Government and Private Sector Roles in Providing Information Security in the U.S. Financial Services Industry

Abstract. The financial services sector provides an interesting case study for the proper relationship between government and the private sector in the area of information security. Financial information is attractive to thieves; the sector is pervasively and pro-actively examined and regulated; existing federal security rules impose specific process duties on financial institutions; financial regulatory agencies have exercised this authority in various ways from issuing examination guidance that have pushed the industry toward more robust online banking security procedures to using the industry's payment card industry data security standard as a measure of reasonable levels of security. This paper suggests that the legitimate roles of government range from allowing the industry to autonomously develop its own set of security practices to actively encouraging the adoption of specific security measures. However, the government should generally refrain from enshrining specific security measures in law or regulation since it can freeze innovation, lock in less effective security measures, and prevent the development of compensating controls that are less costly and equally effective. A key role should be to assist the industry to move to higher and socially beneficial levels of security in order to overcome various coordination problems that prevent natural industry forces from moving in that direction