U.S. Banking Regulator Directs Banks to Bolster Cybersecurity Efforts in Wake of Recent Denial of Service Attacks

The alert directs banks to “have a heightened sense of awareness” and to “employ appropriate resources to identify and mitigate” the risk posed by DDoS attacks, including by having appropriate personnel and external partners involved in incident response and by conducting due diligence reviews of third-party service providers (e.g., Internet service providers).  Additionally, the alert calls on banks to share information with other banks, third-party service providers, and the government, and to be prepared to communicate with their customers in a “timely and accurate” manner in the event of an attack.  The alert also states that the OCC expects banks to report DDoS attacks to law enforcement authorities and their supervisory office and to file a Suspicious Activity Report if the attack affects either critical information – such as customer account information – or critical systems.

Authored by Harriet Pearson, and Steve Spagnolo.