The Federal Reserve Board, aka the Fed, published its annual “Cybersecurity and Financial System Resilience” report earlier this month. Not surprisingly, ransomware attacks, nation-state incursions and third-party access topped the list of potential IT security threats to the U.S. financial industry.
With an eye to keeping the country’s financial industry as stable as possible, the Fed report looks at the potential influences that could rock the monetary boat. And, naturally, cybersecurity is perhaps the No. 1 concern when it comes to outside threats to the financial system. Aside from its own internal and regulatory efforts, the Fed oversees various compliance, staffing, training and deployment developments among the financial firms it regulates.
Among the most advanced persistent threats facing the financial sector, the Fed report cited ransomware as a key issue, especially as bad actors increasingly automate it to be a service.
“Like traditional ransomware, ransomware as a service (RaaS) is an increasing concern with added sophistication, speed of proliferation, and difficulty of attribution,” according to the report. “RaaS allows threat actors to create 'franchised' threat offerings. Sophisticated threat actors license the use of their software to other malicious actors, often for a percentage of the ransom.”
Distributed denial-of-service (DDoS) attacks were also pointed up as a growing issue for the U.S. banking industry, according to the Fed report.
“DDoS attempts against the U.S. financial services sector have been prevalent for years,” the report said, “but mitigation and protection services are typically able to prevent, or greatly reduce, the risk to financial institutions, third parties, and other organizations.”
Ongoing violence in the Ukraine will also impact the U.S. financial industry’s cyber-stability, as will the potential access of the many third parties that banks and other financial institutions’ use.
“Geopolitical events, such as the Russian invasion of Ukraine, have led to the potential for increase in cyberattacks that may impact critical infrastructure including the financial services sector,” the Fed report said.
“The ability of threat actors to breach software providers and subsequently use the breached provider’s software to compromise the provider’s client firms highlights the risks stemming from interdependency often associated with third-party vendor management and automated software updates being applied,” according to the Fed report. “As third-party software, and software-as-a-service, in particular, becomes increasingly common in banking, these risks are multiplied.”
As the nation’s most respected and important regulator, the Fed carries a heavy burden when it comes to ensuring financial firms’ stability. (The Fed chairperson is often seen as a role almost as important or equally important to the U.S. president, due to the control over the monetary system.)
Hence, the Fed has been more proactive in pursuing relationships with other U.S. financial regulators when it comes to maintaining cybersecurity. Indeed, for the country’s eight largest and “global systemically important banks,” the Fed has been working more closely with the Office of the Comptroller of the Currency (OCC) and the FDIC to “conduct and coordinate” cyber reviews.
Among other things, the Fed recommended better “staffing, training and resources for bank examiners,” according to the recent report. The report outlined the Fed’s over-arching moves to establish practices and procedures around establishing good cybersecurity hygiene for the financial institutions, it oversees, and laid out a list of recent Fed and interagency “actions” throughout 2021.
“The Board recognizes the increasing and evolving nature of cybersecurity threats to the financial system,” according to the report. “Additionally, the Board and the [regional] Reserve Banks secure their internal information and information assets through robust cybersecurity risk-management programs.”
