Home / Insights / Banking Regulators Warn on Technology Risks

Insight Banking Regulators Warn on Technology Risks

The “Heartbleed” bug in the OpenSSL protocol compromised the security of much of Internet from late 2011 until its discovery on April 7 of this year. The disclosure of the Heartbleed bug and the related news coverage has reminded us all of the importance of sound cybersecurity practices, such as not using the same password for multiple Web sites.

In apparent coincidence, simultaneous with or prior to the Heartbleed announcement, federal banking issued two statements focused on technology risks for regulated financial institutions.

The first, on April 2nd, is from the Financial Institutions Examinations Council (FFIEC) and focuses on (i) cyber-attacks on automated teller machines (ATMs) and card authorization systems and (ii)continued distributed denial of service attacks on public-facing Web sites. In substance, this release discusses the cyber-risks and summarizes regulators’ expectations for financial institution’s risk mitigation efforts. Although unstated, the timing of this release likely relates more to the publicity regarding ATMs that rely on Microsoft’s recently defunct Windows XP operating system.

The second, on April 7th, is from the FDIC and focus on technology-outsourcing guidance for community banks. The FDIC’s April 7 release, technical Financial Institution Letters FIL-13-2014, re-issues three documents from 2011 “as an informational resource to community banks on how to select providers, draft contract terms, and oversee multiple service providers when outsourcing for technology products and services.”

The three documents are “Effective Practices for Selecting a Service Provider,” “Tools to Manage Technology Providers’ Performance Risk: Service Levels Agreements,” and “Techniques for Managing Multiple Service Providers.” FIL-13-2014 provides hyperlinks to all three along with links to the FFIEC’s examination guidance related to technology outsourcing.

Of course, following disclosure of Heartbleed on April 7, the banking regulators quickly released additional statements specific to the Heartbleed risk. For example, the FFIEC’s April 10 statement on Heartbleed is available here: https://www.ffiec.gov/press/pr041014.htm.

If you have questions, please contact our banking group  or call 208.344.6000.

Related Insights

Corporate Transparency Act - Beneficial Ownership Information Reporting Requirement

The Corporate Transparency Act requires certain entities to disclose the beneficial ownership information from people who own or control a company. We're here to help…


Finding Investment Opportunities in the Modern Zoning Code

The Boise City Council unanimously approved a new zoning code, known as the Modern Zoning Code (MZC), that will go into effect on December 1,…


SECURE 2.0 Update

It has been almost six months since “SECURE 2.0” was enacted as part of the Consolidated Appropriations Act, 2023. There has been no shortage of…


Idaho Liquor License Update

During the final days of the 2023 term of the Idaho legislative session, Senate Bill 1120 (“SB1120”) was passed and signed into law. SB1120 makes…