It reads like a movie script: First, the financial services industry experiences a bout of firm-specific attacks in the form of distributed denial of service (DDoS), domain name system (DNS) poisoning, or breach of personally identifiable information (PII).   One day later, trade order processing at major exchanges and alternative trading systems (ATS) is disrupted.  On the following day, the “big one” hits: The settlement process at a clearinghouse is disrupted, causing pervasive settlement failures.  This was the scenario that market participants experienced during the Securities Industry and Financial Markets Association’s (SIFMA) Quantum Dawn 3 Cybersecurity Exercise.   SIFMA’s after-action report highlights the results of the exercise.  SIFMA identified several areas where industry participants can improve responses and coordination:

At the individual firm level

• Enhance executive leadership involvement during times of crisis.
• Firms should create integrated cyber incident response teams consisting of representatives from internal information security, technology, business functions, and required third parties to support a robust response and recovery strategy.
• Enhance internal playbooks to prepare for an expanded array of attacks, including development of additional scenario-based playbooks that account for these various types of attacks or threat vectors.

At the financial services sector level

• Enhance the role of market utilities to aid the early detection of, and response to, a crisis.
• Develop additional (or augment existing) sector playbooks to cover sector-wide events affecting market utilities.
• Strengthen communication with regulators and government agencies, and raise awareness concerning government resources and capabilities available to assist the sector.
• Promote information sharing to allow market participants to share cyberattack data, such as threat actors, common vulnerabilities and mitigation strategies.
• Establish criteria and thresholds jointly among the private sector, government agencies and regulators that will be used to trigger contact and action among them.

One takeaway for financial services industry participants appears to be that systemic cyberattack scenarios should also be considered in developing prudent cybersecurity responses. Consider the sufficiency of your incident response plan (IRP) in light of the potential that vendors, other financial services firms and key market utilities may simultaneously be coping with related cyberattacks.