Depierro, Incident Response, Recovery and Continuity

What Can a Global Pandemic Teach

Us About Incident Response, Recovery

and Continuity?

aba.com 1-800-BANKERS

Denyette DePierro Vice President and Senior Counsel Cybersecurity and Digital Risk Office of Advocacy and Innovation American Bankers Association


GLOBAL PANDEMIC

Has it changed your approach to business continuity?

Has it changed your approach to identifying and

mitigating risk?

Has it changed your approach to incident response

and recovery?


The Quick Summary

Business continuity is incident agnostic.

Incident response and recovery is the process of building

your institution’s resiliency and capacity through testing,

training, and implementation.


Pandemic = changing supervisory language

Continuity

Response

Recovery

Resiliency

Capacity

Agility


Understand Your Resiliency Relationships

1. Employees

2. Board of Directors and Senior Management

3. Supervisors and Examiners


Employees

1. Awareness

2. Training

3. Capacity and capability


Board of Directors and Senior Management

1. Business Continuity Management

2. Awareness and Training

3. Capacity and Capability

4. Funding and Resources


Supervisors and Examiners

1. Documentation

2. Demonstration

3. Supervisory Trend: Incident Response and Recovery


BCM DURING A GLOBAL PANDEMIC

What does this trend mean for bank supervision

and examinations?


1. FFIEC IT Handbook for Business Continuity Management

(November 2019)

2. Pandemic update (March 2020)

3. FFIEC Joint Statement: Security in a Cloud Computing

Environment (April 2020)

What has changed?

Business Continuity Management


TREND: BCM DURING A GLOBAL PANDEMIC

April 2020

Financial Stability Board releases consultative

document on Pandemic and Cybersecurity Incident

Response and Recovery (CIRR)



July 2020

Financial Stability Board hosts global roundtables in

Asia, EU, and US



August 2020

Basel Committee on Banking Supervision

releases two consultative

documents: Principles of Operational Resilience

and Sound Management of Operational Risk





mitigating risk?


and recovery?


BCM During a Pandemic – Lessons Learned

1. Importance of planning and preparedness.

2. Culturally agile and flexible.

3. Open to creative problem solving.

4. Ability to integrate prior experiences.

5. Familiarity with remote/virtual/cloud operations and

security.


BCM in a Pandemic – Lessons Learned

Importance of planning and preparedness:

1. Robust Business Impact Analysis (BIA)

2. Pandemic tabletop exercises.

• Integrated prior results

• Used pandemic tabletop exercises to review/refresh

IRR plans.



Culturally Agile and Flexible:

• Ability to move to 100% WFH.

• Adopt, adapt, train, identify, and secure new technology.

• Secure and adapt physical premises and procedures.

• Respond to changing staff and customer needs.



Creative Problem Solving:

1. Managing supply chain disruptions.

2. Prioritizing funding and deployment.

3. New platforms for meetings, training, customer service.



Ability to Integrate Prior Experiences:

1. Natural Disaster

2. Severe Weather

3. Business disruption: cyber event

4. Business disruption: 3rd party service provider



Familiarity with remote/virtual/cloud:

1. Digital meeting platforms

2. Hardware availability

3. Staff training and familiarity with WFH processes

4. Tested and assured staff’s WHF capacity


SECURITY AWARENESS

AND TRAINING Security awareness is the knowledge and attitude members of an organization possess regarding the protection of the physical and informational assets of that organization.

– Wikipedia


Security Awareness and Training

Compliance focus Promoting behavior change

People are a valuable asset

for detecting suspicious emails.


Security Awareness and Training

Start with New Hires:

Information security summary for new employees on

the 1st day of hire.


Security Awareness: WFH

Keep home devices updated.

Secure WiFi routers.

Manage secure workspaces.

Protect personal accounts.

Be vigilant.

Address hard copy printing at home.


TABLETOP EXERCISES Discussion-based sessions to discuss team roles during a

scenario and their responses to a particular emergency situation.


Tabletop Exercises: Annual Program

Quarterly exercises: 2 major + 2 minor

Schedule 30 days for planning

Major Minor

Fall

FS-ISAC CAPS or SIFMA

Quantum Dawn

Winter

Targeted 1 hour exercise for a

small subset of the process.

Spring

Facilitated by a 3rd party. End

to end process evaluation with

executive management

sessions.

Summer

Targeted 1 hour exercise for a

small subset of the process.


Tabletop exercises in a pandemic

PRO

• More people can stay

on WebEx/Zoom.

• More realistic. In real

life, incidents happen on

weekends too.

CON

• Lose the face-to-face

interaction with team

members.

