Danish Central Bank to Continue Cyber Testing With TIBER-DK Program
The central bank of Denmark (Danmarks Nationalbank) is working to increase operational resilience in the financial sector, including resilience to cyber-attacks. In that context, the central bank and the individual participants in the Threat Intelligence-based Ethical Red Teaming (TIBER-DK) program have decided to continue testing with ethical hackers in future. The decision is based on the good experiences with the tests, the purpose of which has been to strengthen cyber resilience and thus promote financial stability. TIBER-DK is based on the TIBER-EU framework developed by ECB and , in this program, critical systemic entities perform threat-based red team tests.
The Central Bank of Denmark and the financial sector have together established the TIBER-DK program. Since January 2019, threat-based red team tests have been conducted in close collaboration with the systemically most important banks and the critical parts of the Danish financial infrastructure, including the Central Bank of Denmark. In a TIBER test, ethical hackers simulate cyber attacks from, for example, organized criminal hacker groups to test cyber resilience and the response to cyber attacks. The test provides learning about how the individual organizations and groups can better defend themselves against their attacks. In April, TIBER-DK experiences were shared with senior management representatives from the TIBER-DK participants.
A TIBER-DK test includes a number of teams in addition to TIBER Cyber Team of the Central Bank of Denmark. The White Team consists of the persons in the tested organization who know about the test and coordinate it. The White Team procures threat intelligence, which examines the threat landscape for the organization in question. The White Team also procures a Red Team, which conducts the actual Red Team attack and consists of the "ethical hackers." There are special requirements in the framework for the experience and competencies of these suppliers to ensure that they are skilled enough to be able to imitate advanced cyber groups—without harming the critical systems. The Blue Team consists of the persons in the organization in question who are attacked and defend themselves. They have no advance knowledge of the test and act as if it were a real attack.
Keywords: Europe, Denmark, Banking, TIBER-EU, TIBER DK, Cyber Resilience, Cyber Risk, Operational Resilience, Central Bank of Ireland
Previous Article
ACPR Publishes Version 1.0.0 of RUBA TaxonomyRelated Articles
FINMA Approves Merger of Credit Suisse and UBS
The Swiss Financial Market Supervisory Authority (FINMA) has approved the takeover of Credit Suisse by UBS.
BOE Sets Out Its Thinking on Regulatory Capital and Climate Risks
The Bank of England (BOE) published a working paper that aims to understand the climate-related disclosures of UK financial institutions.
OSFI Finalizes on Climate Risk Guideline, Issues Other Updates
The Office of the Superintendent of Financial Institutions (OSFI) is seeking comments, until May 31, 2023, on the draft guideline on culture and behavior risk, with final guideline expected by the end of 2023.
APRA Assesses Macro-Prudential Policy Settings, Issues Other Updates
The Australian Prudential Regulation Authority (APRA) published an information paper that assesses its macro-prudential policy settings aimed at promoting stability at a systemic level.
BIS Paper Examines Impact of Greenhouse Gas Emissions on Lending
BIS issued a paper that investigates the effect of the greenhouse gas, or GHG, emissions of firms on bank loans using bank–firm matched data of Japanese listed firms from 2006 to 2018.
HMT Mulls Alignment of Ring-Fencing and Resolution Regimes for Banks
The HM Treasury (HMT) is seeking evidence, until May 07, 2023, on practicalities of aligning the ring-fencing and the banking resolution regimes for banks.
MFSA Sets Out Supervisory Priorities, Issues Reporting Updates
The Malta Financial Services Authority (MFSA) outlined its supervisory priorities for 2023
German Regulators Issue Multiple Reporting Updates for Banks
Deutsche Bundesbank published the nationally deactivated validation rules for the German Commercial Code (HGB) users on the taxonomy 3.2, which became valid from December 31, 2022
BCBS Report Examines Impact of Basel III Framework for Banks
The Basel Committee on Banking Supervision (BCBS) published results of the Basel III monitoring exercise based on the June 30, 2022 data.
PRA Consults on Prudential Rules for "Simpler-Regime" Firms
Among the recent regulatory updates from UK authorities, a key development is the first-phase consultation, from the Prudential Regulation Authority (PRA), on simplifications to the prudential framework that would apply to the simpler-regime firms.