We are currently discussing the results from these questionnaires directly with firms. You will appreciate that I cannot go into specifics. But overall the responses did not reveal any immediate critical shortcomings in the cyber resilience of the firms involved. But they did point to areas for improvement that we will be following up on with firms. Let me list some common themes. 1. Cyber has changed the rules: existing operational resilience arrangements are often geared to dealing with physical threats. These still matter. But cyber changes the game. Cyber is a dynamic, intelligent and adaptive threat. In the cyber arms race, costs are stacked in favour of the attacker, not the defender. To meet the challenge, organisations need to have policies and processes that are dynamic, intelligent and adaptive too. This means investment in capability to identify threats and detect cyber attacks. Without this situational awareness it is hard to determine and achieve appropriate maturity levels for cyber defence and to allocate resources effectively to meet the threat. 2. Cyber is not a minority sport for technologists only: Of course the first line of defence is critical and we still need IT specialists who understand the technical challenges cyber presents. But good cyber resilience is about much more than technology. It is about culture too and this means people and processes. When Morgan Stanley reported recently its customer information had been breached, this wasn’t due to sophisticated hackers, rather an employee who stole data from over 350,000 customer accounts.
Given the scope, relevant intelligence on threats and attack types is drawn together from threat intelligence providers, including government sources, and is used to design a series of tests that mimic the methods that are most likely, according to the threat intelligence, to be deployed against the firm. The companies providing the penetration test are accredited within a framework that has benefitted from GCHQ input and delivery of the test is within a controlled testing process agreed between the firm, the authorities and the test provider. The results should provide firms – and us – with a direct read on the robustness of their defences to more sophisticated attack types and a gaps analysis so that firms know what steps they need to take to improve their resilience. This is not a regulatory requirement though we are encouraging firms to participate. Rather it is a voluntary process. But we think the benefits to firms of CBEST are significant. This is why the FPC in December encouraged firms to undergo a CBEST as “soon as practicable” 5. By going through this process, firms will not only understand where their vulnerabilities lie, but also which threats should cause them most concern and what steps they should take to combat them. Access to direct feeds of commercial and government intelligence, via accredited red team testing by cyber experts, ensures that the test involves the most up-to-date threats, most relevant to their specific situation. And we are keen for other sectors, and other jurisdictions, to benefit from our experiences 6.