Regulators are warning financial institutions of increased cybersecurity risk amid the Iran war.
The California Department of Financial Protection and Innovation sent the firms it regulates a bulletin last week informing them of the need for heightened cyber awareness, said Christina Tetreault, a deputy commissioner with the DFPI.
With the military action occurring in the Middle East, Iran has said it will target financial institutions, specifically those in the region linked to the U.S. and Israel. Citi and Standard Chartered told staff not to come into offices in Dubai, The New York Times reported. Goldman Sachs has done likewise, according to Bloomberg. HSBC closed branches in Qatar.
Threats from the conflict in the region extend to the cyber realm, Tetreault indicated.
“Making sure that our licensees and covered persons really are vigorous in their cybersecurity defenses is very much part of what we're working to do with bulletins and other advice and educational materials,” Tetreault said Wednesday during a Banking Dive-Payments Dive virtual event.
It’s also a topic of conversations between the state’s examiners and licensees, she noted. “We're very eager to see people really fortify those defenses,” Tetreault said, because “we know that financial institutions are a target.”
Similarly, the New York Department of Financial Services issued a letter last week to chief information security officers of its regulated institutions, alerting them to increased risk of cyberattacks from global conflict, saying “recent events warrant vigilance.”
Late Wednesday, Michigan-based medical equipment company Stryker said it was experiencing a global network disruption due to a cyberattack, MedTech Dive reported. An Iran-linked threat actor that researchers call Handala claimed credit for the attack, according to Check Point Research.
Fitch Ratings warned Monday that hacktivists, state-sponsored groups or solo actors may target critical infrastructure and U.S. public entities through cyberattacks, in response to the bombing campaign that began Feb. 28, Cybersecurity Dive reported.
The DFPI’s bulletin said California financial institutions are “encouraged to maintain a high level of awareness as the situation overseas continues to unfold.”
NYDFS also encouraged financial institutions to review their cybersecurity programs, making sure they’re compliant with the department’s cyber regulation, and ensuring cyber practices reflect a “heightened threat environment.”
Regulated entities were urged to mitigate security vulnerabilities to reduce access points for bad actors, monitor web traffic to be able to identify attacks intended to disrupt traffic to a network, and remove or reduce devices connected to the public internet and disable unused ports, according to California’s bulletin.
Banks and other firms were encouraged to prepare for cyber incidents by reviewing and testing procedures and response playbooks to protect and restore essential functions, information systems and nonpublic information. Financial institutions should confirm detection thresholds and escalation channels are sufficient, the state agencies said.
California and New York regulators also recommended lenders bolster monitoring for suspicious activity on information systems; monitor communication from supply chain partners; ensure alternate secure communication channels are available if main networks are affected; confirm strategies to communicate to employees and customers are sufficient if system and service disruptions are protracted; and monitor for disinformation involving their company.
Financial institution CISOs should also ensure minimum possible user and service account permissions and privileges, when it comes to accessing and maintaining web servers and databases; and restrict and validate user inputs before forwarding to databases, to protect against cyberattacks that involve injecting malicious code into an application.
Tetreault encouraged California-licensed financial institutions to reach out to the DFPI for cyber-related resources.
A spokesperson for FS-ISAC, a cybersecurity information-sharing organization for the financial industry, said the group is coordinating with other entities “to ensure our ecosystem has continuous access to the latest intelligence and guidance to protect the global financial system” amid military action in the Middle East.
“Geopolitical conflicts and ongoing tensions have always presented opportunities for threat actors to target the financial sector. Recent events have shown that it is vital that the sector remains vigilant against increased nation-state activity and hacktivism,” the spokesperson said.
The Federal Reserve, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corp. declined to comment. The Treasury Department and Financial Crimes Enforcement Network didn’t respond to a request for comment.
