Security Priorities for Banks Gartner's Chuvakin on Mobile, Cloud, Hacktivist Attacks By Tracy Kitten, May 18, 2012. Credit Eligible From mobile and the cloud to DDoS attacks and risks surrounding big data, what should banks and credit unions do now to mitigate exposure? Gartner's Anton Chuvakin offers his top recommendations. Chuvakin, who joined Gartner in 2011, says because most banking institutions have spent far too much time focusing on compliance instead of security, many have missed opportunities to exploit the full potential of the fraud-detection and prevention technologies in which they've investing. "Compliance is meant to drive security, not replace it," Chuvakin says. "Compliance is a motivator, not the end goal." What does Chuvakin recommend? That banking institutions invest in technologies that offer more transactional visibility. Banks and credit unions need systems that can raise red flags when suspicious activity occurs. But for anomalous-behavior detection to be effective, institutions must have adequate data collection, data analysis and skilled people who can filter through all of it. "Having data that flows into the technologies and then having people smart enough to analyze the data is the key," he says. " want to see more people focus on technology and skills in visibility." But it's easy for banking institutions to get ahead of themselves, Chuvakin warns, by trying to master more data than they can handle. "In 90 percent of (breach) cases, the evidence of the intrusion was in the logs or other monitoring technologies," he says. "To me, this means we're not doing enough to get this visibility to collect data ... or nobody is looking at the data." During this interview, Chuvakin discusses: •The dangers of moving too much data to the cloud, and how some organizations may get too comfortable with public cloud environments; •Why the industry must pay more attention to denial of service attacks; •Four steps every banking institution should take now to ensure security. Before Chuvakin joined Gartner, his job responsibilities included security product management, evangelist, research, competitive analysis, PCI-DSS compliance, and SIEM development and implementation. He is the author of "Security Warrior" and "PCI Compliance," and was a contributor to "Know Your Enemy II," "Information Security Management Handbook" and others. He has published dozens of papers on log management, SIEM, correlation, security data analysis, PCI-DSS, and security management. His blog, "Security Warrior," has grown to become one of the most popular in the industry. Chuvakin also has taught classes and presented at security conferences across the world; he recently addressed audiences in the U.S., the U.K., Singapore, Spain, Russia and other countries. He has worked on emerging security standards and served on advisory boards of several security startup companies.