|
|
Posted By USFN,
Friday, November 14, 2025
Updated: Wednesday, November 12, 2025
|
By Kathryn
H. Kellam (Katie), Esq.
BWW
Law Group, LLC *
USFN Member (DC, MD, VA)
On September 16, 2025, USFN held an installment of its
briefing series focusing on various emerging topics in the REO/Eviction sphere
of the default industry. Both new and seasoned professionals gained valuable
knowledge from the panel, which focused on national and state-based themes. The
goal of the session, titled “REO/Eviction Refresher & Hot Topics Under a
New Administration,” was to touch on the fundamentals of this practice area and
enlighten attendees on current issues affecting post-sale processes nationwide. Roy A. Diaz (Diaz | Anselmo) moderated the panel. He
was joined by panelists Joe Hawk (Walentine O’Toole, LLP), Stuart Gordon
(McCalla Raymer Leibert Pierce, LLP), and William R. Jarrell (Aldridge Pite,
LLP). All of the panelists brought an abundance of knowledge and information to
the virtual briefing space and created a plethora of opportunities for future
in-depth discussions regarding the evolving post-sale landscape. The panel kicked off with a discussion of legislative
efforts aimed at squatters in REO properties. Legislatures across the country
have passed new laws detailing expedited procedures for removing squatters from
properties, which is welcome news when it comes to handling REO portfolios.
Many of the new laws went into effect in July of 2025. Traditionally, laws
throughout the nation have favored squatters. However, the presence of
squatters blocks vacant properties from being marketed, sold, or rented in a timely
fashion. Lawmakers have taken note of the delays that occur as a result of
squatters, with worsening housing supply shortages in a constrained market
bringing some of these issues to the forefront. Vexatious Litigants are another area of recent
legislative concern on which the panel focused. Repeated baseless filings by
borrowers and related parties continue to delay closings and evictions in the
months after a foreclosure sale. A handful of states have recently explored
passing litigation to curb the problems brought on by such litigants, including
the unnecessary delays and great expenses of handling lawsuits and
counter-claims brought by these individuals. While only a few states have
passed legislation so far, including California, Illinois, and Nevada, other
legislatures are working through proposed legislation on this topic, which
could serve to curb the frivolous motions, delays, and abusive tactics of
vexatious litigants nationwide. In order to effectively handle post-sale matters, the
panel turned to a refresher of the REO and Eviction processes, focusing on
post-pandemic trends and emerging compliance considerations under the new presidential
administration. This discussion was well-tailored to professionals of varying
experience levels, as the panel touched on the basics of what happens
post-foreclosure sale and the myriad of issues that could arise at each step in
the process, especially as there are lingering backlogs from pandemic and new
tenant protection statutes that have been passed in many jurisdictions. The
panel also addressed the evolving landscapes of the CFPB, HUD, Veterans
Affairs, and the USDA, opining on what lies ahead for the agencies for the
remainder of 2025 and into 2026. Finally, the panel shed light on issues that arise
with third party vendors assisting with REO properties and recommended best
practices for their use. The panel highlighted the need for strong indemnity
provisions and to ensure that vendors understand state specific limits – as a
one-size-fits-all 50-state approach is often ineffective when it comes to
post-sale matters. As the panel noted, “[t]he REO and
eviction space is being reshaped by policy, politics, and public sentiment.”
Proactive strategies, good legal foresight, and staying well-informed of
developments in this area of law are the keys to success in managing REO
portfolios in the months and years to come. USFN continues to
provide vital educational resources to help the industry meet these challenges.
For more on upcoming briefings, compliance events, and digital tools—including
the USFN
Source platform—visit usfnevents.org or explore
the member directory to
connect with experts in this space.
Tags:
#Briefing
#REO
#USFN
Permalink
| Comments (0)
|
|
|
Posted By USFN,
Friday, July 18, 2025
Updated: Thursday, July 17, 2025
|
By Adam A. Diaz, Esq.
Diaz │ Anselmo*
USFN Member (FL, IL, IN, KY, OH,
WI)
As part of its ongoing Briefing
Series, USFN hosted an informative virtual session on May 13, 2025,
spotlighting the complexities of HECM (Home Equity Conversion Mortgage)
loans—commonly known as reverse mortgages. The session, titled
"Enforcement, Foreclosure, and Key Differences from Conventional
Loans," provided a comprehensive overview of the unique characteristics of
HECM loans and the legal challenges servicers and practitioners encounter when
managing these products.
