Community Banking Connections

Print Article

November 2024

2024 Midwest Cyber Workshop Recap
by Kerri Koral, Senior Manager, Examinations & Inspections, Federal Reserve Bank of Kansas City

The second annual Midwest Cyber Workshop, a hybrid event held in St. Louis, took place on June 25 and 26. The event was offered to state member bankers within the Chicago, Kansas City, and St. Louis Federal Reserve Bank Districts. The annual workshop provided a forum for bankers, regulators, and industry cybersecurity professionals to connect, share information and insights, and discuss trends as well as common challenges posed by cybersecurity issues within the banking community.¹

The event included informative presentations on current themes and best practices for maintaining a safe and sound banking environment given cybersecurity capabilities and technology vulnerabilities. Participants engaged in a cybersecurity incident response simulation and listened to a variety of panel discussions featuring cybersecurity professionals representing various public and private institutions.

Governor Michelle W. Bowman set the stage for the event with recorded remarks discussing cybersecurity as a key risk to the banking industry. She highlighted the challenges and costs associated with mitigating this key risk and discussed trends in recent ransomware attacks and strong practices banks can implement to help ensure their preparedness to address cybersecurity events.² Additionally, Governor Bowman briefly highlighted Supervision and Regulation (SR) letter 23-4, “Interagency Guidance on Third-Party Relationships: Risk Management,” which provides guidance on sound practices for banks to consider for effectively managing relationships with vendors and other third-party entities.³ Day one of the workshop also featured a keynote address by Tammy Hornsby-Fink, executive vice president and Federal Reserve System chief information security officer. Drawing on her extensive career in information security, technology consulting, and leadership, Hornsby-Fink shared her perspectives on the goals and priorities of the Federal Reserve within the current cybersecurity landscape of the broader financial system.

Throughout the remainder of day one, attendees heard from individuals on three panels with various professional backgrounds within the information technology and cybersecurity fields. The first panel consisted of examiners from the three participating Reserve Banks who discussed current trends, safe and sound risk management practices, and emerging issues observed during information technology examinations across the Midwest. The second panel discussion focused on aspects of ransomware and included commentary from several Federal Reserve System professionals. Day one concluded with a law enforcement panel that included professionals from the FBI and the Cybersecurity and Infrastructure Security Agency. The panelists spoke about their individual work and priorities within their respective organizations as well as how the law enforcement agencies collaborate to share information and coordinate actions in response to cyber events.

Day two of the event featured a cybersecurity tabletop exercise led by a principal cyber consultant and lead facilitator with IBM Security X-Force Cyber Range. The session provided bankers and supervisors with a unique opportunity to put their incident response knowledge and experience into practice by discussing and prioritizing actions to take should a sudden and unexpected cyberattack or other information security–related event occur. Some key takeaways and discussion topics from the session included the importance of informing customers when the safety of their personal information could be at risk, promptly alerting a bank’s federal and state supervisors about an event causing any type of operational impact (particularly in the case of a computer-security notification event),^4,5 and working with the bank’s insurance provider when necessary and appropriate.

Also on day two, attendees heard from a professional with the Joint Cyber Defense Collaborative Industry Partnerships Team. The event concluded with a presentation from a payments risk expert with the Federal Reserve Bank of Atlanta, who discussed the unique risks that cyber events pose to payments systems and functions and the Federal Reserve’s efforts to promote safe and inclusive innovation in payments initiatives.

An added benefit of the workshop was the opportunity to network, enabling attendees to connect and exchange experiences with their peers. The event received positive feedback, and facilitators and attendees expressed interest in a third annual workshop in 2025 (date and location to be announced). Although this year’s event was offered to state member bankers across the Seventh, Eighth, and Tenth Districts, the event is just one example of industry forums that occur throughout the year across the Federal Reserve System. See the Federal Reserve Board’s website for more resources and information about cybersecurity in banking and the rules and regulations that govern this key risk area.⁶

The 2025 Midwest Cyber Workshop will be held on June 3 and 4 at the Federal Reserve Bank of Chicago.

• ¹ More information about the workshop is available at www.chicagofed.org/events/2024/midwest-cyber-workshop.
• ² See Governor Michelle W. Bowman’s June 25, 2024, opening remarks, available at www.federalreserve.gov/newsevents/speech/bowman20240625b.htm.
• ³ See SR letter 23-4, available at www.federalreserve.gov/supervisionreg/srletters/SR2304.htm.
• ⁴ See Kalyn Yzaguirre, “Requirements for Notifying Primary Federal Regulators About Computer-Security Incidents,” Community Banking Connections, Third Issue 2022, available at www.cbcfrs.org/articles/2022/i3/reporting-computer-security-incidents.
• ⁵ See SR letter 22-4/Consumer Affairs letter 22-3, “Contact Information in Relation to Computer-Security Incident Notification Requirements,” available at www.federalreserve.gov/supervisionreg/srletters/SR2204.htm.
• ⁶ More information and resources are available at www.federalreserve.gov/supervisionreg/topics/information-technology-guidance.htm.