We’ve been on this soapbox repeatedly – critical infrastructure, energy, financial targets.  These very visible, high-value targets comprise some of the most critically sensitive operations in the industry.  Watching the news wire today, news emerged that a significant disruption caused the NASDAQ trading market to shut down for more than three hours starting at 9:20am PST.  The problem manifested itself in the quote processing system, prompting the first awareness of the issue.  The problem is reminiscent of another NASDAQ incident in May 2013 during which Facebook’s IPO was bungled due to a “software glitch”.  That incident prompted a 10 million dollar fine for NASDAQ, but more importantly a rising lack of confidence has arisen in investor sentiment surrounding the technical elements of today’s trading systems.  People have questioned whether the structure itself is flawed somehow and whether there is an overabundance of dependence on technology baked into both trading strategy and automated trading systems.  The incident also brings to mind the famous “Flash Crash” of 2010, during which the Dow Jones industrial average slipped over 1,000 points during a fifteen minute technical outage.

Particularly interesting to today’s news is that there has been a very recent history of cyber-attacks against U.S. financial institutions.  Reports of continued DDOS attacks, (Distributed Denial of Service) against banks have been heavily reported in the industry for several months now.  Several have gone on for weeks, attacking banks and credit unions across the country.  One report back in March had the one day total size of DDoS attack at 190 gigabits at one time, with 110 gigabits launched at a single institution through numerous criminally-controlled bots.  Sophisticated criminals are reportedly launching these attacks as a diversion to more damaging criminal activities as well, meaning attempts to transfer money and drain accounts are going on during this DDOS.  Stealing stock in a company is a bit further-fetched however as it is difficult for typical criminals to monetize.  What we may be looking at here is the long-forecast scenario where a group of activist hackers are executing such an attack to damage the country’s financial systems.  If you look at the effect it may be having, a continued and resurgent confidence issue could be afoot and it may be the very outcome a determined hacker group may be looking for.  Again, national vulnerabilities at play here – things that affect us every day whether you know it or not are at stake here.

Until an investigation is completed and details from that investigation, there is a vested reason to want this not to be a cyber-attack incident.  Until we know, there is a high amount of speculation, but the question of whether NASDAQ has been attacked has been raised, as it should given the precarious state of cybersecurity.  If it ends up being reported as a cyber-attack, it could mark the very public beginning of an ongoing cyber-war where you can expect continued investigation, possible retaliation, and a fortifying of cyber-security defenses.