Featured Product

    FSI Examines Use of Red Team Testing to Enhance Cyber Resilience

    November 15, 2019

    The Financial Stability Institute (FSI) of BIS published a paper that examines the contribution of red team testing frameworks toward enhancing cyber resilience. The paper describes key components of a red team testing framework, compares the existing frameworks, outlines the benefits and challenges of these frameworks, and highlights the potential cross-border issues in the area of red team testing. In terms of policy implementation, the paper emphasizes that, to take red team testing to the next level, consideration could be given to addressing the legal, operational, and regulatory challenges in coordinating cross-border red team testing for internationally active financial institutions.

    The paper is based on information provided by eight financial authorities and selected private-sector players. Most of the surveyed jurisdictions have red team testing frameworks in place, although the objectives and implementation details may differ. The paper covers the red team testing frameworks for financial institutions in EU (including the Netherlands), Hong Kong SAR, Saudi Arabia, Singapore, and the UK. The paper highlights that the international standards on cyber resilience of financial institutions have raised the bar in terms of defining the expectations on firms. Central to this is the use of red team testing as one of the tests that firms can undertake to assess resilience against realistic cyber attacks and strengthen their cyber resilience. 

    Nevertheless, there are challenges to be overcome and certain facilitating conditions appear to be instrumental in supporting effective implementation of red team testing. Such conditions include a conducive governance structure, an engaged board of directors, a supportive risk culture and, critically, the availability of sound professional skills. In certain jurisdictions, an accreditation framework has been established to boost local capacities. One culture-related hurdle to overcome is getting firms and authorities to view a red team test as a “learn and improve” rather than a “pass or fail” exercise. Other challenges in connection with red team testing include the high cost to firms, trust among the involved parties, and data confidentiality.

    Extending red team testing beyond jurisdictional borders is important to minimize potential cyber resilience blind spots, given that cyber attackers could attack any part of the attack surface of a financial institution. In addition, cross-border technological dependencies could give rise to systemic implications if cyber attackers succeed in exploiting vulnerabilities that could trigger such chain events. The paper recommends the following policy actions going forward:

    • Financial sector authorities may wish to clarify how red team tests fit within their strategies to improve the cyber resilience of financial institutions. This will help provide regulatory certainty to firms and prompt concrete actions to improve their cyber resilience postures.
    • Consideration should also be given to clarifying how red team tests fit within an institution’s cyber resilience framework, which in turn should be coherently considered in its enterprise-wide risk management framework.
    • Authorities should continue to assess the effectiveness of their frameworks and use the lessons learned from each test to improve the overall cyber resilience of the financial sector.
    • Authorities may need to enhance cooperation with other relevant authorities and parties to enable effective implementation of the frameworks.


    Related Links

    Keywords: International, Banking, Insurance, Securities, PMI, Cyber Resilience, Red Teaming Framework, Cyber Risk, Research, CBEST, TIBER-EU, FSI, BIS

    Related Articles

    EBA Finalizes Templates for One-Off Climate Risk Scenario Analysis

    The European Banking Authority (EBA) has published the final templates, and the associated guidance, for collecting climate-related data for the one-off Fit-for-55 climate risk scenario analysis.

    November 28, 2023 WebPage Regulatory News

    EBA Mulls Inclusion of Environmental & Social Risks to Pillar 1 Rules

    The European Banking Authority (EBA) recently published a report that recommends enhancements to the Pillar 1 framework, under the prudential rules, to capture environmental and social risks.

    October 31, 2023 WebPage Regulatory News

    BCBS Consults on Disclosure of Crypto-Asset Exposures of Banks

    As a follow on from its prudential standard on the treatment of crypto-asset exposures, the Basel Committee on Banking Supervision (BCBS) proposed disclosure requirements for crypto-asset exposures of banks.

    October 19, 2023 WebPage Regulatory News

    BCBS and EBA Publish Results of Basel III Monitoring Exercise

    The Basel Committee on Banking Supervision (BCBS) and the European Banking Authority (EBA) have published results of the Basel III monitoring exercise.

    October 18, 2023 WebPage Regulatory News

    PRA Updates Timeline for Final Basel III Rules, Issues Other Updates

    The Prudential Regulation Authority (PRA) recently issued a few regulatory updates for banks, with the updated Basel implementation timelines being the key among them.

    October 18, 2023 WebPage Regulatory News

    US Treasury Sets Out Principles for Net-Zero Financing

    The U.S. Department of the Treasury has recently set out the principles for net-zero financing and investment.

    October 17, 2023 WebPage Regulatory News

    EC Launches Survey on G7 Principles on Generative AI

    The European Commission (EC) launched a stakeholder survey on the draft International Guiding Principles for organizations developing advanced artificial intelligence (AI) systems.

    October 14, 2023 WebPage Regulatory News

    ISSB Sustainability Standards Expected to Become Global Baseline

    The finalization of the two sustainability disclosure standards—IFRS S1 and IFRS S2—is expected to be a significant step forward in the harmonization of sustainability disclosures worldwide.

    September 18, 2023 WebPage Regulatory News

    IOSCO, BIS, and FSB to Intensify Focus on Decentralized Finance

    Decentralized finance (DeFi) is expected to increase in prominence, finding traction in use cases such as lending, trading, and investing, without the intermediation of traditional financial institutions.

    September 18, 2023 WebPage Regulatory News

    BCBS Assesses NSFR and Large Exposures Rules in US

    The Basel Committee on Banking Supervision (BCBS) published reports that assessed the overall implementation of the net stable funding ratio (NSFR) and the large exposures rules in the U.S.

    September 14, 2023 WebPage Regulatory News
    RESULTS 1 - 10 OF 8938