The panel featured seasoned
professionals including Caren Castle (The Mortgage Law Firm), Eric Rudolphy
(Celink), Adam Gross (Gross Polowy, LLC), and Eileen Papariella (Single Source
Property Solutions). Each brought a wealth of experience and insight to the
session, contributing to a robust discussion on the nuances of reverse mortgage
enforcement and asset management.
The panel began by revisiting the
fundamentals. A HECM is a federally insured reverse mortgage product available
to homeowners aged 62 or older. It allows borrowers to access the equity in
their homes without the burden of monthly mortgage payments. As the panel
highlighted, this structure creates a unique servicing and enforcement
environment due to the fact there are no installment payments. Key loan
features include borrower age, repayment triggers (typically upon death or
move-out), and restrictions surrounding occupancy and property condition.
One of the most nuanced areas
covered was enforcement. Unlike traditional mortgages, HECMs are generally
non-recourse and become due and payable upon specific "triggering
events," such as the borrower’s death, the home no longer being the
principal residence, or failure to pay taxes and insurance. These trigger events are unique to HECM
loans, and based on the loan documents, a notice of default is potentially not
needed to begin the foreclosure process.
Since the majority of defaults
should result from the death of the borrower, it is important to determine
whether a probate is necessary to foreclose a HECM loan. The answer, as explained, depends on the
state. In some jurisdictions, like Wisconsin, a probate is required in order to
obtain a party to serve. However, in
other states, such as Florida, a probate should never be filed in order to
commence foreclosure. This lack of
uniformity underscores the importance of understanding state-specific probate rights
and dower laws when enforcing these loans.
It is also important not to ignore a probate when it is filed. For example, in Ohio, there are land sales
through probate may be required, while others do not mandate probate
proceedings.
The panel explored how HECM
foreclosures diverge from traditional foreclosure processes. For instance, a
demand letter may not be necessary in every HECM foreclosure, particularly when
the loan has automatically matured. However, property status—whether vacant or
occupied—affects how and when foreclosure proceedings can commence.
Also discussed were standing
challenges, which are treated differently for HECMs compared to conventional
loans. In many states, such as Florida and New York, HECM loans potentially are
non-negotiable, this means the Courts may not be able to rely on the
endorsement to prove standing.
Another legal wrinkle is the
statute of limitations. The panel explained that HECMs often follow a distinct
limitations timeline, particularly when successive foreclosure actions or res
judicata come into play. Practitioners are advised to tread carefully, ensuring
accurate date tracking and analysis of prior enforcement efforts, and to look
at the facts for each case. There is
potential case law stemming from 28 U.S.C. § 2415(c), that may allow the
enforcement of a loan that is passed the statute of limitations.
Rounding out the discussion, the
panel turned its focus to REO asset management—a critical, often overlooked
component of post-foreclosure HECM handling.
Several best practices emerged: - Partner with vendors who understand HECM
timelines and regulatory pitfalls.
- Obtain the most accurate initial valuation to
reduce the risk of appraisal-based claims (commonly referred to as ABCs).
- Use appraisers trained specifically on reverse
mortgage products.
- Ensure quality control reviewers are highly
experienced and trained in HUD protocol.
Choosing REO agents and vendors
who are well-versed in HECM-specific compliance and financial analysis is
important, particularly when weighing Asset-Based Claims (ABC) versus
Servicer-Based Claims (SBC). The goal: maximize investor recovery while
adhering to HUD’s stringent guidelines.
This USFN Briefing reinforced
that HECM loans are not simply conventional loans in reverse—they come with
their own ecosystem of legal, financial, and servicing requirements. From
probate complexities to appraisal practices, the stakes are high for servicers
and legal professionals navigating these waters.
USFN continues to provide vital
educational resources to help the industry meet these challenges. For more on
upcoming briefings, compliance events, and digital tools—including the new USFN Source platform—visit usfnevents.org or explore
the member
directory to connect with experts in this niche space. Copyright © USFN 2025 USFNews_July 23 *Denotes firm is a 2024 USFN Award of Excellence recipient.
