This paper presents a set of security policy recommendations for McBride Financial Services, a financial institution seeking to expand its loan processing operations amid growing market competition. The paper addresses four critical security areas: general information security, security controls, personnel training, and process improvements. It identifies key threats to customer data — including unauthorized access, improper disposal, and third-party risks — and recommends corresponding safeguards such as firewalls, encryption, access controls, shredding protocols, and staff training. Regulatory compliance with the Sarbanes-Oxley Act, the Gramm-Leach-Bliley Act, and HIPAA is also discussed. The paper concludes by advocating for digitization and automation of loan processes to improve both security and operational efficiency.
McBride Financial Services has experienced increased consumer interest in its innovative and economical loan offerings and terms. With rising competition in the market, McBride is now aggressively working to boost market share through a renewed focus on customer service and simple, speedy loan processing (Fluss, 2009). While many automated processes in the financial sector can be convenient for customers, they can also present unique and significant information security risks for companies (Compton, 2004). The following policies are aimed at covering certain critical security areas for the loan department at McBride Financial Services.
Sensitive information can be defined as a customer's full name, address, phone number, credit information, social security number, date of birth, mother's maiden name, employment and salary information, username/password combinations, or PIN IDs (Bilich, 2000). All such information should be stored securely in order to help ensure confidentiality and to thwart misuse, fraud, theft, and customer privacy violations.
All computer networks should receive a comprehensive review for reasonably foreseeable threats. These may include both internal and external threats such as unauthorized disclosure; misappropriation or alteration of customer information or accounts; improper disposal of sensitive information; unauthorized access to systems; risks associated with third-party vendors or service providers; and improper destruction of outdated electronic data and storage systems (Garratt & Keister, 2009).
Technical firewalls should be implemented, with consideration given to the many ways in which data systems can potentially be accessed from outside the institution (Compton, 2004). Proper risk assessments should be conducted to strengthen potential areas of weakness posed by Internet connectivity. Both automated and manual processes should undergo a thorough and routine security audit to identify areas of vulnerability (Garratt & Keister, 2009).
Information security controls should be instituted to address any risks exposed during assessment (Ferreira & Andrade, 2011). Loan processing is primarily a back-office operation. At a fundamental level, back offices repetitively process large volumes of transactions. These processes can range from simple steps — such as posting payments — to complex, multi-step, multi-touch processes that span lengthy timeframes, such as complex mortgages (Fan et al., 2010). The individuals involved in loan processing are many, including data entry clerks, loan agents, loan processors, accounts payable processors, closing agents, and loan officers.
Access controls that include passwords and classification levels should be implemented to allow only authorized individuals to view customer information and file management databases (Menconi & Desmond, 2000). In addition, access history should be recorded to allow the organization to monitor an employee's retrieving, downloading, and sharing of sensitive records and other forms of data. Encryption for data in transit over networks will help safeguard sensitive information. All computer systems should feature anti-virus, Trojan detection, and other comparable safety measures to immediately quarantine and delete intrusive software or other attacks upon the computer network (Ferreira & Andrade, 2011).
Paper records — including loan applications, credit reports, and customer employment records — should be properly discarded by shredding (Britt, 2005). Similarly, obsolete and sensitive computer-based records should undergo proper media disposal and erasure processes. Access to physical locations where sensitive information is housed (i.e., files, vaults, or storage areas) should also be restricted and monitored through a key card system.
"Staff education on fraud, compliance, and data handling"
"Digitization and automation to enhance security efficiency"
"Cited academic and industry sources"
Always verify citation format against your institution’s current style guide requirements.