SAMA published the Financial Entities Ethical Red Teaming Framework, in an effort to address the increasing cyber risks. The framework is intended as a guide to prepare and execute controlled cyber attacks against the production environment, without exposing sensitive information, with the help of certified and experienced Red Teaming Providers. The framework aims to share intelligence and information obtained during testing to further improve cyber resilience in the financial sector in Saudi Arabia. The framework applies to all member organizations in the financial sector regulated by SAMA.
The principal objective of the framework is to provide guidance on how to conduct the red teaming activities and how to test the detection and response capabilities of a member organization against real sophisticated and advanced attacks and enhance the knowledge of the involved stakeholders. The framework consists of four phases—preparation phase, scenario phase, execution phase, and lessons learned phase. Red Teaming should not be regarded as an audit but as a simulation test that seeks to provide insight into the level of resilience and effectiveness of the implemented cyber-security controls and relevant processes. Red Teaming is not a penetration test; rather, in contrast to a penetration test (in which one or more specific information assets are tested and assessed), it focuses on replicating a targeted and realistic attack against the entire member organization and is performed in a controlled manner.
SAMA has the authority to select any member organization to perform a red teaming exercise considering its criticality and the emerging threat landscape. In addition, a member organization can rightfully conduct red teaming exercise to ensure security resilience. However, as a minimum, domestic systemically important entities will be subject to testing once every three years, in line with this framework. SAMA will maintain the framework and conduct periodic reviews to determine its effectiveness, including the extent to which it addresses the emerging cyber-security threats and risks. If applicable, SAMA will update the framework based on the outcome of the review and lessons learned.
Keywords: Middle East and Africa, Saudi Arabia, Banking, Red Teaming Framework, Cyber Risk, Cyber Testing, Operational Risk, Cyber Resilience, SAMA
Previous ArticleISDA Publishes Master Regulatory Disclosure Letter and Guidance Note
PRA published a set of questions and answers (Q&A) covering common queries regarding residential and commercial property valuations, for the purpose of the Capital Requirements Regulation (CRR), during the period of disruption caused by COVID-19 pandemic.
IOSCO proposed updates to its principles for regulated entities that outsource tasks to service providers.
MAS announced that the first phase of the Veritas initiative will commence with the development of fairness metrics in credit risk scoring and customer marketing.
BoE published the Statistical Notice 2020/4 to update the buy-to-let (BTL) Phase 2 and Phase 3 definitions for the Interest Rate Type data item.
FSI published a brief note that examines challenges facing the banking sector as a result of the payment deferral programs put in place to support borrowers affected by the COVID-19 pandemic.
PRA published the policy statement PS14/20, which contains the supervisory statement SS1/20 and the feedback to responses to the consultation paper CP22/19 on expectations for investment by firms in accordance with the Prudent Person Principle, or PPP, as set out in the Investments Part of the PRA Rulebook.
EBA published an opinion following the notification by the French macro-prudential authority, the Haut Conseil de Stabilité Financière (HCSF), of its intention to extend a measure introduced in 2018 on the use of Article 458(9) of the Capital Requirements Regulation (CRR).
As part of a Research Bulletin on the recent policy-relevant work, ECB published an article that examines the lessons learned from past crises for nonperforming loan resolution in the post COVID-19 period.
RBNZ published the financial stability report for May 2020. This review of the financial system in the country highlights that the economic disruption associated with COVID-19 will present challenges to the financial system.
ECB updated the guidance notes for reporting related to the statistics on holdings of securities by reporting banking groups (SHSG).