Featured Product

    FSI Examines Use of Red Team Testing to Enhance Cyber Resilience

    November 15, 2019

    The Financial Stability Institute (FSI) of BIS published a paper that examines the contribution of red team testing frameworks toward enhancing cyber resilience. The paper describes key components of a red team testing framework, compares the existing frameworks, outlines the benefits and challenges of these frameworks, and highlights the potential cross-border issues in the area of red team testing. In terms of policy implementation, the paper emphasizes that, to take red team testing to the next level, consideration could be given to addressing the legal, operational, and regulatory challenges in coordinating cross-border red team testing for internationally active financial institutions.

    The paper is based on information provided by eight financial authorities and selected private-sector players. Most of the surveyed jurisdictions have red team testing frameworks in place, although the objectives and implementation details may differ. The paper covers the red team testing frameworks for financial institutions in EU (including the Netherlands), Hong Kong SAR, Saudi Arabia, Singapore, and the UK. The paper highlights that the international standards on cyber resilience of financial institutions have raised the bar in terms of defining the expectations on firms. Central to this is the use of red team testing as one of the tests that firms can undertake to assess resilience against realistic cyber attacks and strengthen their cyber resilience. 

    Nevertheless, there are challenges to be overcome and certain facilitating conditions appear to be instrumental in supporting effective implementation of red team testing. Such conditions include a conducive governance structure, an engaged board of directors, a supportive risk culture and, critically, the availability of sound professional skills. In certain jurisdictions, an accreditation framework has been established to boost local capacities. One culture-related hurdle to overcome is getting firms and authorities to view a red team test as a “learn and improve” rather than a “pass or fail” exercise. Other challenges in connection with red team testing include the high cost to firms, trust among the involved parties, and data confidentiality.

    Extending red team testing beyond jurisdictional borders is important to minimize potential cyber resilience blind spots, given that cyber attackers could attack any part of the attack surface of a financial institution. In addition, cross-border technological dependencies could give rise to systemic implications if cyber attackers succeed in exploiting vulnerabilities that could trigger such chain events. The paper recommends the following policy actions going forward:

    • Financial sector authorities may wish to clarify how red team tests fit within their strategies to improve the cyber resilience of financial institutions. This will help provide regulatory certainty to firms and prompt concrete actions to improve their cyber resilience postures.
    • Consideration should also be given to clarifying how red team tests fit within an institution’s cyber resilience framework, which in turn should be coherently considered in its enterprise-wide risk management framework.
    • Authorities should continue to assess the effectiveness of their frameworks and use the lessons learned from each test to improve the overall cyber resilience of the financial sector.
    • Authorities may need to enhance cooperation with other relevant authorities and parties to enable effective implementation of the frameworks.

     

    Related Links

    Keywords: International, Banking, Insurance, Securities, PMI, Cyber Resilience, Red Teaming Framework, Cyber Risk, Research, CBEST, TIBER-EU, FSI, BIS

    Related Articles
    News

    EBA Clarifies Use of COVID-19-Impacted Data for IRB Credit Risk Models

    The European Banking Authority (EBA) published four draft principles to support supervisory efforts in assessing the representativeness of COVID-19-impacted data for banks using the internal ratings based (IRB) credit risk models.

    June 21, 2022 WebPage Regulatory News
    News

    EP Reaches Agreement on Corporate Sustainability Reporting Directive

    The European Council and the European Parliament (EP) reached a provisional political agreement on the Corporate Sustainability Reporting Directive (CSRD).

    June 21, 2022 WebPage Regulatory News
    News

    PRA Consults on Model Risk Management Principles for Banks

    The Prudential Regulation Authority (PRA) launched a consultation (CP6/22) that sets out proposal for a new Supervisory Statement on expectations for management of model risk by banks.

    June 21, 2022 WebPage Regulatory News
    News

    EC Regulation Amends Standards for Calculating Credit Risk Adjustments

    The European Commission (EC) published the Delegated Regulation 2022/954, which amends regulatory technical standards on specification of the calculation of specific and general credit risk adjustments.

    June 21, 2022 WebPage Regulatory News
    News

    BIS Hub Updates Work Program for 2022, Announces New Projects

    The Bank for International Settlements (BIS) Innovation Hub updated its work program, announcing a set of projects across various centers.

    June 17, 2022 WebPage Regulatory News
    News

    EIOPA Issues Cyber Underwriting Proposal, Statement on Open Insurance

    The European Insurance and Occupational Pensions Authority (EIOPA) published two consultation papers—one on the supervisory statement on exclusions related to systemic events and the other on the supervisory statement on the management of non-affirmative cyber exposures.

    June 17, 2022 WebPage Regulatory News
    News

    US Senate Members Seek Details on SEC Proposed Climate Disclosure Rule

    Certain members of the U.S. Senate Committee on Banking, Housing, and Urban Affairs issued a letter to the Securities and Exchange Commission (SEC)

    June 16, 2022 WebPage Regulatory News
    News

    EIOPA Consults on Review of Securitization Framework in Solvency II

    The European Insurance and Occupational Pensions Authority (EIOPA) published a consultation paper on the advice on the review of the securitization prudential framework in Solvency II.

    June 16, 2022 WebPage Regulatory News
    News

    UK Authorities Issue Regulatory and Reporting Updates for Banks

    The Prudential Regulation Authority (PRA) issued a statement on PRA buffer adjustment while the Bank of England (BoE) published a notice on the statistical reporting requirements for banks.

    June 15, 2022 WebPage Regulatory News
    News

    BCBS Issues Climate Risk Principles while HKMA Expresses Its Support

    The Basel Committee on Banking Supervision (BCBS) issued principles for the effective management and supervision of climate-related financial risks.

    June 15, 2022 WebPage Regulatory News
    RESULTS 1 - 10 OF 8280