bank is required to have a convincing one. in summary, we do not expect bank ceos to understand each and every technical detail – but it is the overall responsibility of the management board to manage the risks in an adequate way. they need to have a concrete idea of what is at stake. this might be an unavoidable obligation for executives, but at the same time investing appropriately in cyber security will frequently pay off handsomely. 5. beyond sector limits ladies and gentlemen, the internet has become one of our constant companions – by the same token, cyber defence must become one as well. as i said earlier, actual resilience requires deliberate action in each company from the top down. let me reiterate a few key tasks for senior management : recognise cyber risks as part of your risk appetite and define a convincing and comprehensive cyber strategy ensure that responsibilities remain clear in a changing cyber and corporate environment raise awareness among your staff and set an example in promoting secure cyber behaviour a holistic cyber defence will not emerge bottom - up from your it department – you need to lead towards it. this applies to all industries, but also very much to the financial sector. bis central bankers ’ speeches i have omitted one success factor so far. one that transcends sector limits. i am referring to cooperation for mutual learning. to quote an old proverb : wise men learn by other men ’ s mistakes ; fools by their own. we can benefit a lot from others ’ experience across industries and national boundaries. the bundesbank is a member of up - kritis, a platform for providers of critical infrastructure to exchange ideas and information. we have also launched international exchange on cyber defence, for example with the federal reserve bank of new york. merging defence capacities is a good reason for voluntary collaboration. still, i detect resistance in some institutions, partly because of the delicate issues involved, and partly because of a lack of trust and out of reputational concerns. however we should try to find ways to overcome those barriers – with cyber criminals collaborating globally, our success might depend on us following suit. thank you. bis central bankers ’ speeches

recently accessed on 8 february 2016 ] at : http : / / usa. marsh. com / portals / 9 / documents / benchmarkingtrendscyber8094. pdf. bis central bankers ’ speeches customers, yet at the same time the additional layer of security imposes a higher hurdle for cyber criminals to clear authentication. third, defending from cyber risks is by no means trivial, but requires a considerable degree of foresight and ingenuity. threats are constantly evolving. in order to control and mitigate cyber risk, banks are even starting to use big data to discover unusual patterns that point to a cyber attack. from a governance point of view, setting the right priorities can make a huge difference. we have seen cases in which banks expend a lot of resources on deterring sophisticated assaults while omitting the most basic of measures. i am especially referring to a factor which is still highly underappreciated : the human factor. for humans are often the weakest link in it processes. targeting “ digital carelessness ” among customers and staff is usually a good way to achieve fast results in mitigating risk. 4. how to cope with cyber risks these insights have been incorporated into regulatory and supervisory practice. unsurprisingly, regulation cannot give a detailed prescription for cyber security, because the cyber environment is so agile that technical details can quickly become obsolete. in addition, there is no one - size - fits - all solution that can cover the diversity of the types and sizes of institutions. there are, of course, concrete elements for cyber defence that would not be out of place on a checklist for any institution : network plans with appropriate security layers, contingency and recovery plans and a well - conceived update management, to name some important items. but indeed, there is more to cyber resilience than a functional first line of defence. it requires responses to new as well as unknown circumstances that at the same time maintain the functional viability of an institution. this gives senior management a lot of room for manoeuvre. the tone from the top is instrumental in raising staff awareness of security issues. also, companies and organisations are evolving constantly. managing responsibilities is thus key. this includes breaking down the “ accountability firewall ”, where nobody assumes responsibility for the many intersecting aspects of cyber risk. we therefore demand that banks clarify what is at stake and how the risks are supposed to be governed. this is called a cyber strategy, and every