Tags:
#Briefing
#HECM
#ReverseMortgages
Permalink
| Comments (0)
|
|
|
Posted By USFN,
Wednesday, April 9, 2025
|
By JaVonne Phillips, Esq.
McCarthy & Holthus, LLP*
USFN Member (AZ, AR, CA, CO, ID, NV, NM, OR, TX, WA)
The real estate industry will soon be hit with yet another
new requirement that, at the moment, will require significant additional work
for handling certain residential property transactions.
As discussed at the USFN Briefing held on March 25, 2025,
regarding the new Financial Crimes Enforcement Network (FinCEN) rule, panelists
from law firms and Auction.com provided insight regarding the key provisions of
this rule.
The new FinCEN rule, which will go into effect on December 1,
2025, is aimed at enhancing transparency by requiring reporting of extensive
information related to the sales of United States residential properties to
domestic and foreign third-party entities or trusts. The goal is to attempt to
prevent these types of transactions from being a haven for money laundering,
terrorist funding, and other illicit activities.
The requisite reporting includes the nature of the funds
provided to purchase the properties. Sales subject to this rule must involve
cash-related considerations such as cashier’s checks and money orders. Financed
real property transactions were excluded from the reporting requirement given the
existing safeguards involved.
The applicable residential properties currently include, but
are not limited to, single-family homes, condominiums, townhomes, and mixed-use
buildings. The rule also applies to vacant or unimproved land upon which the
transferee intends to build up to four residential structures. Determining such intent may be only one of
many possible challenges with attempting to comply with this rule.
The rule requires the gathering of information about the
sellers as well as the individuals associated with buying the property for the
entity or trust. Such information includes names, addresses, and copies of
forms of identification such as driver’s licenses and passports. If multiple
individual buyers are involved, then the ones with a 25% or more interest or
with a substantial ownership interest must be reported. Note that if an entity
purchasing the property is a shell company—100% owned by another entity, then
research must be conducted until there is identification of the actual
beneficial owner for owners for reporting. The time and expense associated with
this task will undoubtedly be significant.
In order to satisfy the reporting requirements a form must be
completed. In its current state it has been estimated that the proposed form
has no less than 111 data fields with up to 70 of those fields involving
information that is not typical of
real estate transactions. The time and expense that will be associated with
gathering the required information may be another concern regarding the rule.
For instance, some of the required information is confidential. Additionally, buyers
or potential buyers may not be willing to provide such information. Further,
issues could arise if the buyers do not cooperate with providing any or all of
the required information.
In any event, the reporting requirements must be satisfied by
the last day of the month of the real estate transaction or 30 days after the
real estate transaction takes place, whichever is later. The collected
information must be securely stored for five years. The ability to timely
gather and/or store the required information may present another challenge to
those required to report.
There are exceptions and exemptions to the reporting
requirements related to legal entity and trust purchasers to whom the FinCEN
rule does not apply. The rule does not apply to low-risk transfers due to
death, divorce, easement transfers, and transfers to a bankruptcy estate. Also,
the rule will likely be inapplicable to judicial foreclosures which have court
oversight. Trusts for estate planning purposes are also not subject to the
rule. Transactions that occur pursuant to section 1031 of the Internal Revenue
Code which regards using funds from a sale to buy another property are also
exempt. At the moment, there are no blanket exceptions for attorneys despite
the attorney-client privilege.
Considering the enhanced responsibilities described thus far,
it may beg the question, “Who is responsible for the required reporting?” Those
handling the closing and settlement services of the applicable real estate
transactions appear to be undisputed primary reporters. However, in the default
servicing world regarding sales pursuant to the non-judicial foreclosure
process, the responsible parties seem to be less clear. In general, it may be
the party responsible for recording the deed. Assessment in this regard will
require a review of the applicable state’s cascade since not all states have
the same process. The importance of communication between the relevant,
involved parties cannot be stressed enough so that the reporting requirement
does not fall through the cracks due to a lack of agreement and understanding
regarding who will conduct the reporting. An option that might be helpful for
those to whom this rule applies is that a reporter may be designated; however,
it must be on a transaction-by-transaction basis. The ability to obtain a
blanket designation is not currently permitted.
