US updates cyber security policies
Washington, July 15: The US Federal Deposit Insurance Corporation is updating cyber security policies after a 2015 data breach in which a former employee kept copies of sensitive information on how banks would handle bankruptcy, the regulator's chief said on Thursday.
FDIC Chairman Martin Gruenberg also said he made personnel changes after receiving a report in 2013 informing him that he had not been fully briefed about the major compromise of the regulator's computers by a foreign government in 2010 and 2011.
Gruenberg made the comments in prepared remarks for a hearing of the US House of Representatives committee that on Wednesday said in a report that the FDIC covered up the 2010- 2011 hacks, which the panel said also occurred in 2013 and were likely orchestrated by the Chinese government.
The FDIC is a major US banking regulator that keeps confidential data on America's biggest banks.
Staff from the House Science, Space and Technology Committee said a witness told them the cover- up was intended to avoid endangering Gruenberg's pending confirmation to his post by the US Senate.
The committee criticized the FDIC’s handling of more recent data breaches including the copying by an employee of data on “resolution plans,” which are also known as “living wills” and detail how America's biggest financial institutions would wind themselves down if they failed.
The employee copied information on resolution plans onto a thumb drive immediately before leaving the FDIC, and the incident was detected shortly afterward in September 2015, Gruenberg said, laying out a timeline that had already been disclosed by other FDIC officials. The thumb drive was recovered in December 2015.
Gruenberg said policy changes were being taken to address such “insider threats.”
“A team of executivelevel staff will finalize the FDIC’s insider threat program policy statement and governance structure by October 28, 2016,” Gruenberg said.