NYDFS Issues Report on SolarWinds

Robinson+Cole Data Privacy + Security Insider

This week, the New York State Department of Financial Services (NYDFS) issued the Report on the SolarWinds Cyber Espionage Attack and Institutions’ Response. The Report begins with the statement that “The next great financial crisis could come from a cyber-attack,” And goes on to describe how the SolarWinds attack affected financial institutions and NYDFS’s response assisting financial institutions in its aftermath.

The Report states that “the SolarWinds Attack is, to date, the most visible, widespread, and intrusive information technology (“IT”) software supply chain attack – i.e., a cyber-attack that corrupts IT software and uses that software as an attack vector. Supply chain attacks are dangerous because the malware is embedded inside a legitimate product, and because supply chain attacks can allow an attacker to access the networks of many organizations in a single stroke.”

For this reason, the Report further notes that “this attack confirms the importance of vigorous third party risk management, which starts with a thorough assessment of an organization’s third party risk. Third party risk management is a key part of DFS’s Cybersecurity Regulation, and the Department is exploring ways to further address this critical component of cybersecurity.”

The Report also addresses the lack of transparency in information sharing regarding cybersecurity attacks and indicates that NYDFS is interested in improving information sharing and transparency among its regulated covered entities.

The Report summarizes the background facts of the SolarWind attack, remediation efforts taken by companies affected by the attack, recommendations to strengthen cybersecurity practices, and measures taken to respond to the attack.

[View source.]

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Robinson+Cole Data Privacy + Security Insider | Attorney Advertising

Written by:

Robinson+Cole Data Privacy + Security Insider

Robinson+Cole Data Privacy + Security Insider on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.