Cyber Security in a Risk Management Framework Gary King Senior Risk Analyst, Capital Markets - Africa and Middle East April 2018 © Thomas Murray Data Services 2018 03/05/2019

What do you understand about Cyber Security? Introduction What do you understand about Cyber Security? How to create a secure password How to spot a dangerous E-mail How to protect against identity theft System testing How to treat Cyber Security as part of a full end-to-end risk framework??? © Thomas Murray Data Services 2018 03/05/2019

Risk Management Categories Overarching Components Agenda Key Documents Risk Management Categories Overarching Components © Thomas Murray Data Services 2018 03/05/2019

Key Documents CPMI-IOSCO and BIS CPMI-IOSCO G7 International Standards Key Documents Guidance on Cyber Resilience for Financial Market Infrastructures – June 2016 CPMI-IOSCO and BIS Principle for Financial Market Infrastructures (PFMIs) - April 2012 CPMI-IOSCO Fundamental Elements of Cyber Security for the Financial Sector G7 © Thomas Murray Data Services 2018 03/05/2019

Introduction Guidance Components © Thomas Murray Data Services 2018 03/05/2019

Risk Management Governance Sound Governance is key! The arrangements an FMI has put in place to establish, implement and review its approach to managing cyber risks Sound Governance is key! Cyber is more than just ICT Consistency with Enterprise Risk Management International and National standards Role of the Board and Senior Management Audits and Compliance © Thomas Murray Data Services 2018 03/05/2019

Understand your internal situation! Risk Management Identification Areas where an FMI should identify and classify business processes and information assets as well as external dependencies Business functions and processes Information assets and related access Regular review and update Understand your internal situation! Impact from and on the FMI Not just participants How are you interconnected with third parties? © Thomas Murray Data Services 2018 03/05/2019

Protection of processes and assets: Risk Management Protection How FMIs should implement appropriate and effective measures in line with leading cyber resilience and information security practices to prevent, limit or contain the impact of a potential cyber event. Protection of processes and assets: Protective Controls Resilience by design Layered Protection Interconnection Risk Participation requirements Service Provider agreements Insider Threats Security analytics Employment status changes Access control Training Staff High-risk groups © Thomas Murray Data Services 2018 03/05/2019

Continuous Monitoring Risk Management Detection An FMI’s ability to recognise signs of a potential cyber incident, or detect that an actual breach has taken place. Real time or near real time Comprehensive scope Continuous Monitoring Defence-in-depth approach Delay or disrupt any attack in progress Multi-Layered detection controls © Thomas Murray Data Services 2018 03/05/2019

Incident response, resumption and recovery Risk Management Response and Recovery An FMI’s capabilities to respond to and recover from cyber attacks Incident response, resumption and recovery Investigate! Contain! Recover! Two hour RTO Contingency plan Test it all! Are systems and processes designed to limit impacts, resume activities and ensure data integrity? Work together with the market © Thomas Murray Data Services 2018 03/05/2019

Overarching Components Testing All elements of a cyber resilience framework should be rigorously tested to determine their overall effectiveness before being deployed within an FMI, and regularly thereafter. Coordinate and Test all aspects of the framework Use the results Methodologies and Practices Vulnerability Assessment (VA) Scenario-based testing Penetration tests Red team tests © Thomas Murray Data Services 2018 03/05/2019

Situational Awareness Overarching Components Situational Awareness An FMI’s understanding of the cyber threat environment within which it operates, the business implications of being in that environment and the adequacy of its cyber risk mitigation measures. Cyber Threat Intelligence Identify potential threats Use a wide source of information Gather and analyse information Use information effectively Don’t work alone! – Share your information and expertise Local stakeholders / market participants Cross-industry Cross-border © Thomas Murray Data Services 2018 03/05/2019

Never stop learning! Overarching Components Learning and Evolving An FMI’s cyber resilience framework needs to achieve continuous cyber resilience amid a changing threat environment. Lessons from cyber events Monitor technological developments Predictive Capabilities Use of Metrics for Benchmarking Never stop learning! © Thomas Murray Data Services 2018 03/05/2019

THANK YOU © Thomas Murray Data Services 2018 03/05/2019