SAMA published the Financial Entities Ethical Red Teaming Framework, in an effort to address the increasing cyber risks. The framework is intended as a guide to prepare and execute controlled cyber attacks against the production environment, without exposing sensitive information, with the help of certified and experienced Red Teaming Providers. The framework aims to share intelligence and information obtained during testing to further improve cyber resilience in the financial sector in Saudi Arabia. The framework applies to all member organizations in the financial sector regulated by SAMA.
The principal objective of the framework is to provide guidance on how to conduct the red teaming activities and how to test the detection and response capabilities of a member organization against real sophisticated and advanced attacks and enhance the knowledge of the involved stakeholders. The framework consists of four phases—preparation phase, scenario phase, execution phase, and lessons learned phase. Red Teaming should not be regarded as an audit but as a simulation test that seeks to provide insight into the level of resilience and effectiveness of the implemented cyber-security controls and relevant processes. Red Teaming is not a penetration test; rather, in contrast to a penetration test (in which one or more specific information assets are tested and assessed), it focuses on replicating a targeted and realistic attack against the entire member organization and is performed in a controlled manner.
SAMA has the authority to select any member organization to perform a red teaming exercise considering its criticality and the emerging threat landscape. In addition, a member organization can rightfully conduct red teaming exercise to ensure security resilience. However, as a minimum, domestic systemically important entities will be subject to testing once every three years, in line with this framework. SAMA will maintain the framework and conduct periodic reviews to determine its effectiveness, including the extent to which it addresses the emerging cyber-security threats and risks. If applicable, SAMA will update the framework based on the outcome of the review and lessons learned.
Keywords: Middle East and Africa, Saudi Arabia, Banking, Red Teaming Framework, Cyber Risk, Cyber Testing, Operational Risk, Cyber Resilience, SAMA
Previous ArticleIMF Issues Reports Under 2019 Article IV Consultation with Lithuania
CBUAE has issued a regulation that introduces the licensing and supervision framework for low-risk, specialized banks.
APRA is consulting on CPG 511—the draft Prudential Practice Guide on remuneration for banks, insurers, and superannuation licensees—with the comment period ending on July 23, 2021.
MAS announced a new RegTech grant scheme and an enhancement of the Digital Acceleration Grant (DAG) scheme to accelerate technology adoption in the financial sector.
PRA published a letter that sets out findings from the 2020 Internal Audit Review of the Collections function of a sample of non-systemic banks and building societies.
EIOPA launched a consultation on the Interbank Offered Rate (IBOR) transitions, in context of the EU Benchmarks Regulation.
EIOPA published a discussion paper on uses cases of, and the European approach to, blockchain and smart contracts in the insurance sector.
HKMA granted a banking license to NongHyup Bank (also NH Bank), which is incorporated in the Republic of Korea.
PRA published a discussion paper that explores options for developing a simpler but resilient prudential framework for banks and building societies that are neither systemically important nor internationally active.
ECB published an opinion on the proposal for a regulation on the pilot regime for market infrastructures based on distributed ledger technology.
EBA proposed regulatory technical standards that specify how to identify the appropriate risk-weights and conditions when assessing minimum loss given default (LGD) values for exposures secured by immovable property.