is not simply an it problem. • perform risk assessments and intrusion tests : firms should perform cybersecurity risk assessments on a regular basis. such assessments should include identification of critical assets and commissioned intrusion tests. they need to be performed frequently enough to capture changes in new systems, new product offerings or new security threats. • prepare for the successful attacks : build resilience through distributed architecture and multiple lines of defense and prepare to mitigate the impact on customers. • manage vendor risk : firms should perform cybersecurity due diligence on prospective and existing outsourced service providers and incorporate cybersecurity and data protection provisions into outsourcing agreements. • gather information and follow best practices : firms should follow and apply industry standards to their cybersecurity risk management frameworks as appropriate for the scale and nature of their business and participate in industry information sharing groups. • educate staff : firms should provide regular security awareness training to all staff. firms should address the “ human factor ” by cultivating an environment of security awareness throughout the firm and providing regular security awareness training to all staff. without good security awareness training, each staff member becomes a weak link from a security perspective. • have robust it policies, procedures and technical controls are put in place : that includes incident reporting and response plans, recovery and business continuity plans, patch management, and employee access rights. • consider buying cyber - insurance : firms may consider evaluating the possibility of using cyber - insurance as a partial risk mitigation strategy. looking ahead the central bank intends to sharpen its focus on the cybersecurity threat. we are committed to building up our knowledge and expertise. in line with the rapidly evolving nature of cyber risk, the central bank ’ s regulatory expectations will be evolving. bis central bankers ’ speeches supervisors have an important role in fostering robust oversight of cybersecurity risks, even though the onus is on the firms to manage these risks. our approach needs to be agile. we will adopt a multi - pronged approach where we use the range of tools at our disposal, including thematic reviews, inspections of supervised firms, independent reviews by the internal audit team or external third parties, issuing guidance and working to raise awareness and educate industry and consumers on cybersecurity issues. a single regulator cannot successfully tackle this threat alone. the threat does not stop at national borders. there needs to be a united and coordinated approach among regulators and to this end, we are working closely with the ec

carbanak attack, which targeted the money processing services, atms and bank accounts of over 100 banks worldwide over a period of two years and may have led to up to $ 1bn being stolen. the risk / reward trade - off for cybercrime is very attractive. cybercriminals know there is a low likelihood of being detected, caught or prosecuted and many attack strategies can be executed cheaply. this has led to a substantial broadening of the attacker base. due to the proliferation of the cybercrime - as - a - service business model, the cybercrime industry is no longer just the domain of highly skilled it people. now a relatively low - skilled cybercriminal can cause significant damage. irrespective of size, cybercriminals can use a variety of approaches, some highly technological, such as exploiting previously undiscovered defects in computer software, some relying on human error, such as deception of employees or spear - phishing. it is this human element to which i now turn. employee risk : insider - threat and human error people can be the most vulnerable and unpredictable part of a firm ’ s tech infrastructure. there are two main types of employee driven cybersecurity risk : insider - threat and human error. disgruntled current and ex - employees can be a significant source of security risk due to their knowledge of firms ’ systems and data assets. they may have a strong personal motivation to damage the firm or hold it to ransom. while security or it staff might be the obvious cases, other examples include staff with access to valuable intellectual property, senior management or sales staff with client data. financial firms have long managed the risk of employee fraud through separation of duties, two - person authorisation and access limitations. similar controls around high - value data and systems are needed. bis central bankers ’ speeches for instance, firms have to ensure that access rights are reconfigured when an employee leaves or moves internally. firms should ensure that employees have at any moment only the access rights they need to carry on their job. accidental and / or non - malicious employee security breaches accounted for around 25 % of data breaches in 2013 and 2014. often the breach occurs for well - intentioned reasons such as an employee wanting to work on something from home and sending a document to their personal email or copying data onto a usb drive, or when employees use external systems or software. if an it system cannot give employees