It will be important to educate and train relevant staff in
order to ensure compliance with this FinCEN rule. A failure to comply may
result in a $5,000 fine for each day of the violation, up to five years of
imprisonment, and/or additional fines for willful violations or patterns of
negligent activity. As part of an effort to avoid consequences it may be
worthwhile to always exercise good faith, and diligent efforts toward obtaining
the required information in the event that there are obstacles such as a lack
of buyer cooperation. Other challenges with compliance may occur in
jurisdictions where the winning bidder differs from the vesting party;
therefore, compliance to the extent possible might be helpful in avoiding
negative consequences.
This rule is subject to ongoing changes which may provide
hope for less burdensome requirements. For example, days before the USFN
Briefing on this topic FinCEN changed another recently implemented rule
regarding Beneficial Ownership Information (BOI) reporting to create an
exemption for domestic reporting companies and their beneficial owners.
Therefore, a similar change could be enacted with respect to the FinCEN rule
discussed in this article. A change such as this one would provide welcome
relief for the foreclosure realm. Time will tell so this rule should be closely
monitored through its December 1, 2025, effective date. Copyright © USFN 2025 USFNews - April 16, 2025 * Denotes firm is a 2024 USFN Award of Excellence recipient.
Tags:
#Briefing
#FINCEN
Permalink
| Comments (0)
|
|
|
Posted By USFN,
Wednesday, September 25, 2024
|
By Travis Menk, Esq.
Brock & Scott, PLLC *
USFN Member (CT, NC, RI, AL,
FL, GA, KY, ME, MD, MA, MI, NH, NJ, OH, PA, SC, TN, VT,
VA)
During USFN’s Sept. 10 Briefing, New
Loss Mitigation Options and Bankruptcy Impacts, a discussion featuring four
Creditors’ attorneys and a servicer internal legal counsel highlighted the new
last chance waterfall options recently implemented by the VA, FHA, and the USDA,
and each program’s respective impacts on debtors and creditors in bankruptcy. Each
of these programs, while created with the intent to assist borrowers with new
options in light of the high-interest rate environment, opens the door to a
host of potential issues in the realm of bankruptcy. This Briefing gave a basic
educational overview of each of the three programs and detailed the
considerations and impacts on current bankruptcy processes and forms that will
need concentrated attention by debtors, creditors, and trustees alike to
eliminate potential challenges throughout the bankruptcy process.
The Veteran’s Affairs Servicing
Purchase Program – U.S. Department of Veterans Affairs
Marcy J. Ford, Partner at Trott
Law, began the presentation with an overview of the VA’s last chance waterfall
option known as VASP. This program provides for a loan modification
significantly below market interest rate with a 30-to-40-year term option and
may require a three-month trial period. Ford noted that if the debtor is
involved in an active Chapter 13 case, VASP will not be considered while the
case is pending unless the Chapter 13 was filed during a trial period, in which
case court approval is required to finalize the modification. It was noted that
in jurisdictions which do not typically require court approval, this court approval
would likely still be necessary based on the specific VA requirement in this
situation. Ford also noted that if the borrower is in an active Chapter 7 case
and applies for loss mitigation, VASP will not be an option until the case is
closed. However, it was noted that if the debtor files for bankruptcy during
the trial period, VASP finalization goes on hold until the bankruptcy case is closed. Emphasis was placed on the case having to be
closed and that having stay relief or the trustee filing a report of no
distribution would be insufficient. Ford also noted that caution should be
given about advising debtors to dismiss their cases based on the potential to
get VASP eligibility. A question asked
of the panel was how to proceed with VASP as it relates to bankruptcy court
mortgage modification/mediation orders, and it was surmised that these bankruptcy
court modification/mediation programs could not supersede the rules set by the
VA, and, as such, the court would be unable to force VASP as an option during
the case.
The FHA Partial Claim + Payment
Supplement Program – U.S. Federal Housing Administration
Maria Tsagaris, Partner at MRLP,
continued the presentation with an outline of FHA’s last chance waterfall
option known as the FHA Partial Claim + Payment Supplement program. Servicers
must implement this program by January 1, 2025. Tsagaris detailed that borrowers
will be eligible for an amount up to 30% of the outstanding balance of the loan
for a combination of a partial claim to bring the account current with the
remaining available balance divided over 36 months to act as reduction to the
monthly payment amount up to 25% of the payment. The remaining balance after
the partial claim piece is given to the creditor to bring the account current is
to be held by the servicer as a separate custodial account that cannot be
comingled with any other funds. The creditor is permitted to take funds out of
the custodial payment supplement account and apply them to the account when the
debtor pays the creditor the reduced monthly payment amount. The partial claim
plus the payment supplement amounts will become an interest free second lien on
the property pursuant to the recorded security instrument, which will come due
when the first mortgage is paid or refinanced or upon the sale of the property.
