FINANCIAL SECTOR
Ransomware has become the most visible cyber threat to our nation’s networks. While financial institutions have implemented cybersecurity practices, the rapid advancements in ransomware and its potentially devastating consequences require that every financial institution review and update its controls.
The CSBS Bankers Electronic Crimes Taskforce (BECTF), State Bank Regulators and the United States Secret Service together have developed the Ransomware Assessment Tool (R-SAT) for banks and nonbanks. The self-assessment tool has 16 questions designed to help financial institutions reduce the risks of ransomware. It was developed to help financial institutions assess their efforts to mitigate risks associated with ransomware and identify gaps for increasing security. By using the self-assessment tool, executive management and the board of directors with an overview of the institution’s preparedness can better identify, protect, detect, respond to, and recover from a ransomware attack.
The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) issued an updated advisory on September 21, 2021, to highlight the sanctions risks associated with ransomware payments and the proactive steps companies can take to mitigate such risks. Specifically, the updated advisory encourages U.S. entities to adopt and improve cybersecurity practices and report ransomware attacks to, and fully cooperate with, law enforcement. The updated advisory states that when affected parties take these proactive steps, OFAC would be more likely to resolve apparent sanctions violations involving ransomware attacks with a non-public enforcement response.
The U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) has issued an advisory on Ransomware and the Use of the Financial System to Facilitate Ransom Payments.
