benoit cœure : cyber resilience for financial market infrastructures speech by mr benoit cœure, member of the executive board of the european central bank, at the workshop on the cpmi - iosco guidance on cyber resilience for financial market infrastructures, frankfurt am main, 13 january 2016. * * * ladies and gentlemen, let me start by expressing my appreciation to the european system of central banks ’ payment and settlement systems committee for taking the initiative to organise this workshop on cyber resilience and to the representatives of other authorities and the financial market infrastructures ( fmi ) community for coming here today to discuss with us this very important topic in the international agenda. financial stability usually conjures up questions about capital and liquidity and the network of financial exposures and interdependencies that make up the financial sector. but the sector is an operational network too. on a daily basis it delivers financial intermediation between market participants and end users, whether the transmission of salaries and other payments from one bank account to another or the settlement of market transactions through a web of settlement banks, clearing houses, settlement systems and custodians. as overseers of fmis, we need to ensure that each of the nodes in this network is operationally resilient and in a position to provide the services that are important to the system as a whole. we also need to ensure that where disruptions do occur, firms can continue to operate or recover quickly, minimising any adverse impact on the functioning of the system as a whole. fmis play a critical role in promoting the stability of the financial system, and the world in which they operate is evolving and changing rapidly. computing and digitalisation are becoming increasingly pervasive and enhancing nearly all aspects of personal life and business, creating more opportunity for innovation, but also more and more threats. industry leaders and authorities alike consider cyber risks as a top priority. and so, what about cyber risk? well cyber presents new challenges. it is not a game against nature. unlike other causes of operational disruption like fires and floods, we know there are agents out there – criminals, terrorist organisations – that have the will, if not necessarily the means, to attack and exploit the system. motivations vary. more often than not they are economic – to defraud banks or their customers or to extract information. but we have seen cases where the motivation is to damage the system, either to destroy data or cause non

##availability of systems or both. the capabilities of these actors, and thus the nature of the threat, are rapidly evolving – barriers to entry are low in cyber space and attacks are readily scalable. low level attacks are now not isolated events but continuous. unlike physical attacks that are localised, these attacks are international and know no boundaries. add to this, the cyberattack surface is rapidly growing : • in 2015, there were 3 billion digital users, and by 2019, this will increase to 4 billion ; • in 2015, there were 3. 3 billion smartphone connections, which will increase to 5. 9 billion in 2020 ; • in 2015, there were 16. 3 billion ip - connected devices, which will increase to 24. 4 billion by 2019 ; • and it is estimated that network traffic will more than double from 2015 to 2019. the routes for exploitation and potential disruption are therefore clearly increasing. furthermore, the threat to fmis is increasing. fmis represent critical infrastructure to the financial system. in a recent survey on critical infrastructures, more than 70 % thought bis central bankers ’ speeches cybersecurity threats to their organization are increasing ; and 48 % found it likely that a cyberattack will take down their critical infrastructure. cyber defence as a result has become not a matter of designing a hard perimeter that can repel attacks but detecting where networks have been penetrated and responding effectively where this occurs. as it changes and multiplies, cyber is elusive, hard to define and to measure. it is clear that the risk is on the rise and a growing cause of concern to industry and authorities alike. it is within this context that the committee on payments and market infrastructures ( cpmi ) and the board of the international organization of securities commissions ( iosco ) joined their efforts in developing the guidance on cyber resilience for financial market infrastructures which you will discuss today. 1 from the outset, this guidance is aimed towards financial market infrastructures, overseers, supervisors and authorities, making it clear that our response to cyber risk must be a collective and united effort, based on a partnership model. this is why on the side of cpmi and iosco we seek the views of the industry through a public consultation, and hence this workshop is an important opportunity to bring us all together for some shared reflections during the consultation period. the cpmi - iosco guidance is the first set of internationally agreed principles in the field of financial markets and institutions to support consistent and effective