Cyber-attacks on small- to medium-sized financial institutions are on the rise. The FFIEC expects financial institutions to take steps to address this threat by reviewing the adequacy of their controls over information technology networks, card issuer authorization systems, ATM usage parameters, and fraud detection processes. In addition, the members expect financial institutions to have effective response programs to manage cyber attacks.
The members also expect financial institutions to address DDoS readiness as part of their ongoing information security and incident plans. More specifically, each institution is expected to monitor incoming traffic to its public website, activate incident response plans if it suspects that a DDoS attack is occurring, and ensure sufficient staffing for the duration of the attack, including the use of pre-contracted third-party servicers, if appropriate.
Cyber-attacks on Financial Institutions’ ATM and Card Authorization Systems (PDF)
Distributed Denial-of-Service (DDoS) Cyber-Attacks, Risk Mitigation, and Additional Resources