Bank of England launches cyber security test framework

The Bank of England has created a cyber intelligence network and testing framework to help identify where the banking sector is most vulnerable to cyber attacks.

The CBEST framework will bring together expertise from government and the private sector to help improve defences against an increasingly mature cyber threat.

It was developed alongside the Council for Registered Ethical Security Testers (CREST), a not-for-profit organisation that represents the technical information security industry, Her Majesty's Treasury and the Financial Conduct Authority (FCA), as well as cyber intelligence firm, Digital Shadows.

Speaking at a British Bankers' Association event today, Andrew Gracie, executive director for resolution at the Bank of England, said: "The idea of CBEST is to bring together the best available threat intelligence from government and elsewhere, tailored to the business model and operations of individual firms, to be delivered in live tests, within a controlled testing environment,"

"The results should provide a direct readout on a firm's capability to withstand cyber-attacks that on the basis of current intelligence have the most potential, combining probability and impact, to have an adverse impact on financial stability."

The framework will help improve understanding of the fast-evolving cyber threat among banks at board level, with banks coming under increasing attack from cyber criminals, nation states and hacktivists. A recent survey by PwC, 70 percent of bank CEOs identify cyber security as a threat to their growth prospects, and the Bank of England has previously indicated that several major banks have had services disrupted due to attacks.

According to the Bank of England CBEST will differ from other security testing, because it uses real threat intelligence and "focuses on more sophisticated and persistent threats on critical systems and essential services".

"Although existing penetration testing services in the financial services sector have provided a good level of assurance against traditional attacks, they do not address more sophisticated cyber attacks on critical assets," said Ian Glover, president of CREST. "CBEST tests have been designed to replicate the behaviours of serious threat actors, assessed by Government and commercial intelligence providers as posing a genuine threat to important financial institutions."

The announcement forms part of the Bank of England's response to the Financial Policy Committee's recommendation to test and improve resilience to cyber-attacks, made last year.

In recent months there have been increasing calls for better collaboration between banks, central government, regulators and the private sector to improve cyber defences. The findings of a Bank of England-led cyber security exercise, named Operation Waking Shark, revealed a lack of formal communication channels between banks and the wider sector when cyber attacks occur.