OFR_2016_Financial-Stability-Report

2.3 Cybersecurity Incidents Affecting Financial
Firms
Financial institutions, like other businesses, are under constant threat
of malicious cyber activity. They are especially vulnerable because of
their reliance on information technology (IT) and their many links to
each other, to financial markets, and to other parts of the economy.
Malicious cyber activity that targets financial firms has become more
common and more sophisticated. Incidents can disrupt services,
reduce confidence in firms and markets, and damage the integrity of
key data.
Malicious cyber activity
that targets financial
firms has become more
common and more
sophisticated. Incidents
can disrupt services,
reduce confidence in
firms and markets, and
damage the integrity of
key data.
The OFR ranked vulnerability to malicious cyber activity as a top threat
with substantial potential impact. Quantifying the magnitude of these risks
or measuring the resilience of institutions is difficult. Still, cybersecurity
incidents clearly have the potential to cause real harm. Some financial institutions
play unique roles. If their IT systems were compromised, that could
disrupt payment systems or markets and trigger a cascade of operational and
financial losses.
Financial firms already fight off malicious cyber activity on many fronts
(see White House, 2013). They may spend heavily to defend themselves.
Regulators have also taken steps to increase cyber-resilience. They have
encouraged information-sharing and collaboration and issued guidance and
rules for financial firms. U.S. regulators could also consider developing a
shared risk-based approach to guide financial firms in their IT security practices.
Although firms are primarily responsible for the security of their systems,
regulators should provide guidance and oversight and work to ensure
that the financial system can recover quickly.
Cybersecurity Incidents Come in a Variety of Forms
Cyberattacks are deliberate efforts to disrupt, steal, alter, or destroy data on
IT systems. Tactics include finding hidden weaknesses in widely used software
(called zero-day vulnerabilities) to get into IT systems, targeting e-mail
accounts to steal passwords (spear-phishing), targeting websites to infect
users with malicious software (malware), and implanting software that
locks companies out of their own IT systems (ransomware). The growth
in Internet links provides more ways for attackers to enter proprietary IT
systems and networks.
Detailed data about frequency, tactics, and results of cybersecurity incidents
are scarce. In part, data are lacking because firms and authorities avoid
reporting them due to reputation concerns or concerns over giving insights
to potential hackers (see OFR, 2015; U.S. Congress, 2016). Cybersecurity
38 2016 | OFR Financial Stability Report