|
Bridge Collapse
The Trump administration wants to slash more than $700 million from the Cybersecurity and Infrastructure Security Agency (CISA) — and some worry this could leave community banks with fewer resources to fight bad actors.
The proposed 26% cut comes on the heels of $135 million in spending reductions approved by Congress last year, bringing CISA’s budget to $2.7 billion. According to the budget proposal, the White House wants to eliminate alleged inefficiencies and censorship, and return the agency to its core mission of “enhancing the security and resilience of critical infrastructure.”
Banks are part of that critical infrastructure, but running a leaner CISA could prove damaging. CISA provides information to groups such as the Financial Services Information Sharing and Analysis Center (FS-ISAC), a member organization that financial firms use for threat intelligence, says Steve Sanders, chief risk officer at the technology provider CSI. Last year, CISA cut funding to the nonprofit Center for Internet Security; a number of community banks rely on the center’s control framework, he says. CISA also plays an important role in coordinating federal response when a major cyber incident occurs.
If the cuts are approved by Congress, they would come as the ongoing conflict in Iran has elevated potential threats. “Let's suppose that Iran, or a hacking group associated with Iran, launched a large-scale attack [on] banks all across the country,” says Sanders. “Who's going to coordinate that [response]?”
Sanders hopes banks will call their congressional representatives. But bank leaders should know what they’ll do to protect their institutions by reviewing their options for threat intelligence, revisiting their incident response plans and beefing up documentation. He also thinks banks should revisit their budgets for cybersecurity resources.
“The weakening of CISA is not theoretical right now. Staff losses have happened; programs have been cut,” Sanders says. He likens the reductions to removing the support structures that hold up a bridge. While the bridge may appear safe, it’s more prone to collapse. “If I were leading information security at a bank, I would be looking to see how I could be demonstrably protected.”
• Emily McCormick, vice president of editorial & research for Bank Director
| 
