WASHINGTON—The Federal Financial Institutions Examination Council, which includes NCUA, has released two statements about ways that financial institutions can identify and mitigate cyber-attacks that compromise user credentials or use destructive software, known as malware.
In addition, the FFIEC provided information on what institutions can do to prepare for and respond to these threats.
“Cyber-attacks have increased in frequency and severity over the past two years,” the FFIEC said in a released statement. “The attacks often involve the theft of credentials used by customers, employees, and third parties to authenticate themselves when accessing business applications and systems. Cyber-criminals can use stolen credentials to commit fraud or identity theft, modify and disrupt information systems, and obtain, destroy, or corrupt data. Also, cyber-criminals often introduce malware to business systems through e-mail attachments, connecting infected external devices, such as USB drives, to computers or networks, or by introducing the malware directly onto the business systems using compromised credentials.”
The FFIEC is releasing guidance that calls for FIs to:
- Securely configure systems and services.
- Review, update, and test incident response and business continuity plans.
- Conduct ongoing information security risk assessments.
- Perform security monitoring, prevention, and risk mitigation.
- Protect against unauthorized access.
- Implement and test controls around critical systems regularly.
- Enhance information security awareness and training programs.
- Participate in industry information-sharing forums.