Tsagaris mentioned that for the
debtor to be eligible for this program, they had to indicate that they could
maintain the payment and had to sign a note, security instrument, and payment supplement
agreement. In addition to an annual accounting to both HUD and the borrower, 60
to 90 days prior to the end of the 36-month period, the creditor would need to
provide a detailed annual report as to the status of the payment supplement
account. It was also noted that at 36 months and 1 day, the program will
automatically terminate, and any remaining payment supplement funds had to be
refunded to HUD. The program would also terminate in the following scenarios: request
of the borrower, modification, foreclosure, short sale, or deed in lieu.
Tsagaris noted a couple of the mechanics
set forward by the program. The program requires 30-day default reports on each
of these accounts but failure to make an ongoing payment does not terminate the
program. The program also sets forth detailed instructions for the requirements
and responsibilities of servicers regarding the transfers of loans that are
involved in the program. Finally, Tsagaris also noted that servicers will receive
a $1,750 payment supplement incentive for completion of the program. Full
details of the program can be found in Mortgagee
Letter 2024-02.
Alice Whitten, Internal Legal
Counsel for Wells Fargo, when asked, stated that the incentive of $1,750 likely
did not cover the cost to fully implement this program, as it has been
described as one of the most complex programs to implement at the servicer
level. A discussion among the panelists then ensued about whether industry
members were getting too concerned about the impacts of these programs given
that these were last chance waterfall options only available if all other
waterfall options failed. The discussion focused on the fact that if interest
rates remain high, precluding other loss mitigation waterfall options from
being viable, these three programs and their impacts would likely be seen more
often than naught. Given that thought process, the Briefing turned to the
bankruptcy impacts of the FHA Partial Claim + Payment Supplement Program.
Patrick Hruby, Senior Associate at
Brock & Scott, PLLC, highlighted these impacts and many of the best
practices that creditors, creditor’s attorneys, and trustees have been working
together on to facilitate integration of this program into bankruptcy. Hruby presented
a proposed 410A with disclosures regarding the debtor being in the program, the
effects of the program on the ongoing payment, and the expiration date of the
program for the debtor. He also noted suggested revisions to Part 3 of the 410A
of the proof of claim for missed payments and corresponding unreceived monthly
principal reductions. He also suggested revisions to Part 4 to account for the
reduced ongoing payment amount due to the monthly principal reduction. Hruby
also noted that for jurisdictions utilizing GAP Payments or administrative
arrears, the payment supplement portion is going to want to be shown in Part 3.
Hruby also noted that post bankruptcy entrance into the FHA Partial Claim +
Payment Supplement Program would necessitate an amended proof of claim and a
payment change notice. Also, payment change notices will need to be carefully
drafted to note the full payment amount and the amount due from the borrower
due to the payment supplement.
The payment change notice
information issue brought to the forefront that communication needs to be as
clear as possible on all documents in bankruptcy with respect to this program
in order to avoid any unintended consequences and potential inquiries from the
trustees and U.S. Trustees/Bankruptcy Administrators. At the end of the 36-month
payment supplement period or if the program is terminated, it was noted that a
payment change notice will have to be filed to show the elimination of the
monthly payment supplement. On the topic of program termination, it was noted
that if the debtor modifies the loan, the program will be terminated. As a
result, it was noted that creditor’s counsel will need to look closely at the
plan for modifications or cramdowns that would terminate the program and object
appropriately. Consequently, debtor’s attorneys should also be aware if their
debtor client is in one of these programs and to shape the debtor’s plan
accordingly so as not to inadvertently terminate the program. Finally, it was also
noted that the handling of annualized payments in Chapter 12 cases would
present some interesting and unique situations with respect to default
reporting and payment supplement distribution.
