Technology Alert: OpenSSL "Heartbleed" Vulnerability

Summary:

The FDIC, as a member of the Federal Financial Institutions Examination Council (FFIEC), is issuing the attached alert advising financial institutions of a material security vulnerability in OpenSSL, a popular cryptographic library used to authenticate Internet services and encrypt sensitive information.

Statement of Applicability to Institutions with Less than $1 Billion in Total Assets: This Financial Institution Letter (FIL) applies to all FDIC-supervised institutions.

Highlights:

• OpenSSL is an open-source implementation of the Secure Sockets Layer and Transport Layer Security protocols. Financial institutions may use OpenSSL in common network services such as Web servers, email servers, virtual private networks, instant messaging, and other applications.
• A significant vulnerability has been found in OpenSSL that could allow an attacker to decrypt, spoof, or perform attacks on network communications that would otherwise be protected by encryption.
• The FDIC expects financial institutions to upgrade vulnerable systems as soon as possible, following appropriate patch management practices.
• Financial institutions should monitor the status of their third-party service providers and vendors' efforts to implement patches on software that uses OpenSSL and to take the following steps, as appropriate:
  • Ensure that third-party vendors that use OpenSSL on their systems are aware of the vulnerability and take appropriate risk mitigation steps.
  • Monitor the status of their vendors' efforts.
  • Identify and upgrade vulnerable internal systems and services.
  • Follow appropriate patch management practices 1and test to ensure a secure configuration.
• Examination guidance and additional information on patch management, software maintenance, and security updates can be found in the following FFIEC IT Examination Booklets:
  • Development and Acquisition
  • Information Security 
  • Operations

Suggested Distribution:

• FDIC-Supervised Banks (Commercial and Savings)

Suggested Routing:

• Chief Executive Officer
• Chief Information Office
• Chief Information Security Officer

Paper copies may be obtained through the FDIC's Public Information Center, 3501 Fairfax Drive, E-1002, Arlington, VA 22226 (1-877-275-3342 or 703-562-2200).

Additional Related Topics:

• FFIEC IT Examination Handbook
• U.S. CERT, OpenSSL "'Heartbleed"' Vulnerability (CVE-2014-0160)
• U.S. CERT, "Heartbleed" OpenSSL Vulnerability

• 1

  Patch management, software maintenance, and security update practices are covered by a number of FFIEC IT Examination Handbooks including Development and Acquisition, Information Security, and Operations.