Our current approach to ensure firms are able to continue to operate core functions in a major operational disruption involves ensuring that firms have primary and secondary sites at a safe distance from each other and the capacity to switch operations between the two without any extended interruption in activity. But with cyber such common systems environments between primary and secondary sites and mirroring of data between the two could, in the event of a successful attack, result in a complete loss of systems, disrupting a firm’s capacity to operate and leaving the timeframe and route to recovery uncertain. Unlike most other forms of operational disruption, we know too with cyber that this is not a game against nature. There are groups out there that are motivated to attack the sector. For most, the motivation is economic; that accounts for the rise in fraud. But there are actors out there, sometimes state-sponsored, who may be motivated to bring systems down and cause harm to the sector. Their capabilities vary, but it is in the nature of cyber that attack types are constantly evolving and readily scalable. And the threat is international. Attacks can originate anywhere around the globe. This all implies a different disposition for cyber defence. We should not expect to build an impermeable perimeter that, through technology design, will withstand attack. Rather we should expect the cyber threat to be ever-present, ever-evolving and networks to be penetrated. The capability to identify where this has occurred and to respond is key.
The accent has been on assessing the vulnerability of the UK financial sector to cyber attack. We are doing that in two ways: a crosssector review of current risk management practices with regards to cyber and vulnerability testing via CBEST. Let me describe these in turn. As a first step in diagnosing the sector’s cyber resilience, the UK financial authorities 3 issued a questionnaire to thirty six firms that make up the “core” of the UK financial system. This included the largest UK and foreign banks active in London and the key payment and settlement systems, clearing houses and exchanges that together are critical for delivery of the financial services that the wider economy depends on. The questionnaire provided for a detailed self-assessment by firms of how they organise their cyber defences. Its purpose was to enable UK authorities to take stock of resilience across the sector and identify best practice across firms. Part of this was to be able to play back to individual firms where they stood relative to best practice. But lying behind this is the objective of raising resilience in individual firms by ensuring that the network as a whole is resilient. And given the importance of these firms to the stability of the financial system, this implies a level of resilience that goes beyond basic cyber hygiene but aims instead to ensure that firms are in a position to manage Advanced Persistent Threats (APT) that are the hallmark of some statesponsored attackers.