Transcript: CFTC Staff to Hold Roundtable on Cybersecurity And
Total Page:16
File Type:pdf, Size:1020Kb
UNITED STATES OF AMERICA COMMODITY FUTURES TRADING COMMISSION STAFF ROUNDTABLE ON CYBERSECURITY AND SYSTEM SAFEGUARDS TESTING Washington, D.C. Tuesday, March 18, 2015 2 1 PARTICIPANTS: 2 VINCENT McGONAGLE CFTC 3 TIMOTHY MASSAD 4 CFTC 5 J. CHRISTOPHER GIANCARLO CFTC 6 PHYLLIS DIETZ 7 CFTC 8 SUSAN STEWART CFTC 9 JAMES ORTLIEB 10 CFTC 11 ROBERT WASSERMAN CFTC 12 DAVID TAYLOR 13 CFTC 14 MICHAEL DANIEL White House 15 WILLIAM NELSON 16 FS-ISAC 17 BRIAN PERETTI FBIIC 18 MARK CLANCY 19 DTCC 20 LEO TADDEO FBI 21 GERARD BRADY 22 MORGAN STANLEY 3 1 PARTICIPANTS (CONT'D): 2 STEVEN CHABINSKY CrowdStrike 3 MURRAY KENYON 4 NSA 5 DAVID GARLAND CME Group 6 GREG GIST 7 CitiGroup 8 CHRISTOPHER KINNAHAN FBIIC 9 DAVID LaFALCE 10 DTCC 11 RANDY SABBAGH Schwab Technology 12 JOHN RAPA 13 Tellefsen & Co. 14 KEVIN GREENFIELD Office of the Comptroller of the Currency 15 DAVE EVANS 16 Bank of England 17 JERRY PERULLO ICE 18 THOMAS MILLAR 19 US-CERT/DHS 20 RONALD ROSS NIST 21 RYAN LIBEL 22 CME Group 4 1 PARTICIPANTS (CONT'D): 2 ANN BARRON-DiCAMILLO US-CERT/DHS 3 4 5 * * * * * 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 5 1 P R O C E E D I N G S 2 (9:08 a.m.) 3 MR. McGONAGLE: Good morning, everyone. 4 Welcome to the Staff Roundtable hosted by the 5 Divisions of Market Oversight and Clearing and 6 Risk. The topic for today is cybersecurity and 7 system safeguards testing; and we have some 8 introductory remarks from our Chairman. 9 MR. MASSAD: Well, good morning, 10 everyone. Thank you for being here; thank you, 11 Vince. I think we all know that cybersecurity is 12 the most important single issue facing our markets 13 today in terms of market integrity and financial 14 stability. The need to strengthen the security 15 and resilience of our financial markets against 16 cyber attacks is clear. And the examples of cyber 17 attacks unfortunately are all too frequent and 18 familiar, whether it's JP Morgan or Home Depot, 19 Target, Sony, both within the financial sector and 20 outside. Some of our nation's exchanges have been 21 hit or suffered other technological problems that 22 have caused outages or raised concerns. And 6 1 because of the interconnectedness of financial 2 institutions and markets, an attack in one place 3 can obviously have significant repercussions 4 throughout the system. And I guess what's most 5 concerning to many of us is that, while we know 6 some of these attacks are motivated by people 7 whose aim is commercial profit, some are clearly 8 motivated with the aim of simply to disrupt or to 9 even shut down services. 10 Now, we at the CFTC have responded in a 11 number of ways. We have incorporated 12 cybersecurity standards into our regulations, our 13 core principles now include them, we've required 14 clearing houses and exchanges to maintain system 15 safeguards and risk management programs, to notify 16 us promptly of incidents, to have recovery 17 procedures in place. And we've also made this a 18 priority in our examinations. But, you know, the 19 responsibility for cybersecurity obviously rests 20 with private institutions. As a government 21 agency, we can set standards, we can engage in 22 examinations, but it is up to the private 7 1 institutions that run critical financial 2 infrastructure to do the daily comprehensive work 3 that's required. And that's especially true when 4 it comes to testing. Testing that some would say 5 only works when the institution fails, meaning 6 when it is pushed to the point that you truly 7 identify weaknesses or a penetration occurs so 8 that then you can remedy a problem. 9 And that brings us to today's Round 10 Table discussion. So we are seeking industry and 11 government views on cybersecurity matters, but in 12 particular, on systems testing. The staff is 13 interested in the panelists' thoughts on what 14 constitutes effective and adequate risk analysis 15 in testing by exchanges and clearing houses in 16 particular. And we also want to hear thoughts on 17 what should our role be in promoting testing. Can 18 the agency contribute to cyber readiness by 19 establishing more detailed standards for systems 20 testing? And how do we make sure those standards 21 truly add value to cyber readiness and not simply 22 more work for IT specialists? 