• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar
  • Skip to secondary sidebar

Alston & Bird Privacy, Cyber & Data Strategy Blog

  • Home
  • Services
  • Events
  • Contacts

NYDFS Issues Guidance on Multi-Factor Authentication

December 14, 2021 By Kim Peretti, Kate Hanniford and Kristen Bartolotta

The New York Department of Financial Services (NYDFS) continues to refine its position regarding the importance of and requirements regarding Multi-Factor Authentication (MFA), as evidenced most recently with the release of new guidance. This new guidance is consistent with its June guidance, in which NYDFS clarified its expectation that NYDFS-regulated covered entities subject to 500.12 implement MFA for any individual accessing the covered entity’s internal networks, externally exposed enterprise applications, and third-party applications from an external network.

The June guidance was released when the rate of ransomware attacks was rapidly increasing and reflected NYDFS concerns regarding ransomware’s potential to destabilize the financial system. Now, NYDFS has identified the lack of MFA as a specific and significant weakness of financial organizations and further clarifies its explicit requirement for this “essential control.”

NYDFS is using all tools at its disposal to address gaps in MFA coverage at covered entities, including through guidance, examinations, and enforcement. Since the Cybersecurity Regulation went into effect in 2017, according to NYDFS, MFA weaknesses have been “the most common cybersecurity gap exploited” at financial services companies. From January 2020 to July 2021, NYDFS found that more than 18.3 million consumers were impacted by cyber incidents reported to the Department in which Covered Entities experienced MFA failures. While MFA–or reasonably equivalent or more secure compensating controls–have been consistently required by NYDFS since the inception of 23 NYCRR 500, in the last year the Department resolved two enforcement actions against companies that were required to implement MFA but had not done so. The Department has also announced that it is increasing its review of MFA during the examinations cycle. NYDFS’ focus in the examinations context will be on the common weaknesses described below, but the Department will also want to know whether Covered Entities have MFA for privileged accounts, use token-based or push-based MFA (with a stated preference for token-based), and have a process for regular testing and validation of MFA. Based on past guidance, enforcement actions, and the anticipated scrutiny during the examinations process, NYDFS appears to have laid the groundwork for additional enforcement actions in the future.

Common Weaknesses in Use of MFA

NYDFS notes the following as the most common weaknesses in MFA that are violations of the Section 500.12 requirement:

  1. Legacy systems that do not support MFA: When outdated applications and systems do not support MFA, a Covered Entity can find itself in violation of the MFA requirement. It is important to keep an inventory of IT assets and ensure that they are either protected by MFA or decommissioned if no longer in use. Exploitation of a lack of MFA is most often seen in Microsoft email services and entities should elect modern authentication over basic authentication when using Microsoft’s email services.
  2. MFA for remote access fails to cover all applications: Even when a Covered Entity has MFA for remote access, there may be applications such as email that can be accessed without VPN or other remote access tools. MFA must be in place for all systems, including those that can by accessed without a VPN.
  3. Lack of MFA for third parties with access to an internal network: Covered Entities must require MFA or the use of a reasonably equivalent control for all third parties (including independent insurance agents) accessing information systems with nonpublic information.
  4. Incomplete or slow MFA rollouts: When an MFA setup or rollout is incomplete or slow, gaps may be left in the MFA coverage. Additionally, Covered Entities should avoid MFA “self-setup” and designate one or more individuals to oversee the granting of remote access permission and configuration.
  5. Poor exceptions management: Covered Entities should establish a clear policy on MFA exceptions and have a plan for strict enforcement of that policy. Exceptions should be granted sparingly and should be regularly reviewed to ensure they do not last longer than necessary.

Although NYDFS took pains to recognize the difficulties cybersecurity can present for small businesses in the guidance, it nevertheless has held fast to its position regarding the importance of MFA implementation, in part due to the ongoing threat landscape. As cited by NYDFS, the U.S. Small Business Administration noted that small businesses are being aggressively targeted for their valuable information and lack of security infrastructure. To assist small and medium sized businesses with cybersecurity controls, NYDFS has partnered with the Global Cyber Alliance (GCA) to promote GCA’s Cybersecurity Toolkit for Small Business which includes step-by-step instructions for implementing MFA in applications often used by small businesses.

Filed Under: Cybersecurity, Data Protection, Data Security, Enforcement, NYDFS Tagged With: cybersecurity

About Kim Peretti

A former DOJ cybercrime prosecutor and former director of PwC's cyber forensics group, Kim delivers top of the line cyber risk management and information security counsel to her clients. As co-leader of our Privacy, Cyber & Data Strategy Team, Kim is recognized by select publications and is frequently quoted by the media.

[Read Bio]

About Kate Hanniford

Kate Hanniford is a senior associate with Alston & Bird’s Privacy, Cyber & Data Strategy Team. . She focuses her practice on cybersecurity counseling, as well as federal securities law compliance, enforcement, and litigation.

[Read Bio]

About Kristen Bartolotta

Kristen Bartolotta is an associate in Alston & Bird’s Privacy, Cyber & Data Strategy Team. She advises clients on managing privacy and cyber risk, breach investigations and response, transactional diligence, and emerging technologies. Kristen also advises on privacy and security compliance at the state, federal, and international levels.

[Read Bio]

Primary Sidebar

This blog is a service of Alston & Bird’s Privacy, Cyber & Data Strategy team and focuses on key data privacy and data security issues.


Receive email notifications when new posts are added.

Receive email notifications when new posts are added.


THE DIGITAL DOWNLOAD
Click here to see the editions

PRIVACY & CYBER EVENTS
Click here to see upcoming and past events

PRIVACY & CYBER MAILINGS
Click here to sign up

@ALSTONPRIVACY
Click here to follow us on Twitter

Secondary Sidebar

Categories

Recent Posts

  • The California Privacy Protection Agency Solicits Public Input on Forthcoming Privacy Regulations
  • U.S. Department of Commerce Announces the Establishment of a Global CBPR Forum
  • Colorado Issues Pre-Rulemaking Considerations for the Colorado Privacy Act
  • Recent Updates in Two Closely-Watched Cybersecurity and Privacy-Related Securities Fraud Class Actions
  • EU and U.S. Reach Agreement In Principle on a Replacement for the EU-U.S. Privacy Shield
Copyright © 2022 · Alston & Bird · All Rights Reserved. Privacy.