The Telework-Ready Bank

By Evan Sparks

As the coronavirus pandemic began to spread across the country, Live Oak Bank did what almost all banks—along with other businesses—did: sent its customers an email.

Like others, the email emphasized the bank’s customer commitment and reminded customers that online banking tools remained fully available. But the notice was a little different than other banks: Live Oak’s offices were fully closed and every single one of its employees was teleworking to support the goal of social distancing.

“Our cloud-based operations allow us to be nimble in the face of pandemics and other stresses,” the email read. “We’ve been through two hurricanes impacting our headquarters, and as we learned then and continue to embrace today, we remain laser-focused on our employees and customers. Our valued employees will work remotely, but they remain committed and available to support you.”

It’s true. Live Oak’s hometown of Wilmington, North Carolina, is close to the beach and regularly in the path of Atlantic hurricanes. With Hurricane Florence in 2018 and Hurricane Dorian in 2019, the bank closed its campus entirely. “When we have some issue, we’re able to do the same [work],” says Brian Lora, Live Oak’s chief technology officer, adding that the bank “just tell[s]people to go where it’s safe.”

The reason for this resilient agility is Live Oak’s cloud-based technology architecture. “Because we’ve been an online bank and in the cloud from the beginning, we basically run our business this way every single day,” says Lora. “It’s good business practice for a business to run, regardless of world conditions.”

Each employee is issued a laptop that they use, in the office or remotely, to connect to the bank’s cloud systems and do their work. (About one in five bank employees work remotely under normal circumstances.) Once the decision was made to close the bank’s offices, there was no hitch in getting “every single one of our employees up and operational” at home, Lora explains.

It can be harder to spool up capacity for remote work with on-premises servers, and banks that operate retail branches still need some level of on-site staffing. But there are things banks can do now to facilitate a more aggressive work-from-home posture, Lora says, including expanded internet capabilities and signing up for videoconferencing and chat tools. And amid the rapid rush to telework nationwide, companies’ IT distributors are reporting six-week delays in shipping laptops, says Omar Refaqat, a senior manager at Crowe, meaning that many bank employees use a personal laptop or PC to do their work.

But unlike a hurricane—which is often predicted several days in advance but which may require a complete shutdown of a physical location—the pandemic may allow banks a little time to make the transition to telework. Since many bankers are defined as essential critical infrastructure workers, they can continue to go to offices while practicing appropriate social distancing. This window can buy IT staff and executives time to boost work-from-home capacity. For example, Summit Technology Group is offering ABA member banks complimentary cloud desktops and business continuity resources for six months. The recipient of a direct investment from ABA, Summit is a firm that helps community banks transition to the cloud.

“With the evolving coronavirus threat, banks of all sizes need to be prepared for anything, including the possibility their employees may be forced to work remotely,” says Summit CEO Ben Wallace. “Through our existing cloud partnerships, we are coming together to offer these remote access services so banks can continue to do their part to support the economy at this difficult moment.”

One major consideration for the rapid telework transition is maintaining a secure IT environment, especially in an environment where many employees are using personal devices. The change in environment from office to home “causes people to change their behaviors,” says Crowe principal Troy La Huis, which “creates an opportunity for threat actors.” Crowe experts note that social engineering hacks—in particular, phishing attacks that tap into people’s massive appetite for COVID-19 news and information—and brute-force attacks are some of the top threat vectors.

Other considerations for banks transitioning to telework, notes Lora: ensure multi-factor authentication is in place for system access and require VPN or other secure access portals for applications that access or house sensitive customer data. And Crowe principal Dave McKnight urges banks to consider several novel security issues, including “Zoombombing” (when threat actors attempt to gain access to videoconferences), the risk of digital assistants like the Amazon Echo and Google Home overhearing and recording virtual meetings and the question of how employees who print documents at home dispose of printouts that include sensitive information.

All told, an all-telework environment is a big change, even for a bank like Live Oak that was fully telework-ready. The company “likes to do business face-to-face,” Lora says. Bank leaders go out of their way to ensure that the firm’s collaborative culture perseveres through the pandemic. “We try to increase touchpoints just to simulate the hallway conversation.”