Credit Suisse Financial Services Forum Terry Dolan Vice Chairman and Chief Financial Officer Jason Witty EVP, Chief Information Security Officer February 7, 2017 Exhibit 99.1
We’re Constantly Investing in Many Areas New products Customer- facing Back office Compliance Customer- facing Innovation Risk management Research Facilities Technology Training
Risk Management at U.S. Bancorp The “what” Risk and governance start at the top Investments in people, processes and technology Infrastructure largely in place and reflected in our run rates The “how” The Risk Management Committee of the Board of Directors approves and oversees the risk management framework and risk appetite statement Implementation of a collaborative “Three Lines of Defense” system of checks and balances; experienced risk management team, including integrated risk officers in each business line Continue to enhance “Know Your Customer” and Anti-Money Laundering program to address consent order
Operational Risk Management We’ve established an effective program for operational risk Third party risk management Cybersecurity and information technology New and modified products and services Innovation activities Monitoring and verification activities throughout all phases of the lifecycle Independent risk management coverage; second line of defense over critical operations Comprehensive independent risk assessments Customized independent risk evaluations Payment systems Business continuity and crisis management programs Complaint management Ethics Oversight End-to-end coverage by independent risk management Preparedness at all levels of the organization Timely response to customer and regulator concerns Ensuring we do the right thing
Cybersecurity is Key to Risk Management We must keep in mind… Size of the “opportunity” Frequency of attacks Successes to date embolden the “bad guys” Number of exposed points is exploding Cyber risk is not about a couple of guys in their basement A few striking statistics From 2013 to 2016 22,143 companies fell victim to a “business email compromise” $3 billion was the combined exposed dollar loss In 1Q16 “Crypto-ransomware” netted criminals $209 million in 1Q16 alone $1 billion was the FBI’s FY 2016 estimate By 2020 50 billion devices will be connected to the internet Online data volume will increase 50x Sources: https://www.ic3.gov/media/2016/160614.aspx https://www.wsj.com/articles/in-the-bitcoin-era-ransomware-attacks-surge-1471616632 http://blogs.microsoft.com/microsoftsecure/2016/01/27/the-emerging-era-of-cyber-defense-and-cybercrime/
Internet Velocities are Mind-blowing Netflix: 23,148 hours of video watched.1 YouTube: 138,889 hours of video watched.5 Google: 4.1 million searches.9 Facebook: 3.3 million pieces of content shared.2 Ads: 10 million ads displayed.3 Pinterest: 57,870 page views.10 Twitter: 347,222 tweets.6 Instagram: 38,194 photos uploaded.7 Pandora: 31,773 hours of music played.11 Amazon: $133,436 in sales.4 Apps: 194,064 app downloads.8 IM: 34.7 million instant messages (MIM) sent.12 Source: What Happens in an Internet Minute?, 2014. 1Netflix U.S. & Canada Blog, Jan. 13, 2014; 2”A Focus on Efficiency”, a whitepaper from Facebook, Ericsson and Qualcomm, p. 6, Sept. 2013; 3”2013 U.S. Digital Future in Focus Whitepaper”, Feb. 14, 2013; 4Amazon Quarterly Income Statement, Year Ending Sept. 30, 2013; 5YouTube Press Statistics, Feb. 2014; 6Twitter IPO – SEC Report; 7Instagram Press Site, Feb. 2013; 8”Gartner Says Mobile App Stores Will See Annual Downloads Reach 102 Billion in 2013”, Gartner, Sept. 2013; 9Google Official History, Comscore, Jan. 1, 2014; 10”The CMO’s Guide to Pinterest”, Crossing, Inc., p. 3, Nov. 2013; 11Pandora Monthly Audience Metrics Press Releases, Jan. 2013-Dec. 2013; 12”Technology, Media & Telecommunications Predictions 2014”, Deloitte Touche Tohmatsu Limited, 2014. Every 60 seconds there are…
When We Went to the Moon in the 60’s… Source: https://en.m.wikipedia.org/wiki/Apollo_Guidance_Computer Apollo Guidance Computer: 2MHz processor 4kB RAM 75kB storage Weight: 70 lbs IBM System/360 Model 75: 6 MB (6,000 kB) program Memory was small, computers were big
Today’s Apple iPhone Device is small, but capacity is big Apple iPhone: 2.23 GHz (2,230 MHz) A10 CPU/RAM/GPU 256 GB (256 million kB) storage That’s roughly 42,139 times more capacity than it took to put humans on the moon! Source: https://en.wikipedia.org/wiki/IPhone
The Cybersecurity Industry is Booming 7- 8% CAGR Spending on Information Security worldwide in 2015… Source: http://www.gartner.com/newsroom/id/2828722
The Cost of Cybercrime is Unprecedented Spending on Information Security worldwide in 2015… Source: Spending: http://www.gartner.com/newsroom/id/2828722 Cost: http://www.mcafee.com/us/resources/reports/rp-economic-impact-cybercrime2.pdf Organized criminals are exceptionally well-funded; the cost of cybercrime in 2014 reached $575 billion!
