This week, the New York State Department of Financial Services (NYDFS) issued the Report on the SolarWinds Cyber Espionage Attack and Institutions’ Response. The Report begins with the statement that “The next great financial crisis could come from a cyber-attack,” And goes on to describe how the SolarWinds attack affected financial institutions and NYDFS’s response assisting financial institutions in its aftermath.
The Report states that “the SolarWinds Attack is, to date, the most visible, widespread, and intrusive information technology (“IT”) software supply chain attack – i.e., a cyber-attack that corrupts IT software and uses that software as an attack vector. Supply chain attacks are dangerous because the malware is embedded inside a legitimate product, and because supply chain attacks can allow an attacker to access the networks of many organizations in a single stroke.”
For this reason, the Report further notes that “this attack confirms the importance of vigorous third party risk management, which starts with a thorough assessment of an organization’s third party risk. Third party risk management is a key part of DFS’s Cybersecurity…
