Banking and Finance Sector-Specific Plan - U.S. Department of ...

members are very active. One of the subsets or measurable outcomes can be particular to the financial sector, but the modeling
needs to take into account the interdependence of all sectors.
D The financial sector has adopted practices from the retail sector and is, through BITS, establishing a database of offenders
to be used to protect financial institutions from undue harm. Commonalities in the use of such information across sectors
would benefit the implementation of practices and standards and could lead to acceptable use criteria for such information.
This could lead to a possible profiling tool that could be used as a model across all industries.
E Critical infrastructure protection decision support and analysis systems are not unique to the financial sector, but inter-sector
and intra-sector dependence needs to be analyzed in order for the financial sector to make use of them. The financial
sector would make a good starting point for such research as the sector firmly grasps success criteria and measurable outcomes.
These criteria can be particular to the financial sector, while the modeling takes into account the interdependence
of all sectors.
F Financial services regulators commonly have been vague with respect to recovery standards (e.g., “no single event can
impact your ability to do business.”) No central source for practices and standards takes into account uptime requirements,
data transmission limitations, and the limitations of the Nation’s critical infrastructure. As the financial sector has business
continuity planning (BCP) requirements that span dependence on other sectors, it is logical that research into standards
that meet those requirements be done within the sector. The benefits then can be drawn by other industries that may not
have as much of a regulatory mandate but still could benefit from standards for calculating the present value of BCP and
recovery efforts.
G Emerging threats are by definition unknown, but as vulnerabilities become known, threats commonly are enacted first
against the financial sector. It is imminently important for institutions in the financial sector to be able to find out quickly
about threats, to assess their possible impact, and to react. Research into standards for making best use of centrally identified
emerging threats would be invaluable to the financial sector and a model that could be carried easily to other industries.
H The financial sector has long been the main driver for security features in vendor products aimed at advanced infrastructure
architecture. Research, development, implementation, and creation of guidelines for any advanced infrastructure
within the financial sector would make best use of the embedded knowledge base in financial services while promoting
secure, self-healing, interoperable, and redundant systems that then could be used in all industries that utilize the Internet.
I Human and social issues can affect all industries. But not all industries are considered critical to how we function as a
society. Human and social issues need to be factored into the continuity plans of critical areas such as the financial sector.
For example, the impact of mass absenteeism due to a pandemic can affect our financial fabric and could be examined,
modeled, promulgated, and factored into all continuity planning.
J Establishing data transmission interoperability standards for the financial sector would enable banking and clearing operations
to continue seamlessly. This would aid in enhancing public confidence in our financial sector and would be reusable
for other industries.
K The establishment of standards and protocols based on new and best practices for identification and authentication would
help all industries that engage in transactions that involve two or more parties. The financial sector is an especially rich
area for this research due to the large volume of transactions and their susceptibility to fraud.
L The financial services sector is wholly committed to the establishment of CI/KR protection consensus standards, and interand
intra-dependence of the financial sector with other sectors should be considered.
M The NIPP detection and sensor systems may be considered to include cyber surveillance. Although the use of Intrusion
Detection Systems (IDS) and Intrusion Prevention Systems (IPS) in the financial sector is commonplace, there is no com-
Appendix : FSSCC Research and Development Agenda