A Typical Organized Crime Business Model Security: Configuring your System Foundations of Carding: Terminology, Explanation of Payment Systems Drops and Intermediaries, Customs and Delivery of Goods Working in the U.S., Canada and England Working in Europe, Asia, and the Rest of the World Enrolled Cards: Shipping Methods & Addresses E-Gift Cards The Tourist Sector: Hotel/Travel Booking PayPal Intercepting and Picking Up Packages Brute-forced Accounts Authorization Forms and Account Confirmation Via Telephone Android Devices How to Socially Engineer a Retailer Offshore QA teams “Crypto-ransomware” HR recruiting and staff management teams Big Data analytics 24x7 criminal call centers Strikingly similar to a corporation’s business model
Cyber Strategies Must Be Intelligence-driven Customers Place trust in us and demand that we are careful stewards of their data and transactions Business lines Require agility and fast time to market in order to meet business goals and customer demand Cyber threats Require us to have mature prevention, detection and recovery controls to keep pace Regulators Expect that we provide evidence of a strong information security program Shareholders Require that we protect revenue to enable growth Employees Strive for excellence and are interested in how and where they work
Cyber Strategies Must Also Be Comprehensive Data and information: is secure both at rest and in transit Networks: are monitored 24x7 Devices: are secure and patched regularly to remain protected over time Applications: are secure in both development and production Identity and access: is appropriate based on job role Third parties and vendors: control parity is risk-based and protections are appropriate …across nine information security ecosystem components Industry and partnerships: provide actionable, cost-effective threat and risk intelligence Customers and clients: are educated on cyber risks and their role protecting their devices Employees: first line of defense, key to success Anticipate emerging threats and risks Enable business growth while protecting existing revenue Safeguard U.S. Bank information and assets We must…
Improving Intelligence Staying a step ahead with machine speed data analytics Cyber Defense Fusion Center ~550 information security staff in 34 cities throughout six countries 24x7 detection, monitoring, response teams 1.3 petabytes of information security data $10 billion in money movement reviewed per day Significant investment over the last several years 3.8 billion security events reviewed per day
Building a “Future-proof” Defense Protecting against threats (fraudsters and hackers) and managing through new breakthroughs (disruptive technologies and real-time payments) Offering machine-speed data, using external intelligence, and taking advantage of machine-learning, analytics and artificial intelligence Creating a holistic view of customers and fraud, while enabling real-time decisioning Intelligence, analytics and data keep us on the cutting edge
Here, Now and Coming Soon “Arguably the single most forward-thinking major financial institution in the United States today,” 2016 #3 for Innovation “Arguably built the industry’s deepest innovation department,” 2015 Innovation Award – Photo Bill Pay, 2014 Mobile Voice Biometrics Mobile Fingerprint Authentication Mobile customer money movement “light switches” Online customer authentication preference panel End of the password: facial recognition, pattern matching, fingerprint Real-time rewards redemption Fingerprint and voice authentication Pay with your phone Android Pay Samsung Pay Apple Pay Innovative, frictionless, customer-centric controls First bank to use mobile to open accounts MSA Pay 2014-2016 2016 2017+
Award-winning Industry Thought Leadership Risk-based, frictionless, customer-centric controls * U.S. Bank is the only bank to rank in the top five for all 12 years since Ponemon’s first privacy trust study was conducted in 2004, and has been number one for the past 10 years Multichannel customer authentication Secure options Frictionless Customer-selected Patent for customer malware detection President’s Advisory Board Named “Most Trusted Company for Retail Banking” by privacy and information security research firm, Ponemon Institute* Information Security Executive North American Project of the Year Award for Data Tokenization