of putting all their eggs in one basket, this creates a concentration risk that should not go unnoticed. there are cases where these concentration risks cannot be avoided, but this should then go hand in hand with tougher requirements for cyber resilience. further, the ecb insists that banks should employ enough sufficiently skilled staff to monitor and oversee their outsourced activities. in 2017, the ecb also set up a cyber incident reporting process. the information on incidents reported by banks is used by the ecb to identify and monitor trends, and to facilitate a fast reaction of the ecb in the event of a major cyber incident affecting one or more significant institutions at the same time. the number of reported cyber incidents has been rather low, the most frequent type being distributed denial of service attacks ( ddos ). other reported incidents were related to unauthorised access, accidental data leakage and phishing attacks. in many cases, there was a delay between the onset of the attack and its detection. finally, we see that attackers gained access to banks ’ systems by exploiting both technological vulnerabilities, such as missing it security measures, and human ones, such as insufficient staff awareness. although the number of reported cyber incidents has been rather low, i would not dare to conclude cyber threat levels are low, or even decreasing. i rather think that it is a matter of time until we experience a major attack. ecb banking supervision will continue to monitor it and cyber risks facing banks ; we will continue to push for and request banks ’ resilience to and preparedness for cyber threats. and we will of course continue to engage and cooperate with a number of other institutions and agencies. conclusion ladies and gentlemen, as you may guess from my brief remarks today, we have a great deal of work ahead of us. sharing information, knowledge and expertise among public institutions and with the industry will be essential. in this respect, events like today ’ s have a valuable role to play. i look forward to our discussion. 1 committee on payments and market infrastructures and the board of the international organization of securities commissions. 3 / 3 bis central bankers'speeches

sabine lautenschlager : towards a more cyber secure financial system - the role of central banks statement by ms sabine lautenschlager, member of the executive board of the european central bank, at the g7 2019 conference on " cybersecurity : coordinating efforts to protect the financial sector in the global economy ", paris, 10 may 2019. * * * as we all know, cyber threats to the financial sector are continuously evolving and becoming ever more sophisticated. the attackers – whether they be 16 - year old script kiddies, hacktivist groups or even nation states – are dynamic and agile. they have different reasons for targeting the financial sector, but they each have the potential to cause disruption. besides stealing money and data, they can undermine confidence in the entire financial system. so what can we, as public authorities, do? as the central banker on this panel, i will, of course, focus on what central banks can do. i will first outline some key trends in the financial sector, which make it vulnerable to cyber threats. i will then share some of the insights gained from the ecb ’ s key initiatives on cyber risk. trends in the financial sector we see a number of trends in the financial sector related to cyber risk : first, the close interconnection and complexity of the financial system creates vulnerabilities which can be exploited by cyber attackers. second, attackers seem to be gaining an ever deeper understanding of how the financial system operates. this enables them to swiftly detect and exploit weaknesses more efficiently and should be a concern for us all. third, both banks and financial market infrastructures are struggling to find staff with the skills and experience needed to fend off cyber - attacks. indeed, the skills gap extends well beyond the financial sector. all relevant stakeholders need to urgently work on strategies to make sure that our workforce has the right skills for our future economies, and that our society is able to reap the benefits of innovation. finally, true innovation is always disruptive. fintech might disrupt financial markets in positive ways. but it also comes with risks : fiercer competition could lead some market players to embrace and adopt new technologies, services or methods before fully grasping the related risks – cyber - risks in this case. let me point to some information and knowledge we have gathered at the ecb in our banking supervisory function as well as in our oversight function for financial market infrastructures. we do see room for improvement at banks and financial market infrastructure