Financial Services Sector Faces Cyber Threats

The financial services sector faces cyber threats similar to those faced by  other critical infrastructure sectors, but the potential for monetary gains  and economic disruptions may increase its attractiveness as a target. As discussed in the previous section of this report,  such threats include attacks from individuals and groups with malicious  intent, such as crime, terrorism, and foreign intelligence. Industry Groups in the Financial Services Sector Have Taken Steps to Improve Information Sharing and Address Threats to Its Infrastructure

Financial services industry groups have taken several steps to address  cyber threats and improve information sharing, and they plan to take  continuing action to further address these issues. First, industry  representatives collaboratively developed a sector strategy—National  Strategy for Critical Infrastructure Assurance—that discusses additional  efforts necessary to identify, assess, and respond to sectorwide threats. Third, several other industry groups  representing the various segments of the financial services sector are  taking steps to better coordinate industry efforts and to improve  information security across the sector. Treasury also chairs the Financial and  Banking Information Infrastructure Committee of the President’s Critical  Infrastructure Protection Board. In both of its roles,  Treasury has taken steps designed to establish better relationships and  methods of communication between regulators, assess vulnerabilities  (as  discussed earlier in this report), and improve communication within the  financial services sector. Finally, as previously mentioned, the President’s Special Advisor for  Cyberspace Security chairs the Critical Infrastructure Protection Board  and works closely with the federal government and the private sector to  coordinate protection of the nation’s critical infrastructure information  systems, including those in the financial services industry. Federal entities have taken a number of steps to coordinate federal  government and private-sector efforts and to assist the financial services  sector in its CIP effort, but Treasury has not undertaken a comprehensive  assessment, as called for in federal CIP policy, of the potential use of public  policy tools to encourage increased sector participation. Finally, federal regulators have taken several steps to  address information security issues, including consideration of information  security risks in determining the scope of their examinations of financial  institutions and development of guidance for examining information  security and for protecting against cyber threats. Objectives, Scope, and Methodology

Our objectives were to identify the (1) general nature of the cyber threats  faced by the financial services industry; (2) steps the financial services  industry has taken to share information on and to address threats,  vulnerabilities, and incidents; (3) relationship between government and  private sector efforts to protect the financial services industry’s critical  infrastructures; and (4) actions financial regulators have taken to address  these cyber threats.
Why GAO Did This Study

Since 1998, the federal government has taken steps to protect the nation's critical infrastructures, including developing partnerships between the public and private sectors. These cyber and physical public and private infrastructures, which include the financial services sector, are essential to national security, economic security, and/or public health and safety. GAO was asked to review (1) the general nature of the cyber threats faced by the financial services industry; (2) steps the financial services industry has taken to share information on and to address threats, vulnerabilities, and incidents; (3) the relationship between government and private sector efforts to protect the financial services industry's critical infrastructures; and (4) actions financial regulators have taken to address these cyber threats.

What GAO Found

The types of cyber threats that the financial services industry faces are similar to those faced by other critical infrastructure sectors: attacks from individuals and groups with malicious intent, such as crime, terrorism, and foreign intelligence. However, the potential for monetary gains and economic disruptions may increase its attractiveness as a target. Financial services industry groups have taken steps and plan to take continuing action to address cyber threats and improve information sharing. First, industry representatives, under the sponsorship of the U.S. Department of the Treasury, collaboratively developed a sector strategy which discusses additional efforts necessary to identify, assess, and respond to sector-wide threats. However, the financial services sector has not developed detailed plans for implementing its strategy. Second, the private sector's Financial Services Information Sharing and Analysis Center was formed to facilitate sharing of cyber-related information. Third, several other industry groups are taking steps to better coordinate industry efforts and to improve information security across the sector. Several federal entities play critical roles in partnering with the private sector to protect the financial services industry's critical infrastructures. For example, the Department of the Treasury is the sector liaison for coordinating public and private efforts and chairs the federal Financial and Banking Information Infrastructure Committee, which coordinates regulatory efforts. As part of its efforts, Treasury has taken steps designed to establish better relationships and methods of communication between regulators, assess vulnerabilities, and improve communications within the financial services sector. In its role as sector liaison, Treasury has not undertaken a comprehensive assessment of the potential use of public policy tools by the federal government to encourage increased participation by the private sector. The table below shows the key public and private organizations involved in critical infrastructure protection. Federal regulators, such as the Federal Reserve System and the Securities and Exchange Commission, have taken several steps to address information security issues. These include consideration of information security risks in determining the scope of their examinations of financial institutions and development of guidance for examining information security and for protecting against cyber threats.