Alloy Labs reposted this
In his latest Fintech Takes, Alex Johnson called Evolve Bank and Trust's lax standards "a feature not a bug." Immediately some chimed in with convincing arguments such as "no it wasn't" (without evidence) while others, responding to the hack with "it could happen to anyone." To be fair, it is unlikely many institutions can withstand a sustained assault from a quasi-nation state actor. HOWEVER, this is why best practices such as Encryption at Rest and intrusion detection are critical for anyone storing PII and providing access to the nation's banking infrastructure. A cybersecurity expert told me the the stance should be WHEN, not IF, and that Evolves response time is a clear indicator they were not prepared. Now let's address the elephant in the room. It was not a closely held secret in the industry that Evolve was running fast and loose. You don't need to be an industry insider to or expert to question how a bank of that size can add so many channel partners at that pace without hiccups. As I've said before, it is a quadratic scale of complexity. Our Alloy Labs members that play in BaaS started a Center of Excellence three years ago in anticipation that the industry would need to be better at self policing and standard setting. Some of it, like our nomenclature guide and Roles & Responsibilities which we developed with Unit, Treasury Prime, Lithic, Currencycloud, we've made public (see links below). Others are availble only to members or happen behind closed doors with our next session in Chicago the end of the month. If you are a BaaS bank interested in doing it right, consider joining us. https://lnkd.in/gHpqcX9h
Ishu Bansal
1mo
How can the industry better prepare for potential cyber attacks and ensure that best practices are followed? Is self-policing and standard setting enough or do we need stricter regulations?
Great read. Transparency and robust internal controls are key to maintaining stability and trust.
Interesting take on fintech security! It's a reminder of the importance of staying ahead in such a critical industry.
For those looking for our standards around Roles & Responsibilities, you can find those here: https://www.linkedin.com/posts/jasonhenrichs_defining-roles-responsibilities-in-baas-activity-6989284057624834048-eZVK/