This week, the New York State Department of Financial Services (NYDFS) issued the Report on the SolarWinds Cyber Espionage Attack and Institutions’ Response. The Report begins with the statement that “The next great financial crisis could come from a cyber-attack,” And goes on to describe how the SolarWinds attack affected financial institutions and NYDFS’s response assisting financial institutions in its aftermath.
The Report states that “the SolarWinds Attack is, to date, the most visible, widespread, and intrusive information technology (“IT”) software supply chain attack – i.e., a cyber-attack that corrupts IT software and uses that software as an attack vector. Supply chain attacks are dangerous because the malware is embedded inside a legitimate product, and because supply chain attacks can allow an attacker to access the networks of many organizations in a single stroke.”
For this reason, the Report further notes that “this attack confirms the importance of vigorous third party risk management, which starts with a thorough assessment of an organization’s third party risk. Third party risk management is a key part of DFS’s Cybersecurity Regulation, and the Department is exploring ways to further address this critical component of cybersecurity.”
The Report also addresses the lack of transparency in information sharing regarding cybersecurity attacks and indicates that NYDFS is interested in improving information sharing and transparency among its regulated covered entities.
The Report summarizes the background facts of the SolarWind attack, remediation efforts taken by companies affected by the attack, recommendations to strengthen cybersecurity practices, and measures taken to respond to the attack.