Even more important when staff is WFH


PHISHING EXERCISES Fraudulent attempt to obtain sensitive information, or data, such as usernames, passwords and credit card details by disguising oneself as a trustworthy entity in an electronic communication.

- Wikipedia


Phishing Exercises: Leading Practices

1. Find “Teachable Moments” offering positive reinforcement.

2. Gradually increase complexity.

3. Offer additional training for repeat offenders.

Only takes one employee report to help

stop an attack …



4. Need strong support from executive management

and CEO.

5. Publicize program widely from the start.

6. Report results to the Board of Directors.



7. Focus training on high-value targets:

• IT administrators

• Research staff

• Payment/SWIFT administrators

8. Uptick in email reporting is good Behavioral Change


ACCESS:

TERMINATIONS AND

TRANSFERS Access: The ability to physically or logically enter or make use of an IT system or area (secured or unsecured). The process of interacting with a system.

-FFIEC IT Handbook, Information Security


Access: Terminations and Transfers

Why? Data Loss Prevention, Reputation Risk

How? Involve HR, Legal, and Physical Security

Especially important if insider threat is suspected.

Unique Challenges of Work from Home


BUSINESS CONTINUITY

MANAGEMENT The process for management to oversee and implement resilience, continuity, and

response capabilities to safeguard employees, customers, and products and

services.

- FFIEC IT Handbook, Business Continuity Management


Business Continuity Management (BCM)

• FFIEC IT Handbook for Business Continuity

Management (November 2019)

• Pandemic update (March 2020)

• Cloud Security (April 2020)

What has changed?


BCM: Key Points

1. Identify and inventory:

Internal/external risks,

Types of threats,

Interconnectivity, and

Existing controls.

2. Reconcile Business Impact Analysis (BIA) and risk

assessment results with assumed priorities.


BCM: Key Points

3. Training and education on plans and goals.

4. Assure exercise and testing program is sufficient to meet

objectives.

5. Expand BCM and resiliency relationships beyond law

enforcement.


CYBER INSURANCE As with any insurance coverage, cyber insurance does not diminish the

importance of a sound control environment. Rather, cyber insurance may be a

component of a broader risk management strategy that includes identifying,

measuring, mitigating, and monitoring cyber risk exposure.

- FFIEC Statement on Cyber Insurance (April 2018)


Cyber Insurance

• What is it?

• Why is it necessary?

• What are the gotcha’s?


Cyber Insurance:

Do you know if losses arising from

clicking on a phishing link are

covered or excluded in your cyber

insurance policy?


Cyber Insurance:

If you knew the answer to that question:

1. Would you change your approach to anti-

phishing training?

2. Would you change your cyber policy?


Cyber Insurance: Who?

Who should consider cyber insurance?

Does your bank:

1. Store and maintain customer information?

2. Collect online payment information?

3. Use the cloud?


Cyber Insurance: Why?

• 2018: cyber claims surpassed all other bank liability

insurance claims.

• Rising global cost of cyber crime:

2018 - $3 trillion.

2021 - $6 trillion.

• 1 ransomware demand every 40 seconds


Cyber Insurance: Why?

As part of a risk management plan, organizations decide

which risks to avoid, accept, control, or transfer.

Cyber insurance is a form of transferring risk.


Cyber Insurance: Gotcha!

READ YOUR

POLICY


Cyber Insurance: Gotcha!

Terms & Conditions

1. Are you using approved vendors?

2. Can you monitor claim expenses?

3. When do you notify the insurance carrier?

4. What is required if a third party is breached?





mitigating risk?


and recovery?


TAKEAWAYS


Takeaways

Tabletop and phishing exercises are low cost and high

return methods to improve security.

Executive management support is essential;.

Make reporting easy and use positive reinforcement.


Takeaways

Manage the security of the employee lifecycle from

Day 1 to departure.

Business continuity and risk transfer requires the full

support senior management and the board of

directors.


Takeaways

Know what’s covered and what is not covered in your cyber insurance policy.

Have your vendors approved prior to an incident.

Rely on your insurance carrier as a trusted advisor and partner.


