Lloyds Banking Group has become the first big UK bank to complete the Bank of England’s cyber-stress test, headed up by the Financial Policy Committee.
The country’s 36 systemically most important financial institutions have been asked to complete the exercises this spring, so that a report can be issued over the summer. That will be followed by a transatlantic cyber exercise, organized by US and UK authorities, which will test the vulnerabilities of large financial institutions of both countries in a coordinated way.
In response to the Financial Policy Committee’s recommendation to test and improve bank resilience, Andrew Gracie, executive director of resolution at the Bank of England, formally launched a new framework last fall to help identify areas where the financial sector could be vulnerable to sophisticated cyber-attack.
The framework, called CBEST, uses intelligence from government and accredited commercial providers to identify potential attackers to a particular financial institution. It then replicates the techniques that potential attackers use in order to test the extent to which they may be successful in penetrating the defenses of the institution. On completion of the tests there will be workshops for the firm to work through the results with the testers and supervisors.
Banks started going through the process—which takes six weeks to three months—in January, according to the Financial Times. So far Lloyds is the only one to complete the gauntlet, but Barclay’s is in the middle of it, as are others.
After they understand where they are vulnerable, they will then be better prepared to implement remediation plans. The inclusion of specific cyber-threat intelligence will ensure that the tests replicate, as closely as possible, the evolving threat landscape and therefore will remain relevant.
“The idea of CBEST is to bring together the best available threat intelligence from government and elsewhere, tailored to the business model and operations of individual firms, to be delivered in live tests, within a controlled testing environment,” Gracie said. “The results should provide a direct readout on a firm’s capability to withstand cyber-attacks that on the basis of current intelligence have the most potential, combining probability and impact, to have an adverse impact on financial stability.”
FT noted that a survey by professional services firm PwC found that 81% of large organizations suffered a cybersecurity breach last year, costing them each £600,000-£1.1m on average. Nonetheless, Ollie Whitehouse, technical director of NCC Group, which is authorized to carry out the tests, said that some financial institutions are reluctant to participate in the resilience testing.
“With anything that is new there is always a certain amount of anxiety,” he told FT. “There is a question of how they do against competitors as security is a key differentiator in financial services.”