The Federal Reserve’s Cybersecurity Analytics Support Team is responsible for monitoring cybersecurity threats that could affect financial institutions. What happens when news of an attack breaks?
As appeared in the Cleveland Fed Digest's Ask the Expert on 02.26.2019
There are a lot of things that happen. My team works to understand the impact of the attack: Is it impacting banks? Is it impacting a prevalent technology that many banks use? Who is the attack impacting, and how might the attack spread?
We then rate the attack using the nation’s cybersecurity rating scale, which we tailored to the financial industry. It’s 1 through 5—1 being baseline and 5 being emergency. Five is a pretty hard threshold to reach because it involves the likelihood of catastrophic damage to critical operations resulting in, for example, a potential collapse of the banking sector. Most attacks fall between 1 and 3. We routinely perform ongoing monitoring of the attack, adjusting our assessment and rating as we learn more through our analysis, discussions with experts, and technical details reported through other sources. We might initially rate an attack high because we need more information and then adjust its rating down later when more information is known.
Here’s a recent example: One Saturday, I read that ransomware was hitting systems and picking up speed in the UK, impacting the National Health Service. Our Cybersecurity Analytics Support Team called a teleconference to discuss what was being impacted (nothing in the United States). The event ended up being an unpatched Windows vulnerability that affected several hundred thousand computers across the world. Our team knew that, generally speaking, financial institutions are up to date on patching—or running changes to update, fix, or improve a computer program. Still, we worked Saturday, Sunday, and Monday to monitor the situation, assess our ratings, and communicate what was going on.
Depending on the rating we assign to an attack, the team coordinates with a group at the Board of Governors [of the Federal Reserve System] to determine who needs to discuss the potential impact. We also will bring in the Federal Deposit Insurance Corporation and the Office of the Comptroller of the Currency, as appropriate.
Every day, we’re looking at potential threats. Our goal is to understand threat actors and their capabilities, active campaigns, and overall intent in order to assess the potential impact on the financial sector.
Check out more
Chad Siegrist is a banking supervisor who manages the Federal Reserve’s Cybersecurity Analytics Support Team, which supports financial institutions by monitoring and analyzing the cyberthreats they face.
You’re here today.
Don’t miss what we produce next. Subscribe.
Cleveland Fed Digest delivers Cleveland Fed work right to your inbox once a month. Read, download, and explore just some of what the Cleveland Fed offers the public, from economic research and special reports on housing, banking, and labor markets to community development analyses and graphics that examine issues and illustrate trends. Of course, you can also check out all of our published work anytime right here on clevelandfed.org. If you’re not yet a subscriber to Cleveland Fed Digest, share your email address with us to receive the e-newsletter each month. We welcome your feedback, too! Contact firstname.lastname@example.org with questions or comments.
Rest assured, we do not sell or share your email address, and you may unsubscribe at any time.