New York State Cyber Security Regulations for Financial Institutions Could Be Model for Other States

The first phase of the New York state cyber security regulations, which apply to insurance companies, banks, and other financial institutions operating within the state, went into effect on March 1.

While the insurance and finance industries are already highly regulated, New York’s legislation is the first at the state level to mandate specific cyber security requirements. While there is some overlap with existing regulations and standards, the requirements under New York’s law are very specific. However, there’s nothing Earth-shattering about the requirements; they consist of common-sense, proactive cyber security practices that all organizations should already be adhering to. Because of this, and the international reach of the finance and insurance organizations it applies to, it is expected to be a model for other states.

Requirements of the New York State Cyber Security Regulations

The new law is 14 pages long and contains 23 sections; you can download a PDF copy of it here. Among other things, organizations must:

• Design and implement a cyber security program based on a comprehensive risk assessment. Among other requirements, the program must address the organization’s plan to detect and respond to “Cybersecurity Events,” “recover from Cybersecurity Events and restore normal operations and services,” and “fulfill applicable regulatory reporting obligations.” The cyber security program must also establish secure development procedures for applications developed in-house.
• Implement and maintain a written cyber security policy. The policy must be based on the risk assessment and include “policies and procedures for the protection of [the organization’s] Information Systems and Nonpublic Information stored on those Information Systems.”
• Design and maintain a written cyber security incident response plan.
• Provide all employees with ongoing cyber security awareness training.
• Designate a Chief Information Security Officer (CISO). The organization may hire its own CISO or use a third-party service provider to fulfill this function.
• Perform penetration testing, vulnerability assessments, and periodic risk assessments.
• Maintain audit trails.
• Establish appropriate system user access privileges.
• Employ “qualified cybersecurity personnel” to perform cyber security-related functions. Third-party personnel may be substituted for in-house employees. Importantly, the law requires that these personnel be provided with ongoing training so that they stay current in their field.
• Establish a separate cyber security policy for third-party service providers.
• Utilize multi-factor authentication and data encryption.

The law also contains reporting, notification, and confidentiality requirements, as well as certain exemptions for organizations with fewer than 10 employees, less than $5 million in gross annual revenues, and less than $10 million in assets.

Skills Gap Could Make Compliance Challenging

Most banks, other financial organizations, and insurance agencies in the state of New York have six months from March 1 to implement the first phase of the law, including the cyber security policy, employee training program, and incident response program. Despite the law’s exemptions for smaller firms, many finance and insurance organizations are worried about their ability to comply with the new law. There is a significant cyber security skills gap, which has already driven salaries through the stratosphere – assuming an organization can even find qualified talent to begin with. Now that multinational Wall Street finance companies are expected to begin aggressively recruiting security analysts and engineers, the talent pool will shrink even further, and labor costs will rise even higher.

The new law is quite complex, and the penalties for non-compliance are very high. Now more than ever, firms affected by the New York law need to (1) Make use of RegTech software such as Continuum GRC’s IT Audit Machine (ITAM) to automate their governance, risk, and compliance functions and (2) Outsource their cyber security to a qualified third-party provider such as Lazarus Alliance.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will ensure that your organization is complying with the new requirements under New York’s cyber security law, and protect you from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to the New York state cyber security regulations, maintain compliance, and secure your systems.

Latest FINRA Examination Findings Reveal That Firms Have Made Progress with Cyber Security, but Problems Remain

Cyber security remains “one of the principal operational risks facing broker-dealers,” according to the FINRA 2017 Examination Findings Report, and while progress has been made, many broker-dealer firms still have work to do to protect themselves against hackers.

Firms More Aware of Cyber Security Risks

FINRA noted a significant uptick in firms’ awareness of cyber security risks, noting a substantial increase in “attention to cybersecurity challenges over the past two years, including at the executive management level.” Most of the firms FINRA examined had already established or were in the process of establishing risk management programs to address security issues. FINRA noted that firms with the most effective cyber security programs tended to have:

• Strong, risk-based governance structures and processes
• Conducted regular risk assessments and followed up to address areas of concern
• Conducted regular vulnerability and penetration tests
• Conducted regular employee cyber security training
• Conducted comprehensive cyber security reviews of any branch offices

But Better Risk Management & Data Governance Needed

FINRA noted that the quality of firms’ cyber risk management programs varied widely, not only from firm to firm but also within the same organization. By far, the biggest security vulnerability was firms’ own people; the most common threats observed in 2016 and 2017 were all rooted in social engineering: phishing and spearphishing schemes, ransomware (which usually begins with a phishing email), and fraudulent third-party wires (again, usually involving phishing schemes).

