I. INTRODUCTION
The Federal Financial Institutions Examination Council (FFIEC), has issued a statement to notify financial institutions of the growing trend of cyber attacks for the purpose of obtaining online credentials for theft, fraud, or business disruption and to recommend risk mitigation techniques. These attacks include theft of users’ credentials—such as passwords, user names, and e-mail addresses—and other forms of identification that customers, employees, and third parties use to authenticate themselves to systems. Attacks also include theft of system credentials, such as certificates. Financial institutions should address this threat by reviewing their risk management and controls over information technology networks and authentication, authorization, fraud detection, and response management systems and processes.
II. BACKGROUND
Recent reports indicate an ongoing and increasing trend of attacks by cyber criminals to obtain large volumes of credentials. These attacks include theft of users’ credentials—such as passwords, usernames, e-mail addresses—and other forms of identification used by customers, employees, and third parties to authenticate themselves to systems as well as theft of system credentials, such as certificates. User credentials can be stolen in many ways, including phishing and spear-phishing, malvertising, watering holes, and web-based attacks. Stolen credentials are often sold in cyber-criminal forums and then used to commit fraud through account takeovers and identity theft. Users may significantly increase exposure by creating usernames and passwords that are easy to guess or using the same usernames and passwords to access accounts on multiple Web sites.
The theft of each type of user credential presents distinct risks. Stolen customer credentials may give an attacker access to customers’ account information to commit fraud and identity theft. Stolen employee and third-party credentials may provide initial access to trusted internal systems that may be used to leverage system administrator level access to obtain confidential business and customer information, modify and disrupt information systems, and destroy or corrupt data. System credentials may be targeted directly through vulnerabilities in authentication systems (e.g., OpenSSL “Heartbleed”) or indirectly by compromising the credentials of trusted third parties (e.g., fraudulent certificates). Stolen system credentials may also be used to gain access to internal systems and data to further distribute malware or impersonate the financial institution to facilitate fraud such as accessing payment processing systems for automated clearing house transactions.
III. RISKS
Compromised credentials may expose financial institutions to a range of risks that include loss of the confidentiality and integrity of sensitive data, such as customer information and confidential business information. Further, compromised credentials enable cyber attackers to disrupt and degrade systems or process fraudulent financial transactions that may not be recovered by the institutions.
IV. RISK MITIGATION
Financial institutions should design multiple layers of security controls to establish several lines of defense and ensure that their risk management processes also address the risk posed by compromised credentials, consistent with the risk management guidance contained in the FFIEC IT Examination Handbook, specifically the “Information Security,” “Outsourcing Technology Services,” and the “Retail Payment Systems” booklets.
To mitigate the potential risks to customer information, financial institutions must follow the standards outlined in the Interagency Guidelines Establishing Information Security Standards and the related Guidance and Supplement on Authentication in an Internet Banking Environment.
The guidance requires, among other things, security measures to reliably authenticate customers accessing their financial institutions’ Internet-based services. In accordance with regulatory requirements and FFIEC guidance, a financial institution should consider taking the following steps.