The Federal Reserve’s Cybersecurity Analytics Support Team is responsible for monitoring cybersecurity threats that could affect financial institutions. What happens when news of an attack breaks?

There are a lot of things that happen. My team works to understand the impact of the attack: Is it impacting banks? Is it impacting a prevalent technology that many banks use? Who is the attack impacting, and how might the attack spread?

We then rate the attack using the nation’s cybersecurity rating scale, which we tailored to the financial industry. It’s 1 through 5—1 being baseline and 5 being emergency. Five is a pretty hard threshold to reach because it involves the likelihood of catastrophic damage to critical operations resulting in, for example, a potential collapse of the banking sector. Most attacks fall between 1 and 3. We routinely perform ongoing monitoring of the attack, adjusting our assessment and rating as we learn more through our analysis, discussions with experts, and technical details reported through other sources. We might initially rate an attack high because we need more information and then adjust its rating down later when more information is known.

Here’s a recent example: One Saturday, I read that ransomware was hitting systems and picking up speed in the UK, impacting the National Health Service. Our Cybersecurity Analytics Support Team called a teleconference to discuss what was being impacted (nothing in the United States). The event ended up being an unpatched Windows vulnerability that affected several hundred thousand computers across the world. Our team knew that, generally speaking, financial institutions are up to date on patching—or running changes to update, fix, or improve a computer program. Still, we worked Saturday, Sunday, and Monday to monitor the situation, assess our ratings, and communicate what was going on.

Depending on the rating we assign to an attack, the team coordinates with a group at the Board of Governors [of the Federal Reserve System] to determine who needs to discuss the potential impact. We also will bring in the Federal Deposit Insurance Corporation and the Office of the Comptroller of the Currency, as appropriate.

Every day, we’re looking at potential threats. Our goal is to understand threat actors and their capabilities, active campaigns, and overall intent in order to assess the potential impact on the financial sector.