Cyber Security and the Financial Sector David Whyte

Cyber Security and the Financial Sector David Whyte – Head of Cyber Resilience Coordination Centre Restricted

The cyber threat landscape has evolved l Democratization of sophisticated attack tools l Crimeware as a Service Caa. S l Vulnerability “research” for sale – zer 0 -day exploits Restricted 2

The cyber threat landscape has evolved l Democratization of sophisticated attack tools l Crimeware as a Service Caa. S l Vulnerability “research” for sale – zer 0 -day exploits Restricted 3

Interstitial threats Restricted 4

Interconnections Restricted 5

Interconnections Henry Ford tried stockpiling parts and materials, but found that the inventory costs were too high. The answer, he decided, was total control: owning the whole supply chain. By the 1920 s his company ran coal and iron ore mines, timberlands, rubber plantations, a railroad, freighters, sawmills, blast furnaces, a glassworks, and more. Capping it all was a giant factory at River Rouge, Michigan (pictured), which built the parts and assembled the cars. Restricted 6

The threat landscape is evolving – dwell time Evidence subsequently discovered has shown that the targeting of banks in Bangladesh by the subjects began as early as October 7 and 8, 2014, i. e. , before the attack on SPE became overt and more than a year before the cyber-heist at Bangladesh Bank. Restricted 7

Cyber security services for the central bank community Cyber Resilience Coordination Centre (CRCC) § The overall objective of the CRCC is to provide a structured and trusted approach to knowledge sharing and collaboration among central banks in the quest to build cyber resilience. Current activities include: Restricted 8

Cyber range simulation exercises • • Customized hands-on training for central bank personnel Exercise network (and generated datasets) can be used for applied research • • • Increased ability for staff to deal with and coordinate during a major cyber event Complement to tabletop training exercises Test security teams readiness for handling major incidents • Realistic simulations with media and roleplaying injects for an ‘immersive’ experience Restricted 9

Cyber range – why? l Further sharpen Central Banks Cyber defence skills l Test security teams readiness for handling major incidents l Enhance collaboration between security personnel in CBs The Cyber Range is part of the Innovation BIS 2025 strategy Cyber Resilience Coordination Center Restricted 10

Cyber resilience framework (CERT RMM) • • • Non-proprietary customized cyber resilience framework Stronger cyber security posture Inform technology/ security/process investments • • Self-assessment of cyber security posture Ability to undertake a common benchmarking exercise across the central bank community Restricted 11

Resilience l “The emergent property of an organization that can continue to carry out its mission after disruption that does not exceed it’s operational limit” Asset Sustain Keep assets from exposure or disruption Keep assets productive during adversity Manage Condition Manage Consequence Manage Risk Assets Protect People Information Technology Facilities All assets must be protected and sustained to support business objectives * Adapted from CERT Resilience Management Model (RMM) Restricted 12

Cyber resilience l Cyber resilience is an element of the broader Operational Resilience ‘operational resilience’ goals of the organization Cyber 10 Process Areas Goals Practices 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. Asset Management Control Management Configuration and Change Management Vulnerability Management Incident Management Service Continuity Management Risk Management External Dependency Management Training and Awareness Situational Awareness What to do 13 Practices for institutionalization Making it stick A subset of the CERT-RMM focused on cyber resilience. Developed by SEI-CERT at Carnegie Melon University * Adapted from CERT Resilience Management Model (RMM) Restricted 13

Collaboration Explain portal this point in a few sentences. An infographic doesn’t necessarily mean you aren’t allowed to use words. • • Facilitate a secure, interactive, trusted information sharing platform (persistent chat) Forums – self-organizing communities of interest Bi/tri/multilateral sharing opportunities Technology forum to discuss disruptive technology/ cyber security implications • • Ability to leverage scarce cyber security skills Catalogue of current intrusions and emerging threats Restricted 14

Threat data != threat intelligence Threat Intelligence Threat Context Threat Data Restricted 15

Operational usages of cyber threat intelligence – sounds great! l Automated Defences: in-line NRT blocking l Early warning l Ex-post retrospective analysis l Security posture adjustments (MITRE ATT&CK) l Cyber threat hunting (CTH) Restricted 16

So what are the operational challenges? Detection techniques must have the necessary fidelity to enable nonhuman-in-the-loop automated defences § Response speed: 75% of attacks spread from Victim 0 to Victim 1 within 24 hours and over 40% hit the second organization in less than an hour * § Volume/Veracity: 6 month study – 54 threat intelligence feeds (inbound/outbound: significant overlap on inbound feeds however >3% overlap on outbound feeds § Context: without context i. e. raw Indicators of Compromise (Io. Cs) you cannot truly attain cyber threat intelligence § Flux: some classes of Io. Cs are only valid for short periods of time (e. g. IP addresses) (2015) *2015. Data Breach Investigations Report Tech. rep. , Verizon enterprise solutions Restricted 17

Operational challenges (continued) l TRUST!!! § Its about malware/TTPs NOT vulnerabilities! l Automated in-line defence – which data sources produce false positives l Is more always better? § Big Data problem (correlation/context) – firehose vs. gardenhose vs. well l Willingness to share – what is the incentive for sharing? What are the costs? l Targeted attacks – useful? Restricted 18

Questions? Restricted 19