Treasury official gives CU audience cybersecurity tips, resources

November 13, 2014

ARLINGTON, Va. (11/13/14)--The degree of interconnectivity and interdependency of information and payments systems mean that cyberattacks will only increase in volume, says Julia Philipp, deputy director for cyberintelligence in the Treasury's Office of Critical Infrastructure Protection and Compliance Policy.

Philipp spoke at the Credit Union Cybersecurity Symposium in Arlington, Va. Thursday, an event hosted by the National Association of State Credit Union Supervisors in partnership with the Credit Union National Association.

"When you consider the vast electronic interconnectivity within our financial systems, a significant cyber incident impacting your organization could lead to a major impact on the U.S. economy," she said. "The challenge isn't just that malicious cyberactors are getting more sophisticated, it's that they need to just need to compromise one vulnerability in one system to gain access to one network.

"That one vulnerability doesn't even have to be in your system, it could be in your vendors' systems, or even in the home computer you use to remotely access your office," Philipp added.

Phillip referred to the National Institute of Standards and Technology's Cybersecurity Framework, which was released in February of this year.

The framework calls for financial organizations to:

  • Identify: Develop organizational understanding to manage cybersecurity risk to systems, assets, data and capabilities. This calls for organizations to understand the business context, resources that support critical functions and the related cybersecurity risks to focus and prioritize its efforts;

  • Protect: Develop and implement appropriate safeguards to ensure delivery of critical infrastructure services;

  • Detect: Develop and implement appropriate activities to identify the occurrence of a cybersecurity event, including timely discovery;

  • Respond: Develop and implement appropriate activities to take action regarding a detected cybersecurity event, which support the ability to contain the impact of a potential cybersecurity event; and

  • Recover: Develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity event, which support timely recovery to normal operations to reduce the impact from a cybersecurity event.

Philipp added that all credit unions should look to reach out to the proper authorities before a cyberattack, to ensure that the proper procedures can be implemented.

"I would recommend all credit unions identity a point of contact at the nearest FBI field office. There are 56 field offices--each of which have cyber task forces across the country," she said. "It's a good idea to get to know who the person is you'll call in the event of a breach."