The FISMA Focus IPD

Last week, a US federal court indicted a Russian hacker named Aleksandr Kalinin for allegedly hacking into the NASDAQ stock exchange. Kalinin had access to two NASDAQ servers for a couple of years between 2007 and 2010, and during that time was able to enter commands to change and delete data. The case has heightened fears that the next time a trading system is hacked—which is becoming pretty common—rogue programmers could cause a financial collapse. The good news is that the US government has recently drafted a plan to combat stock exchange hackers. The bad news, experts say, is that the government’s plan is not going to help much.

The government’s anti-hacking plan comes in the form of a regulation recently proposed by the Securities and Exchange Commission (SEC), a Wall Street regulator. The rule would require exchanges, including NASDAQ, the New York Stock Exchange, and the Chicago Mercantile Exchange, to ensure that their trading technologies adhere to a set of standards that the SEC has for two decades urged exchanges to adopt voluntarily. It would force exchanges to conduct stress tests of their core technology, submit to regular system reviews to identify vulnerabilities to hackers, and draft recovery plans in case of security breaches. But financial reform advocates, software security experts, and cybersecurity gurus say the rule is far too weak to provide any meaningful protection against cyber criminals.

The way that the SEC defines whether an exchange is actually adhering to the regulation is too vague, says Dennis Kelleher, the president of Better Markets, a financial reform group. Instead of laying out specific requirements for system reviews, for example, the SEC “defer[s] to unspecified practices and standards set by other regulators or ‘widely recognized’ organizations,” Kelleher wrote in a letter to the agency. Without clearer language, Kelleher worries, exchanges could comply with the letter of the regulation without making any meaningful security upgrades. (The SEC declined to comment for this story.)

The vagueness of the proposed SEC rule also means that it won’t require real security testing of exchange software, warns Bill Curtis, director of the Consortium for IT Software Quality, an industry group that develops software quality standards. Instead, Curtis says, exchanges will be able to get away with a mere functional test of the technology, to make sure “it computes the thing I’ve asked it to compute,” Curtis says. Unfortunately, Curtis notes, testing whether a piece of software works is not the same as testing whether it is vulnerable to hackers.

The financial industry, which hates the proposed rule, may be able to weaken it even further. In letters submitted to the SEC, the New York Stock Exchange and the Chicago Mercantile Exchange warned that the rule will “cost significantly more than any derived benefit.” Both the Financial Industry Regulatory Authority, a private corporation that oversees the NYSE, and the Securities Industry and Financial Markets Association, the leading securities industry trade group, say that the SEC’s anti-hacking measures are overly broad and should be scaled back.

Ultimately, it may not matter all that much whether the industry gets its way and weakens the regulations, says Steve Surdu, a vice president at the cyber-security firm Mandiant, because “policy is never sufficient to secure your environment,” Surdu says. While cybersecurity experts agree that new security regulations will do some good, when you’re dealing with trading systems that are massive and complex, it’s impossible to imagine all the security precautions that are necessary, let alone enforce them, Surdu says: “The NASDAQs of the world—they have large infrastructure, there are many systems…there are changes in the environment all the time…and the bad guys only need to find one lapse to take advantage of it.”

It’s hard to outfox a hacker, agrees Alyssa Hutnick, a partner at the law firm Kelley Drye, which represents clients in computer protection cases. “Yes, it’s reasonable to have a written information security program and risk assessment program,” she says, but that’s more to “make people feel good,” she jokes. “It’s a whack-a-mole issue…Whatever [hackers] were doing last month is not what they’re doing today, and not what they’re going to be doing next month.”

The best way to outsmart a potential stock exchange hacker, Surdu says, would be to “isolate yourself physically” from the internet—”which is not possible” for exchanges.

All this to say we could easily be careening towards a hacker-induced financial disaster. “There’s an awful lot of confidential information in those systems,” Curtis says. “If they can get in there and can crack into these systems and get into trading and get into your accounts, they can start doing all kinds of things…to disrupt markets…and create mayhem.”

Read Complete Article