Financial Institution Letters
April 2, 2014
Distributed Denial of Service (DDoS) Attacks
The FDIC, as a member of the Federal Financial Institutions Examination Council (FFIEC), has issued the attached statement to notify institutions of the risks associated with the continued distributed denial of service (DDoS) attacks on public-facing Web sites and the steps institutions are expected to take to address the risks posed by such attacks.
Statement of Applicability to Institutions with Less than $1 Billion in Total Assets: This Financial Institution Letter (FIL) applies to all FDIC-supervised institutions.
- DDoS attacks are continuing against financial institutions' public-facing Web sites.
- Financial institutions that experience DDoS attacks may face a variety of risks, including operational and reputation risks.
- DDoS attacks may be a diversionary tactic by criminals attempting to commit fraud.
- Financial institutions are expected to address DDoS readiness as part of their ongoing business continuity and disaster recovery plans and to take certain specific steps, as appropriate, to detect and mitigate such attacks.
- The attached statement includes references to guidance and publications to assist institutions in mitigating the risks from DDoS attacks.
- FDIC-Supervised Banks (Commercial and Savings)
- Chief Executive Officer
- Chief Information Security Officer
- Joint Statement: Distributed Denial of Service (DDoS) Attacks, Risk Mitigation, and Additional Resources - PDF (PDF Help)
- Donald Saxinger, Senior Examination Specialist, at firstname.lastname@example.org or (703) 254-0214
FDIC Financial Institution Letters (FILs) may be accessed from the FDIC's Web site at http://www.fdic.gov/news/news/financial/2014/.
To receive FILs electronically, please visit http://www.fdic.gov/about/subscriptions/fil.html.
Paper copies may be obtained through the FDIC's Public Information Center, 3501 Fairfax Drive, E-1002, Arlington, VA 22226 (1-877-275-3342 or 703-562-2200).