Financial Institution Letters

Distributed Denial of Service (DDoS) Attacks

Printable Format:

FIL-11-2014 - PDF (PDF Help)

Summary:

The FDIC, as a member of the Federal Financial Institutions Examination Council (FFIEC), has issued the attached statement to notify institutions of the risks associated with the continued distributed denial of service (DDoS) attacks on public-facing Web sites and the steps institutions are expected to take to address the risks posed by such attacks.

Statement of Applicability to Institutions with Less than $1 Billion in Total Assets: This Financial Institution Letter (FIL) applies to all FDIC-supervised institutions.

Highlights:

• DDoS attacks are continuing against financial institutions' public-facing Web sites.
• Financial institutions that experience DDoS attacks may face a variety of risks, including operational and reputation risks.
• DDoS attacks may be a diversionary tactic by criminals attempting to commit fraud.
• Financial institutions are expected to address DDoS readiness as part of their ongoing business continuity and disaster recovery plans and to take certain specific steps, as appropriate, to detect and mitigate such attacks.
• The attached statement includes references to guidance and publications to assist institutions in mitigating the risks from DDoS attacks.