The agency highlighted a number of frequent problem areas:

• Access Management – Some firms didn’t adhere to basic procedures such as terminating system access for former employees and monitoring systems for anomalies, such as logins from unusual locations or privileged users granting themselves additional, unwarranted system privileges.
• Risk Assessments – Despite the importance of regular risk assessments, some firms still aren’t doing them; even worse, the firms “could not effectively identify their critical assets and the potential risks to those assets.”
• Vendor Management – Third-party vendor hacks are a serious problem, but some broker-dealers are still not properly vetting their business associates’ cyber security preparedness or sufficiently documenting vendors’ responsibilities in service level agreements.
• Branch Offices – Branch offices tended to have less robust cyber security than home offices; FINRA noted problems with password management, software updates, removable storage device security, data encryption, and reporting incidents.
• Segregation of Duties – Some small and medium-sized firms are not properly segregating responsibilities for cyber security rules and systems changes; for example, at some firms, network engineers are performing cyber security functions without any supervision from cyber security experts.
• Data Loss Prevention – Many firms need stronger DLP protocols, such as applying the same rules that currently protect clients’ Social Security Numbers to other sensitive data, such as account numbers.

Since cyber attacks represent such a serious threat to the U.S. and global financial systems, both FINRA and the SEC, NFA have indicated that cyber security will be of high priority throughout 2018. Firms that run afoul of SEC, NFA and FINRA standards – or, worse yet, suffer a breach – can face millions of dollars in fines. The good news is that a data-centric, integrated risk management approach to cyber security will head off all of the problem areas FINRA discusses in its report.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.

SEC, NFA cyber security enforcement is set to intensify in light of recent global attacks and new enforcement chiefs

Public companies and firms operating in regulated industries, especially finance, should expect more SEC, NFA cyber security enforcement in the wake of new and emerging threats, like WannaCry and NotPetya, as well as the appointment of two new cyber-minded enforcement chiefs. Reuters reports:

On Thursday, the U.S. Securities and Exchange Commission named Stephanie Avakian and Steven Peikin as new co-directors of enforcement.

In an exclusive interview ahead of the formal announcement, the two said they were deeply concerned about cyber threats and see the topic as a major enforcement priority.

“The greatest threat to our markets right now is the cyber threat,” said Peikin, who was still wearing a guest badge because he has not yet received his formal SEC, NFA credentials yet. “That crosses not just this building, but all over the country.”

The SEC, NFA has started to see an “uptick” in the number of investigations involving cyber crime, as well as an increase in reports of brokerage account intrusions, Avakian said. As a result, the agency has started gathering statistics about cyber crimes to spot broader market-wide issues.

This follows on the heels of a risk bulletin the SEC, NFA released in response to the WannaCry attacks, urging broker-dealers, investment advisers, and investment companies “to assess industry practices and legal, regulatory, and compliance issues associated with cybersecurity preparedness.” The bulletin directed readers to a website established by the Financial Industry Regulatory Authority (FINRA), a self-regulatory organization overseen by the SEC, that provides numerous cyber security tips and resources.

Cyber Security Problems Uncovered During Regulatory Exams

Also contributing to the new SEC, NFA cyber security focus are widespread security lapses the SEC, NFA found during recent regulatory exams at financial companies, including:

• Unauthorized disclosures of personally identifiable information (PII).
• Issues with phishing emails; employees were found to click on suspicious attachments more than 20% of the time.
• Third-party wires not being properly authenticated.
• Organizations not conducting periodic risk assessments, penetration tests, and vulnerability scans.

Penalties for non-compliance with SEC, NFA cyber security standards can be severe. Last June, the agency fined Morgan Stanley Smith Barney LLC $1 million for failing to sufficiently secure its systems to prevent a breach; sanctioned Craig Scott Capital LLC for $100,000 for using non-firm email addresses to receive faxes; and made R.T. Jones Capital Equities Management Inc. pay $75,000 for “failing to implement proper cyber policies” after the firm was breached.

Financial firms aren’t the only ones on the SEC’s radar. Law360 reports that the SEC, NFA is investigating Yahoo for its numerous data breaches.

Sound GRC Practices Will Keep Your Organization on the SEC’s Good Side

A panel held at the recent 2017 FINRA Annual Conference discussed five best practices organizations should adopt to prevent cyber attacks and maintain compliance with both FINRA and SEC, NFA cyber security standards: governance, risk assessment, cyber security training, access management, and vendor management.

Some organizations, especially small and medium-sized businesses, struggle with the cost and time commitment that proactive cyber security and GRC require. To slash the time and money companies must devote to cyber security, Lazarus Alliance utilizes the Continuum GRC IT Audit Machine (ITAM), a proprietary RegTech software package with user-friendly self-help modules, including modules for the FINRA SEC, NFA Cyber Security Report Card and the FINRA Small Firm Cybersecurity Checklist. ITAM saves money, simplifies the compliance process, eliminates audit anarchy, and speeds up the GRC assessment and reporting processes by 180%.

The cost of cyber attacks and non-compliance penalties are much higher than preventing attacks and maintaining compliance in the first place.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.