NYDFS Issues Guidance on Cybersecurity Awareness During COVID-19 Crisis

The New York Department of Financial Services (NYDFS) recently issued an industry letter, providing guidance to regulated entities on cybersecurity awareness during the COVID-19 pandemic.

The industry letter highlights several areas of heightened cybersecurity risk posed by the COVID-19 pandemic, such as an increase in cybercrime and online fraud/phishing attempts.  In addition, the NYDFS states that, as required by the NYDFS’s cybersecurity regulation, regulated entities should assess such areas of heightened risk and address them appropriately.

Remote Working

• In general, regulated entities must ensure that their networks and devices are properly secured (e.g., using VPN connections that encrypt data transmissions).
• Regulated entities should be aware of the security risks involved with using personal devices to work remotely and should consider mitigating steps.
• Video/audio-conferencing applications should be configured to limit unauthorized access and employees must be given guidance on how to securely use such applications. 
• Regulated entities should also remind employees not to transmit nonpublic information through unauthorized personal accounts and devices.

Increased Phishing and Fraud

• In response to the significant increase in online phishing fraud, “[r]egulated entities should remind their employees to be alert for phishing and fraud emails, and revisit phishing training and testing at the earliest practical opportunity.”
• Regulated entities should consider updating authentication protocols, “especially for key actions, like security exceptions and wire transfers.”

Third-Party Risk

• Regulated entities should evaluate how their critical third-party vendors are addressing the new risks related to COVID-19.

The NYDFS also reminds regulated entities that covered cybersecurity events must be reported “as promptly as possible and within 72 hours at the latest.”