Dynamic Network Solutions will be at the Maryland Land Title Association Fall Convention in Dewey Beach, Delaware, October 4 to 6. Our Chief Operations Officer, Sam Chawkat, is presenting one of the convention’s ethics sessions.
Vendor Trust is an Ethical Decision Not Just Flashy Technology
9:15 to 10:15 am, in the Ballroom
1 hour of Maryland Title (Ethics) CE and 1 hour of Delaware Ethics CLE
We are honored to be on the program.
Why a technology decision is an ethics decision
A title company holds what its clients can least afford to lose: the money in escrow and the personal information that comes with every file. That includes bank details, Social Security numbers, closing figures and the date of each wire transfer.
Every technology vendor you bring in can reach some of it: your email provider, the company that manages your computers, the software that runs your closings, and any support technician who can sign in to fix a problem.
Your duty to the client does not pass to the vendor when you sign the contract. If a vendor’s account is used to reach a client’s file, the client still trusted you. That makes choosing a vendor an ethics question.
What a product demo does not show you
A demo shows features. What protects your clients is how the vendor behaves once it has access to your systems.
The questions that matter are about the vendor.
Who at the vendor can reach your systems, and how do they sign in? Shared logins, and vendor accounts without multifactor authentication, are how an attacker signs in as the vendor.
What do they record, and for how long? If something goes wrong, those records are how you find out what was reached. A vendor that keeps 30 days of logs cannot tell you about an intrusion that started two months ago.
What do they do when something goes wrong, and how quickly do they tell you? You may have your own obligation to notify clients, with a deadline that starts when you find out.
What happens to their access when the relationship ends? A former vendor’s account that still works is a common way in, because nobody is watching it.
Why title companies in particular
Real estate closings are one of the most targeted transactions for wire fraud. An attacker who can read a title company’s email can see when a closing is scheduled, who is sending money and how much, and can send fake wiring instructions timed to the closing.
Often the way in is an account belonging to someone the company trusts, such as a vendor.
Where this connects to what we do
This is the work we do every day for organizations that hold sensitive information: managing the computers, the email and the accounts, and controlling who can reach them, vendors included.
That means IT management that keeps a current list of who can sign in and removes access the day someone leaves, and email and identity security that makes a stolen password far less useful on its own.
It also means being the kind of vendor this session is about. We expect to be asked these questions. Ask them of us.
Come and find us
If you are at the convention, come to the session or stop by and say hello. If you want help working through these questions for your own firm, get in touch.