FINRA Issues More Guidance on Ransomware Risk

FINRA warned firms of an increase in the volume and sophistication of ransomware attacks.

In new guidance, FINRA explained that the increase of ransomware incidents was due to (i) firms' ever-increasing reliance on technology, which results in more targets for bad actors; (ii) the continued adoption of cryptocurrencies by bad actors as a form of payment that conceals identity and (iii) the dark web's proliferation of "Ransomware-as-a-Service" malware which has become more available to less sophisticated bad actors.

FINRA stated that firms must "implement strategies that include maintaining security with multiple layers of defense." In the guidance, FINRA offered a series of questions to prompt firms to evaluate their cybersecurity controls addressing ransomware risks. The questions cover:

• governance and risk assessment;

• asset management inventory;

• technical preventive and detective controls;

• social engineering and phishing;

• third-party vendors;

• branch controls;

• backups and recovery; and

• incident response.

FINRA said that firms should consider whether ransomware attacks may require reporting pursuant to FINRA Rule 4530 ("Reporting Requirements") and reminded firms to immediately report ransomware attacks to law enforcement and to file FINRA Suspicious Activity Reports ("SARs").