NCUA Public Affairs Specialist John Fairbanks said Wednesdaythat the agency had not received any reports of credit unions beinghit with the threatened May 7 attacks.

Likewise, targeted credit unions reported no ill effects onTuesday.

Despite the threats being more bark than bite, Brian McGinley,CEO of IDT911 Consulting, a Scottsdale, Ariz.-based data riskmanagement firm that has approximately 30 credit union clients,said the inclusion of credit unions on the May 7 Anonymous targetlist should serve as a wake-up call for institutions of allsizes.

Also Read:

• Was May 7 Only a Test?
• Mixed Views in LinkedIn Poll on May 7Warning
• No Takedowns Reported Tuesday
• Anonymous May 7 Target List IncludesCUs
• Krebs: DHS Memo Says 'More Bark ThanBite'
• Threat of the Week: May 7, Ready orNot
• CO-OP Issues DDoS White Paper
• CUNA Explains Thinking BehindWarning
• Reactions Vary to May 7 Warning
• DDoS Attacks Often Fraud Diversions
• Mark Your Calendar (or Not) for May 7Attacks
• CUNA Issues May 7 DDoS Warning

Credit unions should initiate meetings with IT service providersto hammer out what communication and technical plans would beimplemented were an attack to occur, and what to expect in terms ofservice levels, he said.

“And, when you're talking about large providers serving hundredsor thousands of clients, if there is an attack, somebody needs toask who would get priority in getting back up online,” he said.

Any credit union – even those not targeted by hackers – couldsuffer what he called “collateral damage” if they share serviceproviders with an institution hit by a DDoS attack.

“That's really the key message of why these attacks aredifferent,” he said. “Since most credit unions use a third party ITsupplier, the attack, per se, goes through the provider to hitthem.”

When a DDoS attack floods a website with traffic, he explained,that traffic goes through switches that may be shared by hundredsof institutions, and all could feel the effects.

Although the attacks so far have been targeted at online bankingprograms, McGinley said they could extend to platforms that supportteller terminals, systems that open new accounts or those thatprocess loans, he said, because they are delivered through webservices.

Cloud distribution could also be subject to disruption, headded.

Corporate credit unions weren't listed a potential victims.However, Scott Hunt, the NCUA's director of the Office of National Examinations and Supervision, emailed aletter to corporate credit unions on Tuesday providing informationregarding the attacks and instructing corporates what they shoulddo if they are attacked.

In the letter, Hunt said the main May 7 anticipated attackvectors included not just DDoS, but also Structured Query Languageinjection and cross-site scripting.

DDoS attacks could peak at approximately 30 gigabits per second,and could be globally attributed, “with anticipated network spikesof up to 9 Gbps originating from Indonesian Class C InternetProtocol Address space,” his letter said.

Hunt told corporates the FBI recommends DDoS mitigationtechniques should include limiting the number of sessions from eachIPA, reducing connection timeout wait time and analyzinginfrastructure with publically available vulnerability scanningtools and patching that include the latest application and securityupdates.

“An effective configuration/patch management process provides asubstantial defense to exploitive hacker tactics like SQLi and XSSand is foundational to an effective information security programintended to assure the safety and soundness of insuredinstitutions,” Hunt said in the letter.

The chief examiner of all corporate credit unions and naturalperson credit unions with more than $10 billion in assets furthertold the corporates should they experience any significantcyber-attack activity, they should notify their NCUA districtexaminer and state regulator, if applicable.

“The will allow NCUA to take necessary steps to ensureappropriate defensive actions are taken at other credit unions,” hesaid.

Fairbanks confirmed that no corporates were targeted byAnonymous for May 7, but said because all financial institutionsare subject to cyber threats and fraudulent attempts to break in,the regulator “remains diligent in reviewing security controls atcredit unions.”