Sabine Lautenschläger: Towards a more cyber secure financial system - the role of central banks Statement by Ms Sabine Lautenschläger, Member of the Executive Board of the European Central Bank, at the G7 2019 conference on "Cybersecurity: Coordinating efforts to protect the financial sector in the global economy", Paris, 10 May 2019. * * * As we all know, cyber threats to the financial sector are continuously evolving and becoming ever more sophisticated. The attackers – whether they be 16-year old script kiddies, hacktivist groups or even nation states – are dynamic and agile. They have different reasons for targeting the financial sector, but they each have the potential to cause disruption. Besides stealing money and data, they can undermine confidence in the entire financial system. So what can we, as public authorities, do? As the central banker on this panel, I will, of course, focus on what central banks can do. I will first outline some key trends in the financial sector, which make it vulnerable to cyber threats. I will then share some of the insights gained from the ECB’s key initiatives on cyber risk. Trends in the financial sector We see a number of trends in the financial sector related to cyber risk: First, the close interconnection and complexity of the financial system creates vulnerabilities which can be exploited by cyber attackers. Second, attackers seem to be gaining an ever deeper understanding of how the financial system operates. This enables them to swiftly detect and exploit weaknesses more efficiently and should be a concern for us all. Third, both banks and financial market infrastructures are struggling to find staff with the skills and experience needed to fend off cyber-attacks. Indeed, the skills gap extends well beyond the financial sector. All relevant stakeholders need to urgently work on strategies to make sure that our workforce has the right skills for our future economies, and that our society is able to reap the benefits of innovation. Finally, true innovation is always disruptive. Fintech might disrupt financial markets in positive ways. But it also comes with risks: fiercer competition could lead some market players to embrace and adopt new technologies, services or methods before fully grasping the related risks – cyber-risks in this case. Let me point to some information and knowledge we have gathered at the ECB in our banking supervisory function as well as in our oversight function for financial market infrastructures. We do see room for improvement at banks and financial market infrastructures with regard to cyber governance, for example. Financial market infrastructures, or FMIs for short, too often lack board-approved cyber resilience strategies. And if there is a strategy, it is often not operationalised. And if it is operationalised, it is often not monitored, and its effectiveness is not challenged. FMIs and banks work diligently on technical security measures in order to detect threats and protect their systems. Some of them, though, neglect people and processes. There is a dangerous lack of awareness and training. Successful cyber-attacks often start with a phishing email to an unsuspecting employee. Having mentioned the complexity of the financial system as a vulnerability, I need to add the complexity of IT-systems as well. Banks, in particular, should aim to simplify their IT landscape. 1/3 BIS central bankers' speeches Simpler IT landscapes have a smaller attack surface. And the easier these systems are to understand and maintain, the better they can be protected. And, last but not least, we see that a significant number of FMIs still lack dedicated cyber incident response plans. These are just a few of the worrying trends and vulnerabilities that we see. So there is clearly much work to be done. How is the ECB addressing cyber threats? An oversight and supervision perspective So, what part can the ECB play? Let’s first look at our role in overseeing FMIs. In March 2017 the Governing Council approved the Eurosystem cyber resilience strategy for FMIs. This strategy is intended to operationalise the CPMI-IOSCO1 Guidance on cyber resilience for FMIs. The strategy rests on three pillars: FMI resilience, sector resilience, and strategic industry-regulator dialogue. Regarding the resilience of FMIs, we started in 2017 by conducting a survey of 76 FMIs across the European Union, to assess their cyber resilience. The results of this survey have enabled overseers to enter into productive dialogues with FMIs on their ability to address cyber-threats. Furthermore, while the principles contained in the CPMI-IOSCO Guidance are important, they are also quite high level. Smaller institutions in particular need to be informed about best practices in a more concrete and detailed manner. So, to facilitate the proportionate implementation of the guidance, the ECB published the Cyber Resilience Oversight Expectations, or CROE for short, in December 2018. A tool for FMIs and overseers alike, the CROE sets out three levels of increasingly demanding expectations, tailored to the size of the FMI. To complement the CROE, the ECB has also developed another tool: the European threat intelligence based ethical red team testing framework (TIBER-EU). By means of “ethical hacking”, red teaming helps to assess a financial institution’s ability to withstand a cyber-attack. TIBER-EU serves to guide authorities and financial institutions in conducting threat-intelligence based red teaming, and to avoid duplication through the emergence of similar pan-European tests. But testing the resilience of individual FMIs or banks may not be sufficient. The financial system is highly interconnected and any cyber-attack could thus trigger contagion. This is why the ECB hosted a market-wide crisis communication exercise, UNITAS, in June 2018. UNITAS facilitated a discussion among pan-European financial infrastructures on a scenario in which a cyberattack resulted in a loss of data integrity and a knock-on effect on other financial infrastructures. The exercise revealed that there were weaknesses at the European level, which are now being followed-up on by the Euro Cyber Resilience Board for pan-European Financial Infrastructures, or ECRB for short. This brings me to the third pillar of our strategy, which seeks to foster strategic engagement between regulators and industry. The ECRB was established in 2018 with the aim of facilitating trust and collaboration among FMIs and authorities and encouraging joint initiatives. Moving on to banking supervision, the ECB Banking Supervision has addressed IT and cyber risk from various angles. First, we have been conducting thematic reviews since 2015 on the topic in the banks that we directly supervise. These gave us a more detailed understanding of the scope of the problem. Moreover, the latest horizontal analysis of IT risk conducted in 2018 has revealed deficiencies in IT security risk management at several banks. For instance, banks’ general risk management frameworks sometimes fail to specifically include IT risk. A significant number of banks have 2/3 BIS central bankers' speeches critical processes that depend on systems which are close to, or have already reached, their end of life. This, in turn, makes them more vulnerable to cyber threats. We also see a failure to rapidly address critical findings in the area of IT security. In addition, IT outsourcing is increasing, and many supervised institutions outsource their IT to a single provider. A classic case of putting all their eggs in one basket, this creates a concentration risk that should not go unnoticed. There are cases where these concentration risks cannot be avoided, but this should then go hand in hand with tougher requirements for cyber resilience. Further, the ECB insists that banks should employ enough sufficiently skilled staff to monitor and oversee their outsourced activities. In 2017, the ECB also set up a cyber incident reporting process. The information on incidents reported by banks is used by the ECB to identify and monitor trends, and to facilitate a fast reaction of the ECB in the event of a major cyber incident affecting one or more significant institutions at the same time. The number of reported cyber incidents has been rather low, the most frequent type being Distributed Denial of Service attacks (DDoS). Other reported incidents were related to unauthorised access, accidental data leakage and phishing attacks. In many cases, there was a delay between the onset of the attack and its detection. Finally, we see that attackers gained access to banks’ systems by exploiting both technological vulnerabilities, such as missing IT security measures, and human ones, such as insufficient staff awareness. Although the number of reported cyber incidents has been rather low, I would not dare to conclude cyber threat levels are low, or even decreasing. I rather think that it is a matter of time until we experience a major attack. ECB Banking Supervision will continue to monitor IT and cyber risks facing banks; we will continue to push for and request banks’ resilience to and preparedness for cyber threats. And we will of course continue to engage and cooperate with a number of other institutions and agencies. Conclusion Ladies and gentlemen, As you may guess from my brief remarks today, we have a great deal of work ahead of us. Sharing information, knowledge and expertise among public institutions and with the industry will be essential. In this respect, events like today’s have a valuable role to play. I look forward to our discussion. 1 Committee on Payments and Market Infrastructures and the Board of the International Organization of Securities Commissions. 3/3 BIS central bankers' speeches