Lance Olsen, Partner at McCarthy
Holthus, LLP, continued the discussion of the impacts of this program in
bankruptcy focusing on payoff statements, motions for relief, and consent
orders. As an initial note, Olsen mentioned that relief would, in theory, be
needed to record the second mortgage even though he had not seen a ton of referrals
for relief to record other standard partial claim mortgages, unlike creditor’s
attorneys in other parts of the country. Olsen continued by noting that under
the program, if the creditor is asked for a payoff involving a loan in the
partial claim + payments supplement program, the creditor will have to give a
payoff for both the original loan and the second position lien partial claim +
payment supplement balance. A discussion among the panelists explored whether
these two payoffs should be done in two separate payoff quote letters or
combined into one letter with the two separate payoffs included. In addition, Olsen noted that creditors with motions
for relief and in consent orders need to make sure to be very detailed and
clear with additional disclosures and information in those motions and consent
orders including, but not necessarily limited to, the total amounts owed, the
reduced payment amounts owed, and the payment supplement amounts owed to the
creditor as a result of the debtor failing to make the reduced payments to the
creditor.
The Payment Supplement Account
Program – U.S. Department of Agriculture
Ford finished up the Briefing by
giving details on USDA’s last waterfall option, the USDA Payment Supplement
Account Program. Ford stated that while this program is similar to FHA’s
Partial Claim + Payment Supplement program, the programs differ in that this program
utilizes an advance from the servicer and not a partial claim. As such, a
second lien is not placed on the property and an additional note and mortgage
are not signed. This program became effective July 24, 2024, with a goal to
achieve an ongoing payment reduction of 25% for up to three years and would
require three trial payments. Ford noted that no bankruptcy guidance has been
presented by the USDA and so, as a result, it does not appear that an active
bankruptcy would interfere with the implementation of this program.
The Briefing generated a
significant number of audience questions. One question related to the timing of
the recording of the partial claim. It was noted that the FHA instructions
required the partial claim to be recorded in five days, which the bankruptcy
practitioners noted would be difficult given motion timeframes in bankruptcy
court, and, as a result, the motions may need to be filed as soon as the partial
claim + payment supplement option is offered to attempt to comply with this
requirement. Another question raised was whether any of the participants had
faced any issues with a Trustee in a Chapter 7 bankruptcy saying the partial
claim cannot be executed or recorded by the debtor, as the property is not part
of the bankruptcy estate. Hruby indicated that he had courts in Ohio which have
refused to approve partial claims, as they felt it interfered with the
reaffirmation process, but none of the other panelists indicated they had any
similar issues.
Each of these three programs are
complex, with numerous details and nuances that will present challenges for debtors,
creditors, courts, trustees, and counsels to navigate within the tides and
winds of the bankruptcy process. Each bankruptcy practitioner and creditor should
familiarize themselves with these programs and the impacts on bankruptcy in
order to best insulate themselves from potential problems that could result if
details are not thoroughly thought through.
Watch a recording of this Briefing
and be sure to register for USFN’s next complimentary Briefing – Show Me,
Insurability & The Road Ahead for REO Properties – on Oct. 15 at https://www.usfnevents.org/briefings.html.
Copyright © 2024 USFN USFNews - Oct. 2, 2024 * Denotes firm is a 2023 USFN Award of Excellence recipient
Tags:
#Briefing
#lossmitigation
Permalink
| Comments (0)
|
|
|
Posted By USFN,
Thursday, February 15, 2024
|
By Alexander Craddock and NateBraun
NetDirector
USFN Associate Member
With the latest generation of phishing and social
engineering assisted by the newest AI technologies, information security is
more important than ever for small businesses. According to the Acronis
Cyberthreats Report, H2 2023, AI-enhanced phishing attacks affected
over 90% of organizations surveyed and resulted in a 222% increase in email
attacks in 2023 when compared to the same time period in 2022.
This risk is especially great for any business dealing in
PII (Personally Identifiable Information), financial data, or legal – for the
default servicing industry, this is the triple threat that makes security a
high priority across the organization. One of the best strategies to ensure
data security is data segregation.
The goal is to ensure that only the individuals who are
authorized to view certain data sets have access to them – and that while that
access is secure, it remains easy and convenient for the team members who need
the data to do their job.
