1. Cyber Resilience
Simon Onyons
Financial Stability – Resilience Team

2. What is Cyber Risk? What are cyber risks?
The risk of attacks carried out on firms’ IT
infrastructure to defraud or disrupt their
operations through the exploitation of weakness and/or the transmission of viruses and malicious software (MalWare) via the internet or s.
The majority of attacks target the external-facing technology infrastructure which makes regulated entities internet-facing IT systems at higher risk of cyber attacks. There remains a significant risk from the ‘insider attack’.
The FCA recognise that the growing cyber risk presents a significant threat to our strategic and operational objectives and we are working to leverage the work being undertaken in response to a recommendation from the UK Financial Policy Committee to discharge our own regulatory obligations.
Background 2 2

3. Conduct Regulation and Cyber
Consumer Impact – Service Availability
Market Integrity - Data corruption or manipulation
Competition - Theft of data; M&A, new products, personal data

4. Cyber – Coordination with other bodies
UK Government and Cyber Agencies
BIS
Cabinet Office
GCHQ
National Crime Agency
CERT UK
CPNI
Government cyber initiatives: UK Cyber Strategy, BIS 10 Steps to Cyber Security, Cyber Essentials Scheme
Her Majesty's Treasury (HMT)
Recommendations
BoE
FPC
(Bank of England Committee)
FCA
MID
Recommendations
Recommendations
CMORG*
Directors Sub Group
PRA
PSR
Resilience and Cyber Sub Groups
* Cross Markets Operational Resilience Group

5. UK regulatory cyber work to date
“HM Treasury, working with the relevant Government agencies, the PRA, the Bank’s financial market infrastructure supervisors and the FCA should work with the core UK financial system and its infrastructure to put in place a programme of work to improve and test resilience to cyber attack.”
36 in-scope firms identified as the “core of the UK financial system”. Predominantly Critical National Infrastructures including Retail Banking, Investment Banking, Insurance, Exchanges and Clearing Houses
Objectives:
Enhance understanding of finance sector threat
Improve the sharing of information
Strengthen work to assess the sector’s current resilience to cyber attack
Develop plans to test sector resilience

6. Develop Testing Plans- “CBEST”
Diagnostic tool developed by the Bank of England, FCA and wider industry to support the FPC’s cyber recommendation
CBEST is a framework to deliver controlled, bespoke, intelligence-led cyber security tests
The tests replicate behaviors of threat actors, assessed by Government and commercial intelligence providers as posing a genuine threat to financial institutions
Requires interaction with the regulators from the outset – it aims to provide a transparent testing and reporting mechanism so that the regulators and regulated can collectively improve their understanding of the threats the system faces and the extent to which the UK financial sector is vulnerable to those threats
CBEST is VOLUNTARY – not mandated. Currently available only to the 36 firms in scope under the FPC recommendation

7. Develop Testing Plans- “CBEST”
Leverage official sector and commercial intelligence on most likely systemic threats e.g. state sponsored
Going beyond the BIS 10 steps to include sophisticated and persistent attack types
Testing of cyber resilience in key firms and FMIs
Will provide a holistic assessment of people, process and technology
Will mimic tactics, techniques and procedures of threat actors identified through intelligence gathering
Deliver a sector-wide assessment of resilience (and vulnerability) in the face of these threats

8. Understanding the Threat
Out-of-scope e.g. acts of war
Neg-day
Nation state / Sponsored actor
Corporate staff information and PC compromise 1 10
Data deletion
Data corruption
System unavailability 2
FPC in scope 1 3
Very high
Organised Crime / Hacktivists 1
Nation state / Sponsored actor
Network
unavailability 1
Source: Bank of England
0-day
BIS 10 Steps
High
Organised Crime
Online banking fraud 8 9
Nation state / Espionage
Data exfiltration & Espionage
Nation state / Hacktivists 4 5
Attack Complexity
Medium 7
Espionage / Organised Crime / Hacktivists
Application layer volumetric attacks
Data exfiltration 6
Nation state / Hacktivists
Hacktivists
Website defacement 9
Low
Volumetric network attacks 7
Defence maturity
Impacts
Customer impact 4
Loss of IP 7
Web services unavailable 10
Disclosed staff
credentials and data theft 1
Operational disruption 5
Market sensitive data
System impact 2
Loss of data 8
Financial loss 3
Lower confidence in accuracy of information 6
Disclosure of customer data 9
Brand impact

9. What have UK Authorities found?
High level findings, following a comprehensive thematic assessment by the FCA and the Bank of England, are:
Cyber undermines existing operational resilience arrangements.
Testing of cyber for people, processes and technology is still immature.
Business Engagement and Strategic Planning
& influencing for cyber varies widely.
Firm scale and resources impact effective
risk management.

10. What have UK Authorities found?
Articulating target states of cyber maturity is a challenge.
Cyber investment is technology
centric.
There is generally a low capability to
effectively detect cyber attacks and
identify threats.
Oversight of third party suppliers
and the supply-chain is immature.
Challenge from the third line of
defence is limited.

11. What do the UK regulators want to see?
Cyber Governance arrangements
(Mission, Vision, Strategy, Leadership)
Understanding of dependence on technology
systems and communication networks
Identification, assessment and mitigation of relevant cyber-security risks
Threat intelligence capabilities
Cyber-security incident management capabilities
Resilience measures to ensure availability of critical processes
Measures to prevent, detect and minimise social engineering attacks
Independent assurance to assess adequacy of cyber-security measures
LEAD IDENTIFY PROTECT DETECT RESPOND RECOVER LEARN

12. QUESTIONS?