individuals who are authorized to view certain data sets have access to them – and that while that access is secure, it remains easy and convenient for the team members who need the data to do their job.

 

It’s easiest to envision a complete data segregation strategy by visualizing the way a layered, segmented security protocol works on physical documents. The familiar layers of security are present for most hard copies of documents in the physical world. An example:

 

·         a property gateway (potentially with a security guard) exists, verifying access to the property.

·         the building entrance uses a badge reader or biometric scan, and a secondary badge entrance would provide further segregated access to a particular wing.

·         within the wing, even fewer key cards would grant access to certain hallways or individual rooms.

·         a certain key is required to unlock a particular cabinet full of sensitive files.

 

In this example, there are up to six layers of security present between the “outside world” and the sensitive information, each of which limits access in steps. Could an outside unknown malicious actor get access to a document in the file cabinet (without the use of “Hollywood writers”)? The short answer is no. In this scenario, the only people who could do harm are a very limited number of internal employees, restricted by the many layers of access and significantly narrowing down potential threats.

 

What if one of those layers is compromised, like the lock on the cabinet? Even with one or two less layers of security, the documents themselves are still secure from outside access. Risk probability decreases exponentially after each layer of security in place.

 

An equivalent layered segregation process is the best approach to ensure a secure environment for digital data. For example:

 

·         A VPN gateway functions as the property access, with as many as eight factors of verification in this “frontline” defense: a username and password, with multifactor authentication (MFA) tokens matching the PC/Device, IP Address/location, a one-time PIN from Authenticator, mobile device registration for authenticating devices, and FaceID on the authenticated device.

·         Firewall/security rules work as the building key card: after VPN connection is established, the VPN client with an Endpoint Security Profile can determine what access is allowed based on the user’s account and group membership; denying or granting specific IP/port access.

·         Application authentication represents key card access to specific rooms and hallways, and is separately managed in a similar way to the VPN (factors include Internal WebUIs, File Shares, RDP, SSH, and a different username/password requiring a new MFA)

·         Finally, the file cabinet lock is represented by specific application access. After authentication in the previous steps, what data is available to that authenticated user in the specific application? This is the final step to ensuring the right data is readily available to users who need it, and can also determine read/write permissions, modification availability, etc.

 

Final questions to consider around data segregation include:

Q: How many layers does our company need?

A: One layer, even with MFA, is no longer enough. Companies should have at minimum two layers each with their own multifactor authentication before classified/protected information can be reached.

Q: Which technologies are most important to secure?

A: Endpoint security for physical devices (laptops, phones, etc.) through which employees can access classified information is most important. Authentication and file transfers for Unified Messaging technologies (email, IM, phone, online conference, voicemail) is second most important. Web based interfaces, applications, and connections would be third on the list. These are the big three that absolutely need their own layers of security, including MFA.

 

Copyright © 2024 USFN

USFNews - Feb. 21

Tags:  #Briefing  #Cybersecurity 

PermalinkComments (0)
 

Key Takeaways and Practical Tips from USFN’s Recent Briefing: Cyberattacks & How to Respond

Posted By USFN, Thursday, February 15, 2024

by Tina Crivello

Brock & Scott, PLLC *

USFN Member (CT, NC, RI, AL, FL, GA, KY, MA, MD, ME, MI, NH, NJ, OH, PA, SC, TN, VA, VT)

 

USFN kicked off the new year with a Briefing on one of the industry’s most timely and critical topics for today and the foreseeable future – Cyberattacks & How to Respond. On January 23, a panel of industry leaders, including attorneys, fintech leaders, and insurance experts, provided attendees key insight into the state of cyberattacks and what we can do now to prevent and prepare.

 

Cyberattack prevention as the first line of defense should be at the forefront of everyone’s efforts. Ronny Loew, ProCirrus Technologies, Inc., and Jan Duke, a360inc, shared the top elements of a prevention plan which includes a three-prong approach of user education, using application controls, and increasing awareness throughout an organization. Loew reminded attendees, “Eighty-two percent of the issues that are occurring are due to the human element.” Security training and simple, yet effective, controls such as multifactor authentication can help prevent many attacks. Just as important is email security, patching and updating of anything connected to the network or internet, and cybersecurity services such as endpoint monitoring. Duke suggested to ensure that phishing training campaigns in organizations are relevant to users, “so it’s something that really will try to appeal” to employees. She encourages organizations to have town hall meetings to discuss the dangers and “make it real” to employees, so they hear it from the top of how important this is.