RESOURCES


Securing WFH & BYOD

National Institute for Standards and Technology (NIST), ITL

BULLETIN: Security for Enterprise Telework, Remote

Access, and Bring Your Own Device (BYOD) Solutions

(March 2020).

https://csrc.nist.gov/CSRC/media/Publications/Shared/documents/itl-bulletin/itlbul2020-03.pdf








Awareness and Training Resources

• SANS Institute’s Security Awareness

• NIST’s Building an Information Technology Security

Awareness and Training Program – SP 800-50

• Verizon’s Data Breach Investigations Report

https://www.sans.org/security-awareness-training

https://csrc.nist.gov/publications/detail/sp/800-50/final

https://csrc.nist.gov/publications/detail/sp/800-50/final

https://enterprise.verizon.com/resources/reports/dbir/


Access and Termination Resources

ABA Guide to the FFIEC IT Examination Handbook, Information Security

Booklet (March 2017).

aba.com/news-research/references-guides/guide-ffiec-it-examination-

handbook

• Section II.C, Risk Mitigation,

• Section II.C.7, User Security Controls, and

• Section II.C.15, Logical Security.

https://ithandbook.ffiec.gov/it-booklets/information-security.aspx

https://www.aba.com/news-research/references-guides/guide-ffiec-it-examination-handbook













https://ithandbook.ffiec.gov/it-booklets/information-security.aspx


Tabletop Resources

• MITRE’s Cyber Exercise Playbook

• SANS Institute’s Incident Handling Annual Testing and Training

• NIST’s Guide to Test, Training and Exercise Programs for IT Plans and

Capabilities – SP 800-84

• FDIC’s Cyber Challenge for Community Banks

https://www.mitre.org/sites/default/files/publications/pr_14-3929-cyber-exercise-playbook.pdf

https://www.sans.org/reading-room/whitepapers/incident/incident-handling-annual-testing-training-34565

http://csrc.nist.gov/publications/nistpubs/800-84/SP800-84.pdf

http://csrc.nist.gov/publications/nistpubs/800-84/SP800-84.pdf

https://www.fdic.gov/regulations/resources/director/technical/cyber/cyber.html


Business Continuity Management Resources

FFIEC IT Handbook, Business Continuity Management Booklet (November

2019)

https://ithandbook.ffiec.gov/it-booklets/business-continuity-

management.aspx

FFIEC Statement on Pandemic Planning (March 2020)

https://www.ffiec.gov/press/PDF/FFIEC%20Statement%20on%20Pandemic

%20Planning.pdf

https://ithandbook.ffiec.gov/it-booklets/business-continuity-management.aspx








https://www.ffiec.gov/press/PDF/FFIEC Statement on Pandemic Planning.pdf

https://www.ffiec.gov/press/PDF/FFIEC Statement on Pandemic Planning.pdf


Cyber Insurance Resources

Financial Services Sector Coordinating Council (FSSCC) Purchasers Guide

to Cyber Insurance Products

https://fsscc.org/files/galleries/FSSCC_Cyber_Insurance_Purchasers_Guide

_FINAL-TLP_White.pdf

https://fsscc.org/files/galleries/FSSCC_Cyber_Insurance_Purchasers_Guide_FINAL-TLP_White.pdf






Additional Resources

• ABA Cybersecurity-https://www.aba.com/banking-

topics/technology/cybersecurity

• Financial Services Sector Coordinating Council- https://fsscc.org/

• BIS: Cyber-resilience: range of practices report issued by the Basel

Committee- https://www.bis.org/press/p181204.htm

• Financial Stability Board (FSB). Effective Practices for Cyber Incident

Response and Recovery: Consultative Document (April 2020)

https://www.aba.com/banking-topics/technology/cybersecurity



https://fsscc.org/

https://www.bis.org/press/p181204.htm

https://www.fsb.org/2020/04/effective-practices-for-cyber-incident-response-and-recovery-consultative-document/

https://www.fsb.org/2020/04/effective-practices-for-cyber-incident-response-and-recovery-consultative-document/


About the Speaker

Denyette DePierro

Vice President & Senior Counsel, Cybersecurity & Digital Risk

American Bankers Association

Denyette DePierro joined the American Bankers Association in March 2008. Prior

to joining ABA, Denyette was Legislative Counsel at the Independent Community

Bankers of America (ICBA) in Washington, D.C. and the California Independent

Bankers in Newport Beach, California. Denyette received her J.D. and M.DR from

the Pepperdine School of Law, where she was a fellow at the Straus Institute for

Dispute Resolution. She received a B.A. from the University of California, Santa

Barbara, and was a European Union Fellow at the University of Padua in Padua,

Italy in Developmental Economics. At ABA, Denyette focuses on the state, federal,

and international regulation of technology, cybersecurity, privacy, data security and

emerging trends in banking, including fintech, blockchain, internet of things (IOT),

artificial intelligence, and social media.

Email: [email protected]

LinkedIn: www.linkedin.com/in/depierro/

Twitter: @DenyetteD

Phone: 202.663.5333

mailto:[email protected]

http://www.linkedin.com/in/depierro/

http://www.linkedin.com/in/depierro/

Depierro, Incident Response, Recovery and Continuity

Documents

Transcript of Depierro, Incident Response, Recovery and Continuity