DS News - Digital Archives

» VISIT US ONLINE @ DSNEWS.COM COVER STORY MARKET PULSE MARKET PULSE T here is an old proverb that says a chain is only as strong as the weakest link. This is true in the mortgage servicing industry when managing data security. Mortgage servicers, at the top of the chain, have systems and policies in place to protect private and confidential information at the highest levels. In turn, servicers share certain information with their field service partners—the next link in the chain—when property preservation services are required to inspect and maintain vacant and defaulted properties. Those companies then provide access to data as required to other links in the chain—employees, inspectors, and contractors who monitor and perform services at those properties. Every link in the chain must be equally strong in understanding and adhering to policies and procedures to protect the security and integrity of confidential information. Ongoing data security training is critical to ensure that every person who has access to sensitive information complies on a day-to-day basis with all applicable guidelines and requirements. Those include the unique requirements of mortgage companies and their field service partners, as well as industry and regulatory guidelines of agencies such as the Consumer Financial Protection Bureau (CFPB), Fannie Mae, Freddie Mac, HUD, and the U.S. Department of Veterans Affairs (VA). The challenge in protecting data through an entire chain of participants is that it becomes more difficult to ensure the confidentiality of data down each successive link. Small business contractors, for example, may not have the technical resources of a large mortgage servicer or national field service company but still must make sure the data they access is protected with the same vigilance. To ensure compliance, field services companies must not only educate their inspector and contractor networks on best practices for physical and information security, but they must also routinely monitor and audit them to ensure compliance. Data asset management is a critical component of information security. Every company needs to understand the data it has collected, its classification, and how and where it is stored. Knowing the nature of this data is important for protection, and anyone who has access to confidential data should take appropriate measures to protect it. Protecting Access and Passwords Inspectors and contractors performing work at properties are granted limited access to field service and client systems that contain confidential information that they need to complete their work. All user names and passwords, as well as data housed on systems, must be kept confidential. This also applies to the inspectors' and contractors' own systems and accounts. IDs and passwords should not be shared or displayed in a public place. As field servicing companies develop mobile applications to better service the needs of their INSIDE THE BELTWAY A layered approach maintains the integrity and strength of information security in the mortgage servicing industry. clients, it becomes more important for inspectors and contractors to ensure their systems are secure. People use computers and smartphones in almost every aspect of modern life. These devices, while they grant access to a variety of services and information, also can become coveted honeypots of information. If exploited, these devices can be susceptible to identity theft. Inspector and contractor networks need to create complex passwords for all devices used in the office and in the field including computers, laptops, tablets, and smartphones. It also is important to change those passwords on a frequent basis to prevent attacks that may compromise accounts. Anti-Virus and Firewall Programs Most people understand the importance of anti-virus programs, especially those who have experienced the complications of a virus that has infected their computers or systems. Firewalls, while not as widely used, are just as important. These programs, when installed correctly, can help to prevent hackers from gaining access to systems, computers, files, and confidential data. They need to be renewed frequently with the latest virus definitions and firewall updates. While keeping anti-virus software up-todate, it is important to patch the operating system and programs, as well. There are new vulnerabilities that are discovered frequently within these programs and systems that may allow unwanted intruders to gain access to confidential data. The companies that create this 55

• Cover