I. INTRODUCTION
The Federal Financial Institutions Examination Council (FFIEC), has issued a statement to notify financial institutions of the increasing threat of cyber attacks involving destructive malware and to recommend risk mitigation techniques. In some cases, destructive malware used in these attacks successfully compromised large quantities of data and rendered supporting systems inoperable. An institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption, and maintenance of the institution’s operations after a cyber attack involving destructive malware.
II. BACKGROUND
Over the past two years, cyber attacks on businesses have increased in frequency and severity. In some cases, destructive malware used in these attacks successfully compromised large quantities of data and rendered supporting systems inoperable. Malware can be introduced into systems through a variety of mechanisms, including through employees downloading attachments in phishing or spear-phishing emails, connecting external devices (e.g., USB drives), or visiting compromised Web sites, or through unauthorized parties using stolen employee or third-party credentials to install malware directly on systems. Once introduced, destructive malware may be further distributed through compromised enterprise system management technologies.
Historically, business continuity plans have focused on restoring operations after physical events, such as a natural disaster or other geographically centered infrastructure disruptions. In today’s rapidly evolving cyber threat landscape, however, comprehensive resilience depends on the ability to identify and contain damage, recover data, and restore operations from a broader set of scenarios that include cyber attacks involving destructive malware on critical information systems or the institution’s underlying infrastructure. To ensure that critical backup data are not destroyed or corrupted by destructive malware, financial institutions and their technology service providers should ensure that recovery strategies address the potential for simultaneous cyber attacks on backup data centers (e.g., mirrored sites ) or the potential for corrupted data to replicate to backup systems.
III. RISKS
Financial institutions face a variety of risks from cyber attacks involving destructive malware, including liquidity, capital, operational, and reputation risks, due to such events as fraud, data loss, and disruption of customer service.
IV. RISK MITIGATION
Financial institutions should ensure that their risk management processes and business continuity planning address the risk from this type of cyber attack consistent with the risk management guidance contained in the FFIEC IT Examination Handbook, specifically the booklets on “Business Continuity Planning” and “Information Security” and their appendixes, such as Appendix J, Strengthening the Resilience of Outsourced Technology Services.
An institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption, and maintenance of the institution’s operations after a cyber attack involving destructive malware. A financial institution should develop appropriate processes that enable recovery of data and business operations and that address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to this type of cyber attack. This should include the ability to protect offline data backups from destructive malware.
In accordance with regulatory requirements and FFIEC guidance, financial institutions should consider taking the following steps.