for cyber defence. we should not expect to build an impermeable perimeter that, through technology design, will withstand attack. rather we should expect the cyber threat to be ever - present, ever - evolving and networks to be penetrated. the capability to identify where this has occurred and to respond is key. part of this is active engagement with threat intelligence to understand likely adversaries, their motivations and ways of working. for all these reasons, addressing cyber risk in the financial sector is a high priority for the bank of england. it touches on most of our responsibilities – as prudential supervisor of financial firms, as supervisor of financial market infrastructure – and operator of financial market infrastructure ( of real time gross settlement ( rtgs ) ) – and as uk authority responsible for financial stability. financial stability is the unifying objective in all of these responsibilities. it means that, in the spectrum of cyber attacks, we are much more concerned about those that have the potential to disrupt the uk system by damaging the operations of key firms or financial http : / / www. bbc. co. uk / news / entertainment - arts - 30512032. http : / / www. theguardian. com / world / 2014 / dec / 22 / south - korea - nuclear - power - cyber - attack - hack. bis central bankers ’ speeches market infrastructure and to understand how that damage could transmit through the sector, than to deal with individual cases of cyber fraud. such cases of consumer detriment are for the financial conduct authority ( fca ), law enforcement agencies such as the national crime agency, the police and the home office to address. in response to the rise in the potential threat to uk financial stability from cyber, the financial policy committee ( fpc ) in june 2013 recommended that the uk authorities should work with firms at the core of the system to test and improve cyber resilience. i want to spend the rest of this speech outlining what we have done in response. the accent has been on assessing the vulnerability of the uk financial sector to cyber attack. we are doing that in two ways : a crosssector review of current risk management practices with regards to cyber and vulnerability testing via cbest. let me describe these in turn. as a first step in diagnosing the sector ’ s cyber resilience, the uk financial authorities 3 issued a questionnaire to thirty six firms that make up the “ core ” of the uk financial system. this included the largest

towards improved cyber hygiene. this includes board level engagement. front line business areas need to understand and own the risk. management of cyber vulnerabilities needs to feature in strategic planning. the bank, prudential regulation authority ( pra ) and the financial conduct authority ( fca ). bis central bankers ’ speeches 3. cyber requires effective and regular testing : of people, processes and technology. industry investment in cyber is significant but testing the effectiveness of this investment has not kept pace. assurance is often based on audits and control sampling which is not sufficient, not least because of the challenge for internal audit departments to keep pace with change in this area. and of course, given the dynamic nature of the threat, such tests should take place on a regular basis. this leads me onto the other element of our response to the fpc recommendation i wanted to talk about : vulnerability testing through the cbest 4 program. cbest is a framework that we have developed working with government, industry and commercial providers of penetration testing and threat intelligence. the idea is to bring to bear the best available intelligence on potential threats to test directly a firm ’ s ability to protect, detect and respond to cyber attacks. the scope of a cbest test is tailored to the business of the firm and the critical services it provides. given the scope, relevant intelligence on threats and attack types is drawn together from threat intelligence providers, including government sources, and is used to design a series of tests that mimic the methods that are most likely, according to the threat intelligence, to be deployed against the firm. the companies providing the penetration test are accredited within a framework that has benefitted from gchq input and delivery of the test is within a controlled testing process agreed between the firm, the authorities and the test provider. the results should provide firms – and us – with a direct read on the robustness of their defences to more sophisticated attack types and a gaps analysis so that firms know what steps they need to take to improve their resilience. this is not a regulatory requirement though we are encouraging firms to participate. rather it is a voluntary process. but we think the benefits to firms of cbest are significant. this is why the fpc in december encouraged firms to undergo a cbest as “ soon as practicable ” 5. by going through this process, firms will not only understand where their vulnerabilities lie, but also which threats should cause them most concern and what steps they should take to combat