[BreachExchange] Why the FDIC Is Updating Its Cyber Security Policy After This Data Breach

[Audrey McNeil]

http://fortune.com/2016/07/14/fdic-data-breach-cyber-security/

The U.S. Federal Deposit Insurance Corporation is updating cyber security
policies after a 2015 data breach in which a former employee kept copies of
sensitive information on how banks would handle bankruptcy, the regulator’s
chief said on Thursday.

FDIC Chairman Martin Gruenberg also said he made personnel changes after
receiving a report in 2013 informing him that he had not been fully briefed
about the major compromise of the regulator’s computers by a foreign
government in 2010 and 2011.

Gruenberg made the comments in prepared remarks for a hearing of the U.S.
House of Representatives committee that on Wednesday said in a report that
the FDIC covered up the 2010-2011 hacks, which the panel said also occurred
in 2013 and were likely orchestrated by the Chinese government.

The FDIC is a major U.S. banking regulator that keeps confidential data on
America’s biggest banks.

Staff from the House Science, Space, and Technology Committee said a
witness told them the cover-up was intended to avoid endangering
Gruenberg’s pending confirmation to his post by the U.S. Senate.

The committee criticized the FDIC’s handling of more recent data breaches
including the copying by an employee of data on “resolution plans,” which
are also known as “living wills” and detail how America’s biggest financial
institutions would wind themselves down if they failed.

The employee copied information on resolution plans onto a thumb drive
immediately before leaving the FDIC, and the incident was detected shortly
afterward in September 2015, Gruenberg said, laying out a timeline that had
already been disclosed by other FDIC officials. The thumb drive was
recovered in December 2015.

Gruenberg said policy changes were being taken to address such “insider
threats.”

“A team of executive-level staff will finalize the FDIC’s insider threat
program policy statement and governance structure by October 28, 2016,”
Gruenberg said.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20160714/7fda5534/attachment.html>