As we review all published guidance, assess the broad volume of research that is already out there and come to consensus on an evaluation framework, we encourage firms to look at the fundamental commonalities across all best practices and build them into your ongoing/current activities. BIS central bankers’ speeches  5  7. Assessing the threat  To fully assess a threat or risk to a firm, we must first understand where the risk lies, who it affects, how it is defined, and what the associated costs are. In the case of assessing the risk and impact of cyber-attacks, I believe firms need to be cognizant that every business decision, every process, every change a firm makes ultimately has a cyber-related element to it. To add to the complexity of this, the firm’s self-awareness must extend beyond the four walls of their company and must also take into account the impact critical service providers have on the firm. You can outsource the service, but not the risk. Everyone should be using threat intelligence as we go about our day-to-day activities – using the potential of a cyber-attack as another filter through which we view every decision. As we think about the variables to be considered in the decision-making process, we must build in the potential for creating weaknesses, vulnerabilities or opportunities for cyber-attacks, and be aware of the associated costs.
I fear that until we can assign financial consequences to cyber risks, and ensure staff are taking that into account when making decisions, we will not get the commitment needed from every level of the organization to adequately address the problem. As long as decisions are made and actions are taken without this type of assessment, we are going to see more and more of these weaknesses exposed. These vulnerabilities are not necessarily new, but the exposure to them is increasingly being made available to attackers. For instance, a weak patch management process comes with the risk that systems may take longer to patch (or not be patched at all!) resulting in a much larger target window of opportunity for attackers. As we assess the potential impact, it is also important to remember that protecting against an attack is only half the solution – particularly because, as my InfoSec colleagues like to say: “It’s not a matter of IF we get hacked; it’s a matter of WHEN.” A strong cyber resiliency program is a good starting point to address this, but we also need to focus on limiting the impact following an attack by addressing the fundamental structure within the organization – how safe is the system, how compartmentalized are the core areas of technology, and what your ability is to isolate the threat. 8.