It’s easiest to envision a complete data segregation
strategy by visualizing the way a layered, segmented security protocol works on
physical documents. The familiar layers of security are present for most hard
copies of documents in the physical world. An example:
·
a property gateway (potentially with a security
guard) exists, verifying access to the property. ·
the building entrance uses a badge reader or
biometric scan, and a secondary badge entrance would provide further segregated
access to a particular wing. ·
within the wing, even fewer key cards would
grant access to certain hallways or individual rooms. ·
a certain key is required to unlock a particular
cabinet full of sensitive files. In this example, there are up to six layers of security
present between the “outside world” and the sensitive information, each of
which limits access in steps. Could an outside unknown malicious actor get
access to a document in the file cabinet (without the use of “Hollywood
writers”)? The short answer is no. In this scenario, the only people who could
do harm are a very limited number of internal employees, restricted by the many
layers of access and significantly narrowing down potential threats.
What if one of those layers is compromised, like the lock on
the cabinet? Even with one or two less layers of security, the documents
themselves are still secure from outside access. Risk probability decreases
exponentially after each layer of security in place.
An equivalent layered segregation process is the best
approach to ensure a secure environment for digital data. For example:
·
A VPN gateway functions as the property access,
with as many as eight factors of verification in this “frontline” defense: a
username and password, with multifactor authentication (MFA) tokens matching
the PC/Device, IP Address/location, a one-time PIN from Authenticator, mobile
device registration for authenticating devices, and FaceID on the authenticated
device.
·
Firewall/security rules work as the building key
card: after VPN connection is established, the VPN client with an Endpoint
Security Profile can determine what access is allowed based on the user’s
account and group membership; denying or granting specific IP/port access.
·
Application authentication represents key card
access to specific rooms and hallways, and is separately managed in a similar
way to the VPN (factors include Internal WebUIs, File Shares, RDP, SSH, and a
different username/password requiring a new MFA)
·
Finally, the file cabinet lock is represented by
specific application access. After authentication in the previous steps, what
data is available to that authenticated user in the specific application? This
is the final step to ensuring the right data is readily available to users who
need it, and can also determine read/write permissions, modification
availability, etc.
Final questions to consider around data segregation include:
Q: How many layers does our company need?
A: One layer, even with MFA, is no longer enough. Companies
should have at minimum two layers each with their own multifactor
authentication before classified/protected information can be reached.
Q: Which technologies are most important to secure?
A: Endpoint security for physical devices (laptops, phones,
etc.) through which employees can access classified information is most
important. Authentication and file transfers for Unified Messaging technologies
(email, IM, phone, online conference, voicemail) is second most important. Web
based interfaces, applications, and connections would be third on the list.
These are the big three that absolutely need their own layers of
security, including MFA. Copyright © 2024 USFN USFNews - Feb. 21
Tags:
#Briefing
#Cybersecurity
Permalink
| Comments (0)
|
|
|
Posted By USFN,
Thursday, February 15, 2024
|
by Tina Crivello
Brock & Scott, PLLC *
USFN Member (CT, NC, RI, AL, FL, GA, KY, MA, MD, ME, MI, NH, NJ, OH,
PA, SC, TN, VA, VT)
USFN kicked off the new year with a Briefing on one of the
industry’s most timely and critical topics for today and the foreseeable future
– Cyberattacks & How to Respond. On January 23, a panel of industry leaders,
including attorneys, fintech leaders, and insurance experts, provided attendees
key insight into the state of cyberattacks and what we can do now to prevent
and prepare.
Cyberattack prevention as the first line of defense should
be at the forefront of everyone’s efforts. Ronny Loew, ProCirrus Technologies,
Inc., and Jan Duke, a360inc, shared the top elements of a prevention plan which
includes a three-prong approach of user education, using application controls,
and increasing awareness throughout an organization. Loew reminded attendees,
“Eighty-two percent of the issues that are occurring are due to the human
element.” Security training and simple, yet effective, controls such as
multifactor authentication can help prevent many attacks. Just as important is
email security, patching and updating of anything connected to the network or
internet, and cybersecurity services such as endpoint monitoring. Duke
suggested to ensure that phishing training campaigns in organizations are
relevant to users, “so it’s something that really will try to appeal” to
employees. She encourages organizations to have town hall meetings to discuss
the dangers and “make it real” to employees, so they hear it from the top of
how important this is.
