Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

SEC Requests Financial Firms' Security Details

SEC asks 50 businesses for copies of their security policies, procedures, and controls in an effort to help the industry bolster cybersecurity protection.

The Securities and Exchange Commission plans to study the information security policies, procedures, and levels of preparedness of businesses in the financial services sector.

In an announcement issued earlier this month, the SEC's Office of Compliance Inspections and Examinations (OCIE) said it would be "conducting examinations of more than 50 registered broker-dealers and registered investment advisers, focusing on areas related to cybersecurity" -- government-speak for anything involving information, computers, and security.

The agency's stated rationale for conducting the examinations is to "help identify areas where the Commission and the industry can work together to protect investors and our capital markets from cybersecurity threats." Interestingly, the agency added that "this guidance is not a rule, regulation, or statement of the commission," suggesting that the information would be amassed -- at least initially – only for information-gathering purposes.

What form will those examinations take? While no final version of the exam has been released, the OCIE included in its announcement a 28-question sample cyber security document that poses questions around such areas as risk identification, safeguarding firms' networks, securing remote customer access and fund-transfer requests, working with vendors, and detecting unauthorized activity. The agency said the questions are based in part on the "Framework for Improving Critical Infrastructure Cybersecurity" released by the National Institute of Standards and Technology in February.

[Investments in security startups are taking off. Read Venture Capital: The Lifeblood Behind Security Innovation.]

What's especially notable about the SEC's announcement is that the examination isn't predicated on telling businesses what to do or presenting them with a checklist. Instead, it says that maintaining correct risk-based controls is the responsibility of any individual business, and that those controls will be unique to the business. For now, the SEC wants details about what businesses are doing and why they're doing it.

"The philosophy here... is very rigorous; it's very risk-based, comprehensive, and specific to an organization," said Carl S. Young, managing director and chief security officer at computer investigations, intelligence, and risk management firm Stroz Friedberg, speaking by phone. "I was quite encouraged by this exam and the message it sends in terms of people recognizing that this is not a checklist-oriented problem."

According to Young, the Commission is also showing it now wants more than assurances from financial firms. "They've recognized that there needs to be some kind of scrutiny that goes beyond people saying, 'We're OK,' " he noted.

One of the exam's top questions, for example, is this request: "Please provide a copy of the firm's written information security policy." A business's response to that request will go a long way toward demonstrating if the organization has even basic information security practices in place.

But businesses may also face further inquiries from the SEC. "They caveated pretty hard by saying this is not a safe harbor, and there may be other questions," Young points out.

The SEC's examination announcement comes in the wake of a March roundtable, hosted by the agency, which was designed to investigate what role the SEC should play when handling two issues: ensuring that public companies have robust information security defenses in place, and ensuring the security of the market infrastructure and of any organization that must comply with SEC regulations.

"As an SEC commissioner, I have become particularly concerned about the risks that cyberattacks pose to public companies, and to the capital markets and its critical participants, including the exchanges, clearing agencies, transfer agents, broker-dealers, and investment advisers," said SEC commissioner Luis A. Aguilar at the roundtable. "Cyberattacks aimed at these market participants can have devastating effects on our economy, on individual consumers, and on the markets and investors that the SEC was created to safeguard."

Of course, the new exam isn't the agency's first move to solicit information security particulars from financial firms. In 2011, the SEC began requiring public companies to begin releasing some security-related information. "That guidance makes clear that material information regarding cyber security risks and cyber incidents is required to be disclosed," said SEC chairwoman Mary Jo White at the roundtable.

Agency officials have continued to study how businesses have responded to that requirement. "With regard to the public company discussion, I am particularly interested in hearing whether the current disclosure regime under the 2011 guidance is working or how it could be improved," said Aguilar.

Last year, per Regulation S-ID, the SEC also began requiring some financial services firms and creditors to create identify theft programs and comply with Identity Theft Red Flags Rules.

When it comes to the cybersecurity examination, which 50 businesses might the agency first look at? One likely scenario is that the agency will try to study organizations both large and small from a variety of different financial sectors. "That's my view," says Stroz Friedberg's Young. "If they can categorize them into food groups, then I'd take a hard look at what the results of the exam were, then I'd modify the exam and propagate it outwards."

The results of the SEC's exam may have ramifications far beyond the financial services industry. "This may be a watershed announcement," says Young. "It wouldn't shock me if other agencies followed suit."

NIST's cyber security framework gives critical-infrastructure operators a new tool to assess readiness. But will operators put this voluntary framework to work? Read the Protecting Critical Infrastructure issue of InformationWeek Government today.

Mathew Schwartz served as the InformationWeek information security reporter from 2010 until mid-2014. View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
4/29/2014 | 3:39:16 PM
Re: NSA
I for one, don't think our federal bureaucracy is capable of that type of coordinated effort..
wbeilstein130
50%
50%
wbeilstein130,
User Rank: Apprentice
4/29/2014 | 12:03:13 PM
NSA
Am I the only one who thinks that this survey is being done to allow the NSA easier access to the 50 companies web sites.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
4/28/2014 | 3:52:41 PM
Re: Focus On The Real Risk
Yes, indeed. The birth of a new market sector. 
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
4/28/2014 | 3:36:06 PM
Re: Focus On The Real Risk
Now they can add this:


3) Hire expensive security consultant to make SEC go away.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
4/28/2014 | 3:23:47 PM
Re: Focus On The Real Risk
I hope the SEC is more knowledgeable about cybersecurity risk than they were in 2008 when our financial industry collapsed. Somehow, I think not.

Please provide a copy of the firm's written information security policy." A business's response to that request will go a long way toward demonstrating if the organization has even basic information security practices in place.

Who at the SEC is going to review the answers to questions like that.

Thomas Claburn
50%
50%
Thomas Claburn,
User Rank: Ninja
4/28/2014 | 3:17:32 PM
Re: Focus On The Real Risk
Sample list sent to the SEC:

1) send out reminder to change default passwords to something other than "password"

2) pray
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
4/28/2014 | 12:50:25 PM
Focus On The Real Risk
The SEC should leave cyber-security to other organizations and agencies and focus on the real risks of financial malfeseance taking down the entire economy again. I'm more worried about that than hackers.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Another COVID-19 Side Effect: Rising Nation-State Cyber Activity
Stephen Ward, VP, ThreatConnect,  7/1/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15600
PUBLISHED: 2020-07-07
An issue was discovered in CMSUno before 1.6.1. uno.php allows CSRF to change the admin password.
CVE-2020-15599
PUBLISHED: 2020-07-07
Victor CMS through 2019-02-28 allows XSS via the register.php user_firstname or user_lastname field.
CVE-2020-8916
PUBLISHED: 2020-07-07
A memory leak in Openthread's wpantund versions up to commit 0e5d1601febb869f583e944785e5685c6c747be7, when used in an environment where wpanctl is directly interfacing with the control driver (eg: debug environments) can allow an attacker to crash the service (DoS). We recommend updating, or to res...
CVE-2020-12821
PUBLISHED: 2020-07-07
Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil attack.
CVE-2020-15008
PUBLISHED: 2020-07-07
A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation to save data to a custom table exists due to inadequate server side validation. As the code creates dynamic SQL for the insert statement and utilizes the user su...