Risk
4/28/2014
09:50 AM
Connect Directly
RSS
E-Mail
50%
50%

SEC Requests Financial Firms' Security Details

SEC asks 50 businesses for copies of their security policies, procedures, and controls in an effort to help the industry bolster cybersecurity protection.

The Securities and Exchange Commission plans to study the information security policies, procedures, and levels of preparedness of businesses in the financial services sector.

In an announcement issued earlier this month, the SEC's Office of Compliance Inspections and Examinations (OCIE) said it would be "conducting examinations of more than 50 registered broker-dealers and registered investment advisers, focusing on areas related to cybersecurity" -- government-speak for anything involving information, computers, and security.

(Image: IBTimes.com)
(Image: IBTimes.com)

The agency's stated rationale for conducting the examinations is to "help identify areas where the Commission and the industry can work together to protect investors and our capital markets from cybersecurity threats." Interestingly, the agency added that "this guidance is not a rule, regulation, or statement of the commission," suggesting that the information would be amassed -- at least initially – only for information-gathering purposes.

What form will those examinations take? While no final version of the exam has been released, the OCIE included in its announcement a 28-question sample cyber security document that poses questions around such areas as risk identification, safeguarding firms' networks, securing remote customer access and fund-transfer requests, working with vendors, and detecting unauthorized activity. The agency said the questions are based in part on the "Framework for Improving Critical Infrastructure Cybersecurity" released by the National Institute of Standards and Technology in February.

[Investments in security startups are taking off. Read Venture Capital: The Lifeblood Behind Security Innovation.]

What's especially notable about the SEC's announcement is that the examination isn't predicated on telling businesses what to do or presenting them with a checklist. Instead, it says that maintaining correct risk-based controls is the responsibility of any individual business, and that those controls will be unique to the business. For now, the SEC wants details about what businesses are doing and why they're doing it.

"The philosophy here... is very rigorous; it's very risk-based, comprehensive, and specific to an organization," said Carl S. Young, managing director and chief security officer at computer investigations, intelligence, and risk management firm Stroz Friedberg, speaking by phone. "I was quite encouraged by this exam and the message it sends in terms of people recognizing that this is not a checklist-oriented problem."

According to Young, the Commission is also showing it now wants more than assurances from financial firms. "They've recognized that there needs to be some kind of scrutiny that goes beyond people saying, 'We're OK,' " he noted.

One of the exam's top questions, for example, is this request: "Please provide a copy of the firm's written information security policy." A business's response to that request will go a long way toward demonstrating if the organization has even basic information security practices in place.

But businesses may also face further inquiries from the SEC. "They caveated pretty hard by saying this is not a safe harbor, and there may be other questions," Young points out.

The SEC's examination announcement comes in the wake of a March roundtable, hosted by the agency, which was designed to investigate what role the SEC should play when handling two issues: ensuring that public companies have robust information security defenses in place, and ensuring the security of the market infrastructure and of any organization that must comply with SEC regulations.

"As an SEC commissioner, I have become particularly concerned about the risks that cyberattacks pose to public companies, and to the capital markets and its critical participants, including the exchanges, clearing agencies, transfer agents, broker-dealers, and investment advisers," said SEC commissioner Luis A. Aguilar at the roundtable. "Cyberattacks aimed at these market participants can have devastating effects on our economy, on individual consumers, and on the markets and investors that the SEC was created to safeguard."

Of course, the new exam isn't the agency's first move to solicit information security particulars from financial firms. In 2011, the SEC began requiring public companies to begin releasing some security-related information. "That guidance makes clear that material information regarding cyber security risks and cyber incidents is required to be disclosed," said SEC chairwoman Mary Jo White at the roundtable.

Agency officials have continued to study how businesses have responded to that requirement. "With regard to the public company discussion, I am particularly interested in hearing whether the current disclosure regime under the 2011 guidance is working or how it could be improved," said Aguilar.

Last year, per Regulation S-ID, the SEC also began requiring some financial services firms and creditors to create identify theft programs and comply with Identity Theft Red Flags Rules.

When it comes to the cybersecurity examination, which 50 businesses might the agency first look at? One likely scenario is that the agency will try to study organizations both large and small from a variety of different financial sectors. "That's my view," says Stroz Friedberg's Young. "If they can categorize them into food groups, then I'd take a hard look at what the results of the exam were, then I'd modify the exam and propagate it outwards."

The results of the SEC's exam may have ramifications far beyond the financial services industry. "This may be a watershed announcement," says Young. "It wouldn't shock me if other agencies followed suit."

NIST's cyber security framework gives critical-infrastructure operators a new tool to assess readiness. But will operators put this voluntary framework to work? Read the Protecting Critical Infrastructure issue of InformationWeek Government today.

Mathew Schwartz is a freelance writer, editor, and photographer, as well the InformationWeek information security reporter. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
4/29/2014 | 3:39:16 PM
Re: NSA
I for one, don't think our federal bureaucracy is capable of that type of coordinated effort..
wbeilstein130
50%
50%
wbeilstein130,
User Rank: Apprentice
4/29/2014 | 12:03:13 PM
NSA
Am I the only one who thinks that this survey is being done to allow the NSA easier access to the 50 companies web sites.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
4/28/2014 | 3:52:41 PM
Re: Focus On The Real Risk
Yes, indeed. The birth of a new market sector. 
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
4/28/2014 | 3:36:06 PM
Re: Focus On The Real Risk
Now they can add this:


3) Hire expensive security consultant to make SEC go away.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
4/28/2014 | 3:23:47 PM
Re: Focus On The Real Risk
I hope the SEC is more knowledgeable about cybersecurity risk than they were in 2008 when our financial industry collapsed. Somehow, I think not.

Please provide a copy of the firm's written information security policy." A business's response to that request will go a long way toward demonstrating if the organization has even basic information security practices in place.

Who at the SEC is going to review the answers to questions like that.

Thomas Claburn
50%
50%
Thomas Claburn,
User Rank: Moderator
4/28/2014 | 3:17:32 PM
Re: Focus On The Real Risk
Sample list sent to the SEC:

1) send out reminder to change default passwords to something other than "password"

2) pray
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
4/28/2014 | 12:50:25 PM
Focus On The Real Risk
The SEC should leave cyber-security to other organizations and agencies and focus on the real risks of financial malfeseance taking down the entire economy again. I'm more worried about that than hackers.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0485
Published: 2014-09-02
S3QL 1.18.1 and earlier uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object in (1) common.py or (2) local.py in backends/.

CVE-2014-3861
Published: 2014-09-02
Cross-site scripting (XSS) vulnerability in CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted reference element within a nonXMLBody element.

CVE-2014-3862
Published: 2014-09-02
CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to discover potentially sensitive URLs via a crafted reference element that triggers creation of an IMG element with an arbitrary URL in its SRC attribute, leading to information disclosure in a Referer log.

CVE-2014-5076
Published: 2014-09-02
The La Banque Postale application before 3.2.6 for Android does not prevent the launching of an activity by a component of another application, which allows attackers to obtain sensitive cached banking information via crafted intents, as demonstrated by the drozer framework.

CVE-2014-5136
Published: 2014-09-02
Cross-site scripting (XSS) vulnerability in Innovative Interfaces Sierra Library Services Platform 1.2_3 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.