Financial Regulators Release New Appendix to Business Continuity Planning Booklet Appendix J: Strengthening the Resilience of Outsourced Technology Services

The Federal Financial Institutions Examination Council (FFIEC) members today issued a revised Business Continuity Planning Booklet (BCP Booklet), which is part of the FFIEC Information Technology Examination Handbook (IT Handbook). The update consists of the addition of a new appendix, entitled Strengthening the Resilience of Outsourced Technology Services.

-

The BCP Booklet contains guidance to assist examiners in evaluating financial institution and service provider risk management processes to ensure the availability of critical financial services. The booklet also was designed to provide guidance to financial institutions about the implementation of their business continuity planning processes.

-

The appendix highlights that a financial institution’s reliance on third-party service providers to perform or support critical operations does not relieve a financial institution of its responsibility to ensure that outsourced activities are conducted in a safe and sound manner. An effective third-party management program should provide the framework for financial institution management to identify, measure, monitor, and mitigate the risks associated with outsourcing. Specifically, a financial institution should ensure that its third-party service providers do not negatively affect its ability to appropriately recover IT systems and return critical functions to normal operations in a timely manner. The appendix highlights and strengthens the BCP Booklet in four specific areas:

- 

•Third-Party Management

•Third-Party Capacity

•Testing with Third-Party Technology Service Providers

•Cyber Resilience

-

The IT Handbook is a collaborative effort of the Information Technology Subcommittee of the FFIEC’s Task Force on Supervision. The Information Technology Subcommittee promotes uniform and effective information on technology-related policies and supervisory programs for financial institutions and their service providers. The IT Handbook is available online at http://ithandbook.ffiec.gov/

The Federal Financial Institutions Examination Council (FFIEC) members today issued a revised Business Continuity Planning Booklet (BCP Booklet), which is part of the FFIEC Information Technology Examination Handbook (IT Handbook). The update consists of the addition of a new appendix, entitled Strengthening the Resilience of Outsourced Technology Services.

The BCP Booklet contains guidance to assist examiners in evaluating financial institution and service provider risk management processes to ensure the availability of critical financial services. The booklet also was designed to provide guidance to financial institutions about the implementation of their business continuity planning processes.

The appendix highlights that a financial institution’s reliance on third-party service providers to perform or support critical operations does not relieve a financial institution of its responsibility to ensure that outsourced activities are conducted in a safe and sound manner. An effective third-party management program should provide the framework for financial institution management to identify, measure, monitor, and mitigate the risks associated with outsourcing. Specifically, a financial institution should ensure that its third-party service providers do not negatively affect its ability to appropriately recover IT systems and return critical functions to normal operations in a timely manner. The appendix highlights and strengthens the BCP Booklet in four specific areas: •Third-Party Management•Third-Party Capacity•Testing with Third-Party Technology Service Providers•Cyber Resilience

-

The IT Handbook is a collaborative effort of the Information Technology Subcommittee of the FFIEC’s Task Force on Supervision. The Information Technology Subcommittee promotes uniform and effective information on technology-related policies and supervisory programs for financial institutions and their service providers. The IT Handbook is available online at http://ithandbook.ffiec.gov/

Cyber resilience: a financial stability perspective (Bank of England)

"Expect the cyber threat to be ever-present, ever-evolving and networks to be penetrated" - read this speach from Bank of England on Cyber resilience: a financial stability perspective... 

http://www.bankofengland.co.uk/publications/Documents/speeches/2015/speech792.pdf

Tomas J. Curry April 16 2014 OCC Remarks

http://www.occ.gov/news-issuances/speeches/2014/pub-speech-2014-59.pdf

the Speech can be found at the link above...

What most thought was going to be a speech on Cybersecurity and the perils of the cloud and use of the Internet, actually turned into a larger concern regarding Third Party Risk Management. 

In summary....

Curry points out that banks use of third party technolgoies is ever increasing and interconnected.  and the concern is managing the risk associted with interconnected services and their dependances. In otherwords, a single vendor may not be considered crtical on it's own, but it's connections to other applications and the level of dependence may actually add to the Risk... 

The level of dependance FIs are an area of deep concern with Curry pointing out that the OCC as taken “serious enforcement actions” against “some of our large institutions” for mis-management of third party relationships.

FFIEC and Heartbleed

FFIEC issues a Pressrelease today regarding the Heartbleed vulnerability in OpenSSL...

A vulnerability that has been in the wild for 2 years with the release of OpenSSL 1.0.1 beta... and up patched in 1.0.1g

http://www.ffiec.gov/press/pr041014.htm

OpenSSL Security Advosiry was issued on April 7, 2014. 

https://www.openssl.org/news/secadv_20140407.txt 

And TOR Project summed it up iwth it's Blog Post... 

Ars Technica's Dan Goodin hasd a well written article out on 4/8/2014 giving us more information on the defect.  Check out Dan's Article here... 

History: 

 v0.9.8 / July 5, 2005 

 v1.0.0 / March 29, 2010 

 v1.0.1 March 14, 2012 

 Successor of 1.0.0h 

 Supports TLS v1.2 

 SRP support 

 TLS "Heartbeat" RFC 6520 / February 2012 

 TLS is based on reliable protocols, but there is not necessarily a feature available to keep the connection alive without continuous data transfer. The Heartbeat Extension as described in this document overcomes these limitations. The user can use the new HeartbeatRequest message, which has to be answered by the peer with a HeartbeartResponse immediately. 

 v1.0.1g - Now available 

 v1.0.2 - in beta release, coming soon. 

FRB Announces Guidance on Outsourcing Risk

Reposting the Press Release from December 5.... 

Press Release:

The Federal Reserve Board on Thursday released guidance reminding financial institutions it supervises to exercise appropriate risk management and oversight when using service providers.

The guidance describes factors financial institutions should consider when choosing a service provider and how service providers should be overseen. A service provider is defined as any organization or entity--such as a consultant--that enters into a contractual relationship with a financial institution to provide business functions or activities, such as accounting, auditing, loan review, compliance, and risk management.

The guidance does not discourage financial institutions from outsourcing activities to service providers, but says firms should be aware of the potential risks. If service provider relationships are not managed effectively, they may expose financial institutions to risks that can result in reputational problems, financial loss, or regulatory actions, according to the guidance.

Furthermore, the guidance states that the use of service providers does not relieve a financial institution's board of directors or senior managers of responsibility for the activities performed by service providers. Financial institutions are responsible for ensuring that all activities conducted by service providers comply with applicable laws and regulations and are consistent with safe and sound banking practices.

The guidance is applicable to state-chartered banks that are members of the Federal Reserve System, bank and savings and loan holding companies and their nonbank subsidiaries, and U.S. operations of foreign banking organizations.