Eleven major banks including Bank of America and Goldman Sachs face $1.8 billion in fines for failing to monitor employees using WhatsApp and iMessage for business. CISOs now own the problem of controlling personal devices and enforcing record-keeping, requiring coordination across security, privacy, IT, and legal teams.
Chapters
$1.8 billion in fines. Do I have your attention yet? The finance sector is surely paying attention as some of the world's largest banks and brokerages will collectively pay $1.8 billion in fines to the Security and Exchange Commission and the Commodity Futures Trading Commission. They're doing this for failing to maintain the required electronic communication records necessary for oversight website purposes. This is no trivial amount, and future fines for non-compliance are likely to be even more significant. These situations often occur when employees, sometimes even at the direction of their superiors, communicate business-related information using applications and services which are not overseen by the company. Often on their personal phones. Applications like WhatsApp and Apple iMessage have been specifically cited. There have been documented cases where employees were told or decided themselves to delete these conversations to keep them from regulators or legal discovery. In one quote, uh, one trader said, "We use WhatsApp all the time, but we delete the convos regularly." This is a huge issue, and this is definitely not complying with the rules for oversight. I expect the CISOs will now be tasked with controlling the situation by prohibiting such applications from being used and somehow detecting or preventing employees from sending work messages through their personal devices. It's a complex ask with legal and privacy and work productivity ramifications. In the latest rounds of announcements, 11 major financial institutions have agreed to pay the SEC and CFTC fines of $1.8 billion. Big names like Bank of America, Barclays, Citigroup, uh, Credit Suisse Group, uh, Deutsche Bank, uh, Goldman Sachs, Morgan and UBS are among those being fined. And those are 11 huge powerhouses. So it's not just small companies, medium companies. It's not just, uh, a limited issue. This is pervasive. Absolutely. And ultimately, companies, yes, must use a combination of technology, behavioral, and process controls to prohibit unauthorized communication tools and ensure messages are complying with longstanding recordkeeping rules. This is absolutely gonna fall on the shoulders of the chief information security officers, and they're gonna need to work very closely with their privacy, IT, and legal colleagues to make this happen. Cyber risks in this space are not just about breaches anymore. It's about control of access and integrity of data. Such tremendous fines will have a ripple effect on the finance and perhaps other regulated industries like healthcare, who please, I hope you're listening. These impacts are greatly going to expand the expectations of CISOs and what they have to address. And for some, they're probably already working on this. For others, this is entirely new territory. So to my CISO brethren out there, be ready for this. If you're not already, please start the discussions now with the executives, with the board, to define clear goals and prioritizations. You can't do everything all at once. We need clear guidance here. And at the same time, you need to secure the necessary resources for sustaining success. Thank you for watching. And if you like this video, be sure to click the like button. For more strategic insights and discussions, follow me on the Cybersecurity Insights channel.
