steven maijoor : managing climate and environmental related risk stepping up the pace speech ( virtual ) by mr steven maijoor, executive director of supervision of the netherlands bank, at afore consulting's 7th annual fintech and regulation conference, 8 february 2023. * * * hello everyone. almost ten years ago, in 2014, an article on'the secret life of passwords'was published in the new york times. 1 the author of the article, ian urbina, was fascinated by what people use as passwords. and after collecting stories about passwords for some time, he heard about scholarly research on a gigantic password hack. a few years earlier, in 2009, a database of 32 million passwords had been published on the internet. and this triggered a group of academic researchers from the university of ontario institute of technology to start analysing the database. not only with a security focus, but also with a linguistic, psychological and anthropological focus. and they found that for every ten passwords, one turned out to be a name, or a name plus a year. for every 1000 passwords, two turned out to be the word - " password ". and the most commonly used verb turned out to be to " love " – tellingly, more often in combination with a man's name than with a woman's. none of these popular passwords are safe options, of course. so it is no wonder that the overall conclusion one of the researchers drew, was not overly optimistic. he was worried about the fate of our privacy. to him, " the database made clear that humans really are the weak link when it comes to data security. " this was almost ten years ago. a lot has happened since then. today, when you log in on your device, you often still use a password, but probably in combination with facial recognition, fingerprints, or a piece of unique hardware. unfortunately, however, humans remain the weak link in data security. last year's global risks report from the world economic forum2 says that 95 percent of cybersecurity issues can be traced back to human errors. the report also says that, in 2020, there was an increase of 435 percent in ransomware compared to 2019. many of you are probably familiar with the ransomware attack on a big american insurer a few years ago. this insurer ultimately had to pay 40 million dollars to retrieve its data and regain control of its systems. the report also says

##ness, dependency and concentration along with it, the more difficult it becomes for a financial institution to estimate if, how and when it runs the risk of a cyberattack. let me now turn to the netherlands. in its studies from 2021 and 2022, de nederlandsche bank found that, on average, five percent of financial institutions in the netherlands had to deal with the repercussions of a successful cyberattack at some point. " successful " in this case does not necessarily mean that corporate operations were in danger or that data was stolen, but it does mean that there was a security breach. 2 / 5 bis - central bankers'speeches but overall, it remains hard to pinpoint exactly how many cyberattacks occur in the netherlands, and what the success rate is. so that begs the question : how well - prepared for cyberattacks is the dutch financial sector? the tiber - nl program, developed and coordinated by de nederlandsche bank, gives us an idea. tiber is short for threat intelligence - based ethical red teaming. financial institutions participate voluntarily in staged test attacks, using them to gauge their cyber resilience. the aim is to gain insight into strengths and weaknesses, and to identify areas for improvement. afterwards, they share experiences and improvement plans with other institutions. over the past five years, de nederlandsche bank has coordinated over 40 tiber tests on vital dutch institutions. and in many of the cases, ethical hackers successfully accessed critical parts of the financial institutions'systems. the results of the tiber tests have led financial institutions to take measures to increase their cyber resilience. but the results also tell us that we need to remain vigilant at all times. i am pleased that our tiber program has inspired the european central bank to draw up the tiber - eu framework. this is important. because increasing cyber resilience will, at least partly, need to happen on a european level. simply because cyberattacks know no borders. that is why i am also very pleased with the finalisation of the digital operational resilience act – dora. from 2025 onwards, financial institutions will have to comply with this european regulation aimed at increasing cyber resilience. this means, among other things, that third parties will have to comply with certain cyber security criteria. hence, they will become part of the supervisor's scope. with tiber, we already have an instrument that supervisors could use to