 

Wendy Lee, of Sagent, covered highlights of communication plans once an incident has unfortunately occurred. She stressed the importance of pre-planning a crisis communication plan and how the onslaught of communication will be handled. Most critical is understanding federal law, state breach notification laws, contractual obligations, as well as executive buy-in and control. Lee shared a story about a recent settlement related to failure to disclose timely to victims of a cyberattack and stressed how critical it is to meet the notification requirements. Federal requirements, such as the Securities and Exchange Commission’s (SEC) four-day time limit, may not directly impact your business, but it could impact a company you do business with if they are a publicly traded company. Customers may require reporting in one day due to the SEC’s requirement for reporting events “that could have a material impact.” Evaluating materiality in a 24-hour window may be almost impossible, which means potentially reporting an incident whether it’s known yet if there is a material impact. Big companies today are making the required filing regardless of potential material impact to ensure adherence to the law.

 

Key points to include in a crisis communication plan include:

·         Understanding who to notify – victims, state Attorneys General, or other government entities

·         Knowing when to notify the above

·         Adhering to specific requirements about the notice contents

·         Following any state specific form of requirement – in writing, electronic, or by phone

 

Perhaps even before, or at minimum at the same time, as sending any other notices, Harrison Tropp of SGP Advisors, recommended immediately notifying your cyber insurance carrier or broker. Carriers have designated claims hotlines through which you are assigned an adjuster who will begin assembling the claim team. This may include the insurance adjuster and broker, a legal expert, a data security firm, and law enforcement. They will help a company figure out next steps. In cases of ransomware, this will almost always include immediately paying the ransom so companies can regain access to systems as expeditiously as possible. Tropp notes it’s critical to have draft communication ready to go should an event happen. It is also important to have an action plan in place and test it regularly. He also highlighted how the underwriting process, “especially in the default space has gotten increasingly more difficult.” During the underwriting process, insurance companies may run certain tests on a company’s systems and if they don’t meet the requirements they will refuse to underwrite.

 

Brian Nicholas, Esq., McCalla Raymer Leibert, Pierce, LLC, stressed the importance of running a test of a company’s action plan and key questions to ask. First response type questions may include, “How do you know if the attack is real?” and “Who should you contact first?,” among others. Second to answering those questions is knowing what your cyber insurance policy covers, how it helps, and how to activate coverage. In today’s online world, Nicholas recommends having a hard copy of your policy and response plan available to key members of your organization. Finally, Nicholas posed the question of how we reduce the risk of Personally Identifiable Information (PII) exposure. “The biggest risk is loss of that confidential information.” Understanding how companies keep or expunge that data, especially when considering, for many, adhering to state bar guidelines.

 

Nate Braun, of NetDirector, provided pointers on risk reduction with data segregation and segmentation. Network segmentation, which is the grouping and isolation of information systems by function and classification through use of controls, virtual environments, and disk encryption, are just a few steps an organization can take to protect data. Braun cleverly compared network security to being akin to physical security and showed how the multiple check points needed to access a physical file in a cabinet are analogous to the multifactor authentication steps needed when accessing data on a network.

 

The briefing was concluded by moderator Elizabeth DeSilva, Esq., and Brian Nicholas discussing what it really means to run a “table-top” drill. Nicholas explained it is just like your disaster recovery drills, where you run through the steps as if it had been a real event. It’s important to throw a few “curveballs” into the drill as well. What happens if your CIO is on vacation? If your email is down, do you have a secondary system or plan in place to communicate with employees and clients?

 

USFN is committed to helping the industry combat cybersecurity issues and will continue to bring members together to learn and share experiences and expertise surrounding this critical topic.

 

In the meantime, bookmark USFNevents.org and plan to join us for these upcoming virtual programs: 

  • March 12: USFN Briefing: Show Me the Judicial Foreclosure
  • May 7: USFNgage: Artificial Intelligence

 

Copyright © 2024 USFN

USFNews - Feb. 21

 

* Denotes Member is a 2023 USFN Award of Excellence Recipient

Tags:  #Briefing  #Cybersecurity 

PermalinkComments (0)
 
Membership Software Powered by YourMembership  ::  Legal