Cyber Attacks On Banks Prompt New Regulatory Safeguards
Janet Yellen, Chair of the Board of Governors of the US Federal Reserve System.
US regulators plan to require banks to adopt baseline safeguards to shield themselves from cyber-threats after a series of assaults cost the industry billions of dollars and shook consumer confidence, said people with knowledge of the matter.
The Federal Reserve is leading other agencies in crafting the protections, which would be minimum standards, said the people who asked not to be named because work on the measures isn’t public. The effort stems partly from a concern that as digital breaches become more frequent and aggressive, an attack could cripple the entire financial system.
The Fed is working with the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corp., said the people. Further details on the agencies’ plans couldn’t be determined, so it’s not clear whether costly efforts that lenders have already undertaken would put them in compliance with what regulators propose.
The industry has been stunned by recent computer muggings, including a February hack of Bangladesh’s central bank in which thieves made off with $81 million and the 2014 incursion of JPMorgan Chase & Co. that led to information on millions of customers being compromised. The attacks have spurred financial firms to try to fend off attacks by hiring thousands of employees to monitor threats and upgrading their technology.
The agencies’ first step would be to solicit public input on ideas for boosting banks’ defenses, which regulators would study before following up with a more formal proposal. The multistage rule process could stretch into next year.
In recent years, banking regulators’ public responses to hacks have mostly consisted of issuing guidance and industry alerts. But the escalating attacks have put pressure on them to do more, and a formal rule could give the government a greater ability to crack down on lenders it thinks aren’t doing enough to protect themselves. While the agencies years ago established information-security standards for banks, those measures were issued well before the modern threats emerged.
In JPMorgan’s 2015 annual report, Chief Operating Officer Matt Zames described the bank’s thousands of employees working from three global security-operations centers to protect the firm. He noted that every month they find more than 200 million malicious e-mails -- each the potential foothold for an attack on the bank.
‘Unconstrained Budget’
Bank of America Corp. finds it “very tough to keep ahead of those who would do us harm” even with the lender committing an “unconstrained budget” to securing information, Cathy Bessant, who runs operations and technology at the bank, said in an April interview with Bloomberg Television.
The danger of “potentially catastrophic” malware assaults was flagged recently by the panel of US regulators formed to deal with emerging risks to the financial system, the Financial Stability Oversight Council.
Recently, the group called on financial regulators to set up a “common risk-based approach” for figuring out whether firms can block digital invaders, and that agencies remove hurdles that deter companies from talking to each other, the government and the public about how hackers are coming after them.
Last year, Congress passed legislation that lets companies share real-time data on hacking threats without opening themselves up to customer lawsuits.
The Fed itself got roped into this year’s audacious theft of millions of dollars from Bangladesh Bank, as the thieves reportedly transferred funds from that central bank’s account at the New York Federal Reserve after breaching the widely used messaging system run by the Society for Worldwide Interbank Financial Telecommunication, better known as Swift.
Top Issue
Swift connects members who are crucial to the global financial system, including central and commercial banks, money managers and Wall Street securities firms. The Bangladesh attack and other similar ones that have occurred recently relied on false messages routing money to the thieves’ accounts in what Swift has called a “wider and highly adaptive campaign targeting banks.”
While banking regulators are preparing new standards to address threats, the Commodity Futures Trading Commission has already proposed a cybersecurity measure requiring mandatory testing of safeguards at derivatives firms. CFTC Chairman Timothy Massad has said the agency’s work should be finished this year, adding that the risk posed by hackers is “the most important single issue we face in terms of financial market stability and integrity.”