Wendy Lee, of Sagent, covered highlights of communication plans
once an incident has unfortunately occurred. She stressed the importance of
pre-planning a crisis communication plan and how the onslaught of communication
will be handled. Most critical is understanding federal law, state breach
notification laws, contractual obligations, as well as executive buy-in and
control. Lee shared a story about a recent settlement related to failure to
disclose timely to victims of a cyberattack and stressed how critical it is to meet
the notification requirements. Federal requirements, such as the Securities and
Exchange Commission’s (SEC) four-day time limit, may not directly impact your
business, but it could impact a company you do business with if they are a
publicly traded company. Customers may require reporting in one day due to the
SEC’s requirement for reporting events “that could have a material
impact.” Evaluating materiality in a 24-hour window may be almost impossible, which
means potentially reporting an incident whether it’s known yet if there is a
material impact. Big companies today are making the required filing regardless
of potential material impact to ensure adherence to the law.
Key points to include in a crisis communication plan
include:
· Understanding who to notify – victims, state Attorneys
General, or other government entities ·
Knowing when to notify the above ·
Adhering to specific requirements about the
notice contents ·
Following any state specific form of requirement
– in writing, electronic, or by phone
Perhaps even before, or at minimum at the same time, as sending
any other notices, Harrison Tropp of SGP Advisors, recommended immediately
notifying your cyber insurance carrier or broker. Carriers have designated
claims hotlines through which you are assigned an adjuster who will begin
assembling the claim team. This may include the insurance adjuster and broker,
a legal expert, a data security firm, and law enforcement. They will help a
company figure out next steps. In cases of ransomware, this will almost always
include immediately paying the ransom so companies can regain access to systems
as expeditiously as possible. Tropp notes it’s critical to have draft
communication ready to go should an event happen. It is also important to have an
action plan in place and test it regularly. He also highlighted how the
underwriting process, “especially in the default space has gotten increasingly
more difficult.” During the underwriting process, insurance companies may run
certain tests on a company’s systems and if they don’t meet the requirements they
will refuse to underwrite.
Brian Nicholas, Esq., McCalla Raymer Leibert, Pierce, LLC, stressed
the importance of running a test of a company’s action plan and key questions
to ask. First response type questions may include, “How do you know if the
attack is real?” and “Who should you contact first?,” among others. Second to
answering those questions is knowing what your cyber insurance policy covers,
how it helps, and how to activate coverage. In today’s online world, Nicholas
recommends having a hard copy of your policy and response plan available to key
members of your organization. Finally, Nicholas posed the question of how we
reduce the risk of Personally Identifiable Information (PII) exposure. “The
biggest risk is loss of that confidential information.” Understanding how
companies keep or expunge that data, especially when considering, for many,
adhering to state bar guidelines.
Nate Braun, of NetDirector, provided pointers on risk
reduction with data segregation and segmentation. Network segmentation, which
is the grouping and isolation of information systems by function and
classification through use of controls, virtual environments, and disk
encryption, are just a few steps an organization can take to protect data. Braun
cleverly compared network security to being akin to physical security and showed
how the multiple check points needed to access a physical file in a cabinet are
analogous to the multifactor authentication steps needed when accessing data on
a network.
The briefing was concluded by moderator Elizabeth DeSilva,
Esq., and Brian Nicholas discussing what it really means to run a “table-top”
drill. Nicholas explained it is just like your disaster recovery drills, where
you run through the steps as if it had been a real event. It’s important to
throw a few “curveballs” into the drill as well. What happens if your CIO is on
vacation? If your email is down, do you have a secondary system or plan in
place to communicate with employees and clients?
USFN is committed to helping the industry combat
cybersecurity issues and will continue to bring members together to learn and
share experiences and expertise surrounding this critical topic. In the meantime, bookmark USFNevents.org and plan to join us for these upcoming virtual programs: - March 12: USFN Briefing: Show Me the Judicial Foreclosure
- May 7: USFNgage: Artificial Intelligence
Copyright © 2024 USFN USFNews - Feb. 21 * Denotes Member is a 2023 USFN Award of Excellence Recipient
Tags:
#Briefing
#Cybersecurity
Permalink
| Comments (0)
|
|