Bank of England sends in hackers to test lenders’ defences
The Bank of England is to let hackers loose on Britain’s biggest banks to test their defences against cyber-attacks.
Under the Bank’s new framework, known as CBEST, hackers working for private security firms will identify the vulnerabilities of individual institutions, and replicate the methods of malicious attackers.
The Bank said its simulation would be superior to the digital security checks currently used by financial firms because it would be based on real threat intelligence and focus on the more sophisticated potential attacks on systems.
The move follows last year’s recommendation from the Bank’s Financial Policy Committee to beef up the resilience of the financial system to malicious hacking and cyber-crime.
Andrew Gracie, the Bank’s executive director of resolution, unveiled the new framework at the British Bankers’ Association cyber conference. “The idea of CBEST is to bring together the best available threat intelligence from government and elsewhere, tailored to the business model and operations of individual firms, to be delivered in live tests, within a controlled testing environment,” he said.
“Unlike physical attacks which are localised, these attacks are international and know no boundaries. Cyber defence, as a result, has become not a matter of designing a hard perimeter that can repel attacks but detecting where networks have been penetrated and responding effectively.”
The results, including the extent of the access the licensed hackers gain and the damage they could potentially cause, will be shared with both the individual banks and the Prudential Regulation Authority.
“The results should provide a direct read-out on a firm’s capability to withstand cyber-attacks which – on the basis of current intelligence – have the most potential, combining probability and impact, to have an adverse impact on financial stability” Mr Gracie said.
The industry will not be forced to take part but the Bank, which unveiled CBEST unofficially two weeks ago, has seen strong interest from financial institutions. It will cost a bank about £100,000 to have its systems tested under the new regime, which cost about £200,000 to develop.
The internet security giant McAfee has estimated the global cost of cyber-crime at £266bn. In December, the Royal Bank of Scotland said its platform was briefly attacked by hackers, causing problems for customers trying to get access to their accounts.
The Bank expects to have 18 testing companies and nine intelligence firms accredited to carry out the tests after working with the Council for Registered Ethical Security Testers and the intelligence firm Digital Shadows to develop new industry standards.
The Bank told City firms in February they needed to act more quickly and report to regulators in more detail if they became subject to cyber-attacks from criminal gangs or terrorists. The warning followed a three-day exercise, Waking Shark II, which simulated an attack on the City.
Returning to the stage after 20 years makes actress feel 'nauseous'
Top conservatoire offers ‘groundbreaking’ arts degree
- 1 Scottish independence: Ireland since 1919 is a lesson for Scotland in what a Yes vote means
- 2 A bottle of wine a day is not bad for you and abstaining is worse than drinking, scientist claims
- 3 Grandmas keep accidentally tagging themselves as Grandmaster Flash on Facebook
- 4 Daniele Watts: Django Unchained actress detained by Los Angeles police after being mistaken for a prostitute
- 5 Kanye West halts concert after two fans don't stand up - doesn't realise one is in wheelchair and the other disabled
Islamic State: Pope is 'being targeted by Isis', Iraqi ambassador to the Holy See warns
Jennifer Lawrence and Kate Upton nude pictures exhibition cancelled after artist concedes photos were 'stolen property'
Scottish independence referendum: A nation divided against itself
John Travolta addresses former pilot's gay romance allegations publicly for the first time: 'That was the lowest I'd ever felt'
Richard III: Two years after his body was found scientists discover how he died
Daniele Watts: Django Unchained actress detained by Los Angeles police after being mistaken for a prostitute
The political class is doing what Hitler couldn’t – destroying Britain
Scottish independence: Nationalist leader Jim Sillars threatens pro-union companies with 'day of reckoning' after independence
Scottish independence: Yes campaign feels the heat as Alex Salmond's NHS claims come under furious attack
Portuguese academic says British are 'filthy, violent and drunk'
£23m Birmingham cycle scheme is attacked by Tory councillor for not catering to the elderly
iJobs Money & Business
£20000 - £25000 per annum + OTE £35,000 first year: SThree: The SThree group i...
£20 - 24k (Uncapped Commission - £35k Year 1 OTE): Guru Careers: We are seekin...
£20 - 24k + Benefits: Guru Careers: This is a great opportunity for an enthusi...
£280 - £320 per day: Ashdown Group: The Ashdown Group have been engaged by a l...