BoE launches new framework to test for cyber vulnerabilities

10 June 2014

In a speech Andrew Gracie, Executive Director at the Bank of England, formally launched a new framework to help identify areas where the financial sector could be vulnerable to sophisticated cyber-attack.

The new framework called CBEST uses intelligence from Government and accredited commercial providers to identify potential attackers to a particular financial institution. It then replicates the techniques these potential attackers use in order to test the extent to which they may be successful in penetrating the defences of the institution. On completion of the test there will be workshops for the firm to work through the results with the testers and supervisors.

CBEST provides the following:

• access to considered and consistent cyber threat intelligence, ethically and legally sourced from organisations that have been assessed against rigorous standards;
• access to knowledgeable, skilled and competent cyber threat intelligence analysts who have a detailed understanding of the financial services sector;
• realistic penetration tests that replicate sophisticated, current attacks based on current and targeted cyber threat intelligence;
• standard key performance indicators that can be used to assess the maturity of the organisation’s ability to detect and respond to cyber-attacks; and
• access to benchmark information that can be used to assess other parts of the financial services industry.

The combination of these will allow a firm to understand where they are vulnerable. They will then be better prepared to implement remediation plans. The inclusion of specific cyber threat intelligence will ensure that the tests replicate, as closely as possible, the evolving threat landscape and therefore will remain relevant.

CBEST differs from other security testing currently undertaken by the financial services sector because it uses real threat intelligence and focuses on the more sophisticated and persistent attacks on critical systems and essential services. The implementation of CBEST will help the boards of financial firms, infrastructure providers and regulators to improve their understanding of the types of cyber-attack that could undermine financial stability in the UK, the extent to which the UK financial sector is vulnerable to those attacks and how effective the detection and recovery processes are.

Full news

Full speech

© Bank of England