The central bank of Denmark (Danmarks Nationalbank) is working to increase operational resilience in the financial sector, including resilience to cyber-attacks. In that context, the central bank and the individual participants in the Threat Intelligence-based Ethical Red Teaming (TIBER-DK) program have decided to continue testing with ethical hackers in future. The decision is based on the good experiences with the tests, the purpose of which has been to strengthen cyber resilience and thus promote financial stability. TIBER-DK is based on the TIBER-EU framework developed by ECB and , in this program, critical systemic entities perform threat-based red team tests.
The Central Bank of Denmark and the financial sector have together established the TIBER-DK program. Since January 2019, threat-based red team tests have been conducted in close collaboration with the systemically most important banks and the critical parts of the Danish financial infrastructure, including the Central Bank of Denmark. In a TIBER test, ethical hackers simulate cyber attacks from, for example, organized criminal hacker groups to test cyber resilience and the response to cyber attacks. The test provides learning about how the individual organizations and groups can better defend themselves against their attacks. In April, TIBER-DK experiences were shared with senior management representatives from the TIBER-DK participants.
A TIBER-DK test includes a number of teams in addition to TIBER Cyber Team of the Central Bank of Denmark. The White Team consists of the persons in the tested organization who know about the test and coordinate it. The White Team procures threat intelligence, which examines the threat landscape for the organization in question. The White Team also procures a Red Team, which conducts the actual Red Team attack and consists of the "ethical hackers." There are special requirements in the framework for the experience and competencies of these suppliers to ensure that they are skilled enough to be able to imitate advanced cyber groups—without harming the critical systems. The Blue Team consists of the persons in the organization in question who are attacked and defend themselves. They have no advance knowledge of the test and act as if it were a real attack.
Keywords: Europe, Denmark, Banking, TIBER-EU, TIBER DK, Cyber Resilience, Cyber Risk, Operational Resilience, Central Bank of Ireland
Previous ArticleACPR Publishes Version 1.0.0 of RUBA Taxonomy
The Office of the Superintendent of Financial Institutions (OSFI) published an update on the discussion paper that intended to engage federally regulated financial institutions and other interested stakeholders in a dialog with OSFI, to proactively enhance and align assurance expectations over key regulatory returns.
The European Commission (EC) published a report summarizing responses to the targeted consultation on the supervisory convergence and the single rulebook in the European Union (EU).
The European Central Bank (ECB) published its opinion on a proposal for a regulation on European green bonds, following a request from the European Parliament.
The Advisory Scientific Committee (ASC) of the European Systemic Risk Board (ESRB) published a report that explores the expected impact of digitalization on provision of financial and banking services, and proposes policy measures to address the risks stemming from digitalization.
The Hong Kong Monetary Authority (HKMA) is consulting on the draft Financial Institutions (Resolution) Ordinance (Cap. 628), or FIRO, Code of Practice chapter on liquidity and funding in resolution, until March 14, 2022.
The Swedish Financial Supervisory Authority (FI) announced that the capital adequacy reporting as at December 31, 2021 must be done by February 11, 2022.
The European Banking Authority (EBA) announced that the guidelines on the reporting and disclosure of exposures subject to measures COVID-relief measures shall continue to apply until further notice.
The Central Bank of the Philippines (BSP) issued communications covering developments related to online lending platforms, open finance framework and roadmap, and on the expected regulations in the area sustainable finance.
The Board of Governors of the Federal Reserve System (FED) published the final rule that amends Regulation I to reduce the quarterly reporting burden for member banks by automating the application process for adjusting their subscriptions to the Federal Reserve Bank capital stock, except in the context of mergers.
The European Banking Authority (EBA) published its assessment of risks through the quarterly Risk Dashboard and the results of the Autumn edition of the Risk Assessment Questionnaire (RAQ).