8 1 So we're delighted to have you here. I 2 want to thank the panelists, in particular, for 3 contributing their time and expertise. I want to 4 thank our staff for all their hard work in putting 5 this together, and I look forward to today's 6 discussion. And let me -- I think Commissioner 7 Bowen is -- did she want to say -- she stepped out 8 but I know Commissioner Giancarlo wanted to say a 9 few words. 10 MR. GIANCARLO: Thank you, Chairman. 11 Good morning, everyone. Today's Round Table is 12 timely and critically important. Working to make 13 U.S. derivative markets more resilient to cyber 14 attacks is essential to the mission and oversight 15 of the CFTC. And I commend the leadership on this 16 issue by each of my three fellow Commissioners, 17 starting with Commissioner Wetjen, for drawing 18 attention to the issue during his tenure as Acting 19 Chairman, and to Commissioner Bowen in her work in 20 establishing the Market Risk Advisory Committee 21 that has identified this issue as a key part of 22 its mandate. And to you, Chairman Massad, for 9 1 making cybersecurity a Commission priority. 2 I'm interested today to hear from 3 numerous experts on the panels and I thank them 4 for their preparation and their participation, and 5 I thank the staff as well for putting together a 6 terrific panel today. I hope to learn about the 7 range and nature of cyber threats, from cyber 8 crime and vandalism, to terrorism and outright 9 cyber warfare against U.S. and global capital 10 markets. I'm interested to hear about the latest 11 defensive tactics and emerging best practices for 12 market participants in this rapidly evolving and 13 morphing area. And I'm interested to explore how 14 we best balance effective cybersecurity of 15 execution venues and clearing houses without 16 sacrificing marketplace vibrancy and fair access 17 to trade execution and clearing. 18 And I apologize in advance that during 19 the course of the day I may need to step out to 20 take care of some business, but I will try to be 21 here for a good portion of the day for this very 22 important program. 10 1 I thank you all. 2 MR. McGONAGLE: Thank you, Commissioner. 3 I'll turn it over to Bob for the first panel. 4 MR. WASSERMAN: So first I'd like to 5 thank Chairman Massad and Commissioner Giancarlo 6 for those remarks. I'd also like to thank 7 everyone for coming today, in particular our 8 panelists. We have, I think, an extremely 9 talented group of panelists here and I expect that 10 today's discussions will be of considerable 11 assistance to the staff as we work to develop 12 proposals to strengthen our rules regarding 13 testing to protect our regulated infrastructures 14 against cyber threats. 15 I'd like to start with some very 16 important administrative announcements. First, as 17 a public service, we have Wi-Fi available. 18 Instructions are available on the written agendas 19 that are on the table near the door as you came 20 in. We will, during the course of today's 21 proceedings, be taking written questions from the 22 audience in this room and we will endeavor to 11 1 insert some of those questions toward the end of 2 each panel. You should find a note card on your 3 chair, and there are additional note cards on the 4 table near the door. If you will please write 5 your questions down as legibly as possible and 6 pass the card down the row to one of my colleagues 7 who will periodically be coming to pick those up. 8 Restrooms are outside this room to your right as 9 you leave, and then at the end of the space to 10 your left. We have some limited quantities of 11 coffee and tea in the back as well as water. 12 Panelists, if you could please press the 13 button to activate your microphone when you speak. 14 This Round Table is being audio cast to folks who 15 are calling in and they can only hear you if the 16 microphone is on. And if you forget to turn it on 17 you may see me pointing at my ear to remind you. 18 On the other hand, please turn your microphone off 19 when you stop speaking, as we can only have a 20 limited number of them on at a given time. 21 Finally, if you use abbreviations or technical 22 terms, please explain them the first time you use 12 1 them, as some of us are a bit less familiar. 2 I should note that while my colleagues 3 and I will be asking questions and may express 4 tentative views, anything any of us says 5 represents at most only our personal views and 6 does not represent the view of the staff as a 7 whole or of the Commission.