Writing credit memos, preparing board presentations, and creating public-facing communications are only a few of the ways financial institution employees use AI tools such as Chat GPT. Why? Employees have found that it makes their jobs easier and allows them to finish tasks more quickly.
There has been a significant increase in the number of visits to AI web pages such as Chat GPT over the past 12 months. CEOs may want to consider inquiring of their employees across different departments if they are using AI tools such as Chat GPT and, if so, how those tools are being used and if there is personally identifiable information (PII) that is being input into those applications (applications such as these retain ownership and use the information that is input into their applications).
The order is wide-ranging and directs agencies to set standards and best practices for fighting consumer fraud, develop advanced cybersecurity programs to find and fix vulnerabilities in critical software and improve telecom resiliency.
The order also directs agencies to ensure compliance with existing federal laws protecting against bias in underwriting and appraisals and consumer privacy requirements. Additionally, the order requires agencies to issue guidance within 180 days "to combat unlawful discrimination" resulting from AI used in decisions about housing access and other real estate transactions. 1 2
It is a CEO and board-level decision on whether the institution wants to use AI and to what extent. Discussing current and future uses of AI technology, as well as risk assessing those activities and creating policies about the use (or non-use) of AI, is going to benefit your institution.
Using Multi-factor Authentication (MFA) for access from outside the network with VPN connections and on the internal side of the network is critical for three reasons:
The Conference of State Bank Supervisors (CSBS) announced an update to the Ransomware Self-Assessment Tool (R-SAT V2). It is available for free to every financial institution on the CSBS website. 3 This tool, the second version, helps institutions assess their ransomware risks. While not a requirement, IT examiners will be looking for it. Utilizing the self-assessment tool and documenting the results in the IT committee and board meeting will help your institution get the best possible results from your next IT exam. Plus, it is free and easy, so why not do it?
Similar to Russia's invasion of Ukraine in 2022, there has been a significant increase in denial-of-service attacks against government and consumer websites, as well as an increase in cyber-attacks against industrial control systems and critical infrastructure in Israel. 4
Denial-of-service attacks are where attackers send more traffic to a website server (such as an online banking server) or other internet-facing servers than it can handle, effectively knocking it offline and making it unavailable to legitimate visitors to the site. U.S. banks were previously targeted after a successful cyber-attack was launched against Iran's nuclear program; it was suspected that the Iranian government was behind the denial of service on U.S. banks.
Unfortunately, IT staff may misidentify a slow website or down server as being from another cause rather than a denial-of-service attack. Cyber attackers can visit the dark web and find a service that will perform the attack for payment, giving almost anyone the capability to perform such an attack. Your institution likely has already been the victim of such anattack. Ask your technology team what defenses your institution has in place and for examples of how those defenses have been effective.
The United States remains the most frequent target of cyberespionage and cybercrime attacks. Out of a total of 120 attacked countries, the U.S. was the #1 attacked nation, followed by Ukraine and then Israel, according to a recent study from Microsoft. Financial services is one of the most frequently targeted sectors.
Nation-state attackers and other attackers are becoming more sophisticated at creating fake LinkedIn profiles and using this method to contact executives, posing as people within the same industry as the victims they target. The fake profile is a form of social engineering to make the recipient of a connection request feel comfortable accepting a request with malicious links associated with the fake profile.
The FBI has previously warned about romance scams and fake investment opportunists from fake LinkedIn profiles as well.
Consider these three steps when deciding to accept a new LinkedIn connection:
If you suspect a faked LinkedIn profile, you can report it here: Report fake profiles | LinkedIn Help
The Wall Street Journal reported that Clorox Company, makers of Clorox products, Glad Trash Bags, and more, was the victim of a cyberattack. The attack led to operations disruptions and product shortages on store shelves.
Clorox said the financial impact is a reduction in sales of between 23% and 28% for the quarter that ended Sept. 30. The company warned it will post a loss in the quarter instead of the nearly $150 million in profit that investors had expected, and is in the process of assessing the impact the attack will have on fiscal year 2024 and beyond. 5
Bankers are familiar with assessing credit risk; however, cyber security risk creates potential risks with corporate borrowers that may not have been previously considered. Is your institution assessing cyber risk for commercial borrowers?
The Conference of State Bank Supervisors (CSBS) previously released (2020) a version of its ransomware self-assessment tool for non-bank entities. Similar to the version for financial institutions, you may find it helpful to provide commercial borrowers with this tool to perform a self-assessment. The non-bank self-assessment tool may be found at the bottom of this CSBS web page: https://www.csbs.org/ransomware-self-assessment-tool
--
[1] FACT SHEET: President Biden Issues Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence | The White House
[2] Biden directs federal agencies to consider new regulation of AI | ABA Banking Journal
[3] Ransomware Self-Assessment Tool | CSBS
[4] Israel Sees Cyber Incursions Across Digital Systems - WSJ