Cyber Resilience in Financial Services: A Collaborative Approach to Strengthen the Ecosystem
A fresh perspective on cyber resilience has emerged, prompting a call for a collaborative approach among financial institutions, supervisory bodies, and specialized providers. According to a recent whitepaper by CREST, a global non-profit organization dedicated to cybersecurity accreditation, this resilience should not be viewed as the sole responsibility of individual institutions. Instead, it should encompass the broader ecosystem that supports financial services.
The whitepaper, titled Cyber Resilience in Financial Services: A Whole Ecosystem Approach, provides an insightful framework that outlines a maturity pathway for jurisdictions to evaluate their cyber capabilities. This evaluation is essential for establishing coordinated improvements across three critical domains, as noted in the document published on October 29.
The CREST whitepaper emphasizes that vulnerabilities in shared infrastructures—or those stemming from technology providers, cyber firms, or public authorities—can jeopardize the robustness of the entire financial system. By recognizing the interconnectedness of these entities, stakeholders can better address the challenges posed by cyber threats.
The Three Domains of Financial Cyber Resilience
Central to CREST’s framework are three distinct domains, each assigned specific roles and responsibilities. Financial institutions are primarily tasked with the protection of critical business services, ensuring that their cybersecurity controls are effective even under duress. This is crucial, as the ability to withstand cyber threats directly impacts not only individual organizations but the stability of the financial landscape as a whole.
In addition, financial supervisors hold the critical responsibility of establishing appropriate expectations for individual firms while overseeing their activities. They must also develop an understanding of systemic risks that may arise from interconnected relationships between various entities. This comprehensive oversight is vital for maintaining trust and security within the financial services sector.
Meanwhile, cyber service providers play an essential role by delivering specialized advice, assessments, threat intelligence, testing, and incident response capabilities. These providers are tasked with arming financial institutions with the resources needed to proactively tackle cyber threats.
A Pathway to Cyber Maturity
CREST’s framework delineates a progression through five stages of cyber maturity across all three domains. The progression for financial institutions begins with basic hygiene and evolves through more sophisticated capabilities, including advanced, threat-led assurance and continuous improvement practices. For supervisors, the journey starts with basic mapping and evolves towards adaptive, cross-sector oversight. Cyber service providers, on their part, also progress from offering unvalidated services to specializing in financial-sector capabilities.
It is important to note that CREST aims to provide illustrative pathways rather than introduce a stringent compliance standard. Their focus is on establishing an ecosystem-wide measurement of maturity, promoting a shared language across the domains, and facilitating swift development in areas lagging behind.
Multi-Year Cyber Maturity Programs
In urging for a sustainable development approach, CREST recommends that supervisors or market participants institute multi-year programs that encourage synchronized growth across the three domains. A concern is highlighted that pushing requirements too quickly may not yield adequate assurances and could lead to significant vulnerabilities.
The roadmap outlined by CREST spans ten years and commences in the initial two years with institutions identifying critical services while closing immediate gaps in basic hygiene. Concurrently, supervisors are encouraged to publish baseline measures and strategic plans that guide future advancements.
The next phase, covering years three to five, focuses on independent assessments and risk-based testing for institutions, alongside tiered requirements from supervisors and independent accreditation for service providers. The final phase, reaching out five to ten years, emphasizes threat-led penetration testing and system-wide exercises supported by a diverse community of accredited specialists.
The whitepaper also cautions against rushing into mandates requiring the highest international accreditations, which could inadvertently exclude local providers lacking a route to such accreditation. CREST advocates for alternative measures, including mentoring, partnerships, training programs, and initiatives like the Cyber Accelerated Maturity Programme (CREST CAMP) to bolster local capabilities.
"The robustness of the financial ecosystem depends on the collective strengths and capabilities of financial institutions, supervisors, and cyber service providers," stated CREST CEO Nick Benson. This collaborative approach not only enhances individual institutions but ultimately fortifies the financial services landscape against the growing threat of cyber-attacks.