andrew gracie : cyber in context speech by mr andrew gracie, executive director of resolution of the bank of england, at the uk financial services cyber security summit, london, 2 july 2015. * * * it is the prerogative of the keynote speaker to take an olympian view. i am not sure what the gods on olympus would have made of cyber. indeed from the goings on in greek mythology, it could well have been that they were cyber perpetrators rather than protectors. so perhaps it is fitting that there are hacks now like zeus that carry their names. but my olympian view will try and put the work that we are doing as authorities and with the sector in context. the sector ’ s role is important. after all, it is the responsibility of firms first and foremost to ensure that they are resilient to cyber attack. from an authorities perspective, cyber is somewhat different, but it relates to the same underlying goals that drive our policy interventions elsewhere in relation to operational resilience. i want to describe this relationship before turning to the specific steps that we have taken in the uk over the last two years under the aegis of the financial policy committee ( fpc ). cyber is relevant to many of the functions of the bank of england as a financial authority. we are responsible as prudential supervisor for the safety and soundness of banks, large investment firms, insurers and financial market infrastructure. as the financial stability authority we are also responsible for monitoring stability at the level of the sector as a whole. while we have multiple policy hats the common denominator in this space is ensuring that the sector has adequate operational resilience – that is that firms can continue to provide critical services that are important for their own integrity and the functioning of the sector. if a firm ’ s operations are interrupted, we want to be sure that they can be recovered quickly and reliably especially where they are systemically important. three observations at this point : a ) first to stress our accent on financial stability. our efforts target first those firms where operational failures may result in disruption to the provision of vital financial services to the real economy or in dislocation to the rest of the sector. that does not mean the failures in customer facing applications do not matter. it is just that, where no immediate systemic dislocation results from such an outage, any consumer detriment will be a concern for our colleagues at the financial conduct authority ( fca ) more than it

actors out there, sometimes state - sponsored, who may be motivated to bring systems down and cause harm to the sector. second it is adaptive and changing. attackers do not stand still. attack types are constantly evolving and readily scalable. in the cyber arms race, costs are stacked in favour of the attacker, not the defender. organisations cannot rely on building a hard perimeter. they too need to develop defensive capability that is adaptive and invest in threat intelligence to understand potential attackers and attack types. third detection is not easy. compromise of networks or attacks themselves will not always be obvious. diagnosis may take time. by contrast physical threats to operational resilience – bombs, fires, floods – are immediately apparent. and apparent too to the rest of the sector. fourth capacity to recover may be threatened. standard approaches to achieving continuity – operating with common systems environments between primary and secondary sites and mirroring data between the two, could, in the face of a successful cyber attack, be vulnerable to complete loss of applications or destruction of data, disrupting a firm ’ s capacity to operate and leaving the timeframe and route to recovery uncertain. hence the fpc recommendation in 2013 that relevant authorities should undertake work to test and improve resilience to cyber attack of the firms at the heart of the financial system 2. you will have seen from the fsr published yesterday 3 that interest in and awareness of this risk continues to grow. this is why it is so vital that firms – and authorities – take the necessary action to address their cyber vulnerabilities. in response to the fpc ’ s 2013 recommendation our work has been mostly diagnostic, concentrating on assessing the vulnerability of the uk financial sector to cyber attack. our focus has been twofold : a cross - sector review of current risk management processes via a detailed firm self - assessment questionnaire and bespoke voluntary vulnerability testing, known as cbest 4. the conclusions we have drawn from this work can be broken down into three core areas : 1. defensive capabilities http : / / www. bankofengland. co. uk / publications / documents / records / fpc / pdf / 2013 / record1307. pdf. http : / / www. bankofengland. co. uk / publications / pages / fsr / 2015 / jul. aspx. http : / / www. bankofengland. co. uk / financialstability / fsc / pages / cbest. aspx. bis central