A new portal will allow FINRA-members to share intelligence about cybersecurity woes and coordinate responses.
As Shakespeare noted in Henry IV, Part 1, discretion is the better part of valor, which, translated, means it’s better to be safe than sorry. This is especially true when it comes to cybersecurity protections.
Grygo is the chief content officer for FTF & FTF News.
Major geopolitical events have been making financial services firms anxious about an acceleration in cyberattacks. In response, the Financial Industry Regulatory Authority (FINRA), the self-regulatory organization (SRO) for U.S. broker-dealers, has launched the Financial Intelligence Fusion Center (FIFC), a portal for FINRA-member firms “to share timely intelligence about cybersecurity and fraud threats and coordinate responses.”
The key is sharing information about cyber-attacks and how they happened, rather than hiding the fact that the security breaches occurred. In fact, FINRA officials say the SRO “is uniquely positioned to work with its member firms to better protect investors and mitigate risk to the securities industry.”
The strategic focus of the portal is to:
- “Share comprehensive threat intelligence insights curated for the broker-dealer community with participating member firms through the FIFC secure portal;
- Intelligence is sourced from both internal and external sources to enhance the industry’s collective defense;
- Facilitate discreet information sharing about emerging threats. Sharing is done without attribution to ensure privacy and anonymity for firms.”
The FIFC “will collect, analyze, and disseminate threat intelligence to bolster member firms’ awareness and ability to quickly respond to these threats. The FIFC will also leverage FINRA’s existing partnerships, enabling input from other government and private sector partners,” according to FINRA officials. “The platform was developed as part of FINRA Forward, a series of initiatives to further improve FINRA’s effectiveness and efficiency in achieving its mission of protecting investors and safeguarding market integrity.”
Pilot-testing of the FIFC started last year, “with a diverse group of member firms, whose participation and feedback have helped strengthen the portal’s functionality and effectiveness for member firms of all sizes. Through the pilot program, member firms have accessed FINRA’s threat intelligence products and actively shared cybersecurity and fraud threat intelligence via the FIFC, enabling timely threat mitigation. FINRA encourages member firms to opt into the FIFC to gain access to this centralized portal for intelligence sharing among firms and FINRA,” according to the announcement.
The FIFC will also provide FINRA members with “guidance for establishing cybersecurity programs, addressing vulnerabilities, combating cyber-enabled fraud and identifying emerging scams, among others,” officials add.
“The FIFC is available to FINRA member firms and their affiliates. Access is granted by your firm’s Super Account Administrators (SAA), entitling users through FINRA Gateway,” according to FINRA.
As for preserving the privacy aspect of sharing information, anything shared by a member firm “via the FIFC portal will not be made public. FIFC-published analyses and alerts will not be attributable to specific member firms. FIFC is committed to maintaining confidentiality,” according to FINRA. “Based on feedback, the FIFC is considering implementing an anonymous submission option to build trust and encourage sharing. At present, any information included in FIFC intelligence products or alerts will be anonymized and not attributable to individual firms’ submissions.”
For the future, FIFC “is considering several enhancements and will continue collaborating with member firms to enhance the portal. Some of the suggested enhancements include: API [application programming interface] integration with workflow tools; and increased alert and notification customization capabilities,” FINRA says.
While the FIFC portal is likely to evolve, one thing that the FIFC does not replace is regulatory reporting or filings.
“FIFC is a voluntary information-sharing hub. Any information shared by member firms through the FIFC portal does not relieve firms of any existing obligations under federal securities laws, regulations or FINRA rules, including regulatory filing or reporting obligations. Member firms with questions about filing or reporting requirements should contact their risk monitoring team,” FINRA notes.
Is your company featured in this article? Contact us about reprints or licensing.
