A new intelligence-sharing network aims to protect financial institutions by sharing information between government, security firms and financial institutions to “predict” vulnerabilities, according to a report by Information Age.
The move, announced by the Bank of England in a statement and launched by Bank of England Executive Director for Resolution Andrew Gracie in a speech to the British Banker’s association, aims to bring together intelligence from government agencies, security firms and financial institutions.
The organization will use these to mimic the tactics used by cyber criminals, and work out which firms are vulnerable, according to a report by The Register.
The CBEST statement says that the new framework aims to form, “a common framework that delivers a controlled, bespoke, intelligence-led penetration test against financial institutions’ critical systems. Critical systems are those which are essential to the well-being of the institution and the UK financial system as a whole.”
“The idea of CBEST is to bring together the best available threat intelligence from government and elsewhere, tailored to the business model and operations of individual firms, to be delivered in live tests, within a controlled testing environment,” Gracie said.
“The results should provide a direct readout on a firm’s capability to withstand cyber-attacks that on the basis of current intelligence have the most potential, combining probability and impact, to have an adverse impact on financial stability.”
According to IT Pro’s report, the framework will focus on “systemically important” services, with the aim of fending off “sophisticated attacks.”
“Although existing penetration testing services in the financial services sector have provided a good level of assurance against traditional attacks, they do not address more sophisticated cyber attacks on critical assets,” said Ian Glover, president of CREST, according to Computer Weekly‘s report. “CBEST tests have been designed to replicate the behaviours of serious threat actors, assessed by Government and commercial intelligence providers as posing a genuine threat to important financial institutions.”
According to the Bank of England, CBEST is the first initiative of its type to be led by any of the world’s central banks.
“CBEST differs from other security testing currently undertaken by the financial services sector because it is threat intelligence based, is less constrained and focuses on the more sophisticated and persistent attacks against critical systems and essential services,” the organization said. “The inclusion of specific cyber threat intelligence will ensure that the tests replicate as closely as possible the evolving threat landscape and therefore will remain relevant and up to date.”
Author Rob Waugh, We Live Security