Risk
4/28/2014
09:50 AM
Connect Directly
RSS
E-Mail
50%
50%

SEC Requests Financial Firms' Security Details

SEC asks 50 businesses for copies of their security policies, procedures, and controls in an effort to help the industry bolster cybersecurity protection.

The Securities and Exchange Commission plans to study the information security policies, procedures, and levels of preparedness of businesses in the financial services sector.

In an announcement issued earlier this month, the SEC's Office of Compliance Inspections and Examinations (OCIE) said it would be "conducting examinations of more than 50 registered broker-dealers and registered investment advisers, focusing on areas related to cybersecurity" -- government-speak for anything involving information, computers, and security.

(Image: IBTimes.com)
(Image: IBTimes.com)

The agency's stated rationale for conducting the examinations is to "help identify areas where the Commission and the industry can work together to protect investors and our capital markets from cybersecurity threats." Interestingly, the agency added that "this guidance is not a rule, regulation, or statement of the commission," suggesting that the information would be amassed -- at least initially – only for information-gathering purposes.

What form will those examinations take? While no final version of the exam has been released, the OCIE included in its announcement a 28-question sample cyber security document that poses questions around such areas as risk identification, safeguarding firms' networks, securing remote customer access and fund-transfer requests, working with vendors, and detecting unauthorized activity. The agency said the questions are based in part on the "Framework for Improving Critical Infrastructure Cybersecurity" released by the National Institute of Standards and Technology in February.

[Investments in security startups are taking off. Read Venture Capital: The Lifeblood Behind Security Innovation.]

What's especially notable about the SEC's announcement is that the examination isn't predicated on telling businesses what to do or presenting them with a checklist. Instead, it says that maintaining correct risk-based controls is the responsibility of any individual business, and that those controls will be unique to the business. For now, the SEC wants details about what businesses are doing and why they're doing it.

"The philosophy here... is very rigorous; it's very risk-based, comprehensive, and specific to an organization," said Carl S. Young, managing director and chief security officer at computer investigations, intelligence, and risk management firm Stroz Friedberg, speaking by phone. "I was quite encouraged by this exam and the message it sends in terms of people recognizing that this is not a checklist-oriented problem."

According to Young, the Commission is also showing it now wants more than assurances from financial firms. "They've recognized that there needs to be some kind of scrutiny that goes beyond people saying, 'We're OK,' " he noted.

One of the exam's top questions, for example, is this request: "Please provide a copy of the firm's written information security policy." A business's response to that request will go a long way toward demonstrating if the organization has even basic information security practices in place.

But businesses may also face further inquiries from the SEC. "They caveated pretty hard by saying this is not a safe harbor, and there may be other questions," Young points out.

The SEC's examination announcement comes in the wake of a March roundtable, hosted by the agency, which was designed to investigate what role the SEC should play when handling two issues: ensuring that public companies have robust information security defenses in place, and ensuring the security of the market infrastructure and of any organization that must comply with SEC regulations.

"As an SEC commissioner, I have become particularly concerned about the risks that cyberattacks pose to public companies, and to the capital markets and its critical participants, including the exchanges, clearing agencies, transfer agents, broker-dealers, and investment advisers," said SEC commissioner Luis A. Aguilar at the roundtable. "Cyberattacks aimed at these market participants can have devastating effects on our economy, on individual consumers, and on the markets and investors that the SEC was created to safeguard."

Of course, the new exam isn't the agency's first move to solicit information security particulars from financial firms. In 2011, the SEC began requiring public companies to begin releasing some security-related information. "That guidance makes clear that material information regarding cyber security risks and cyber incidents is required to be disclosed," said SEC chairwoman Mary Jo White at the roundtable.

Agency officials have continued to study how businesses have responded to that requirement. "With regard to the public company discussion, I am particularly interested in hearing whether the current disclosure regime under the 2011 guidance is working or how it could be improved," said Aguilar.

Last year, per Regulation S-ID, the SEC also began requiring some financial services firms and creditors to create identify theft programs and comply with Identity Theft Red Flags Rules.

When it comes to the cybersecurity examination, which 50 businesses might the agency first look at? One likely scenario is that the agency will try to study organizations both large and small from a variety of different financial sectors. "That's my view," says Stroz Friedberg's Young. "If they can categorize them into food groups, then I'd take a hard look at what the results of the exam were, then I'd modify the exam and propagate it outwards."

The results of the SEC's exam may have ramifications far beyond the financial services industry. "This may be a watershed announcement," says Young. "It wouldn't shock me if other agencies followed suit."

NIST's cyber security framework gives critical-infrastructure operators a new tool to assess readiness. But will operators put this voluntary framework to work? Read the Protecting Critical Infrastructure issue of InformationWeek Government today.

Mathew Schwartz is a freelance writer, editor, and photographer, as well the InformationWeek information security reporter. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
4/29/2014 | 3:39:16 PM
Re: NSA
I for one, don't think our federal bureaucracy is capable of that type of coordinated effort..
wbeilstein130
50%
50%
wbeilstein130,
User Rank: Apprentice
4/29/2014 | 12:03:13 PM
NSA
Am I the only one who thinks that this survey is being done to allow the NSA easier access to the 50 companies web sites.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
4/28/2014 | 3:52:41 PM
Re: Focus On The Real Risk
Yes, indeed. The birth of a new market sector. 
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
4/28/2014 | 3:36:06 PM
Re: Focus On The Real Risk
Now they can add this:


3) Hire expensive security consultant to make SEC go away.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
4/28/2014 | 3:23:47 PM
Re: Focus On The Real Risk
I hope the SEC is more knowledgeable about cybersecurity risk than they were in 2008 when our financial industry collapsed. Somehow, I think not.

Please provide a copy of the firm's written information security policy." A business's response to that request will go a long way toward demonstrating if the organization has even basic information security practices in place.

Who at the SEC is going to review the answers to questions like that.

Thomas Claburn
50%
50%
Thomas Claburn,
User Rank: Moderator
4/28/2014 | 3:17:32 PM
Re: Focus On The Real Risk
Sample list sent to the SEC:

1) send out reminder to change default passwords to something other than "password"

2) pray
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
4/28/2014 | 12:50:25 PM
Focus On The Real Risk
The SEC should leave cyber-security to other organizations and agencies and focus on the real risks of financial malfeseance taking down the entire economy again. I'm more worried about that than hackers.
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-0334
Published: 2014-10-31
Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.

CVE-2014-2334
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.

CVE-2014-2335
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.

CVE-2014-2336
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 and FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2334 and CVE-2014-2335.

CVE-2014-3366
Published: 2014-10-31
SQL injection vulnerability in the administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to execute arbitrary SQL commands via a crafted response, aka Bug ID CSCup88089.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.