Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

US government now requires banks to fight DDoS attacks

Ground breaking new regulation for US banks

Article comments

Banks and financial institutions regulated by the federal government must now monitor for distributed denial-of-service (DDoS) attacks against their networks and have a plan in place to try and mitigate against such attacks, a federal regulatory body said last week.

In what is ground-breaking regulation for bank security, the Federal Financial Institutions Examination Council (FFIEC) issued a notice defining six steps it wanted banks and other financial institutions to follow, including first setting up a program to assess risk to IT systems, then monitoring Internet traffic to the institution's website to detect attacks, and being prepared to activate incident response plans with ISPs.

The FFIEC is an inter-agency body empowered to set standards on behalf of its members, which include the Board of Governors of the Federal Reserve, the Federal Deposit Insurance Corp., the National Credit Union Administration, the Office of the Comptroller of the Currency, and the Consumer Financial Protection Board. These are the primary regulators of finance, and as such the FFIEC's dictum about DDoS compels the banking industry to confront the DDoS problem.

"This is the first shot from the U.S. government to the private sector that says you have been put on notice to defend against these cyberattacks," says Rodney Joffe, senior vice president and senior technologist at Neustar, which provides anti-DDoS protection services.

The FFIEC anti-DDoS requirement comes in the wake of a series of massive DDoS attacks against the websites of U.S. banks in late 2012 that left several of them unable to provide banking services online for a number of days.

"In the latter half of 2012, an increased number of DDoS attacks were launched against financial institutions by politically motivated groups," the FFIEC statement says. "These DDoS attacks continued periodically and increased in sophistication and intensity. These attacks caused slow website response times, intermittently prevented customers from accessing institutions' public websites, and adversely affected back-office operations."

The FFIEC also notes that sometimes DDoS attacks will serve as "a diversionary tactic" by criminals in the course of attempting to commit fraud of various kinds.

The FFIEC doesn't dictate specific technologies, but it makes it clear that financial institutions have to monitor for attacks, have a response plan and "ensure sufficient staffing for the duration of the DDoS attack and consider hiring pre-contracted third-party servicers, as appropriate, that can assist in managing the Internet-related traffic flow." In addition, banks are expected to "identify how the institution's ISP can assist in responding to and mitigating an attack."The FFIEC also wants banks and others to share attack details with the Financial Services Information Sharing and Analysis Center and law enforcement.

The FFIEC statement points to a number of references, such as the "DDoS Quick Guide" from the Department of Homeland Security and publications from the National Institute of Standards and Technology

Ellen Messmer is senior editor at Network World, an IDG website, where she covers news and technology trends related to information security. Twitter: MessmerE. E-mail: emessmer@nww.com



Share:

More from Techworld

More relevant IT news

Comments



Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *