Bank of England receives ‘7 or 8 cyber attacks a week', says CISO

The Bank of England is fending off regular attempts to hack its into systems each week, with hactivists and nation states the most common culprits.

"We get on average around eight incidents a week, and we are a central bank that is pretty small in number - around 4,000 people," said Don Randall MBE, chief information security officer at the Bank of England, speaking at the Institute of Risk Management's Cyber Risk 2014 Summit. "To date, none of these have caused any major harm - but they [cyber criminals] are definitely looking at it."

The weekly attacks include two or three denial of service attempts on average, some of which go through a service provider, as well as malware attacks such as spearphishing.

According to Randall, the majority of attacks are believed to be from hacktivists and nation states, rather than criminals attempting to hack systems for financial gain, which are more likely to target the UK's retail banks.

"I am not really troubled about serious organised crime at the Bank of England, but if I was one of the banks I would be more so. I am more worried about state actors, and hactivists, or someone who is just fed up with the Bank of England."

Monitoring international tensions

He added that part of the Bank of England's security strategy has involved hiring an analyst to monitor international politics.

"I introduced a geopolitical analyst into my cyber analytical team because I want to understand what is going on in the world. I want to know, if Ukraine and Russia kick off, what are the geographical and political implications of one of those combining with another party to attack the financial sector - either from a central bank or a retail bank perspective, or for national infrastructure."

Randall also warned that, despite recent efforts to create a more concerted approach to sharing and gathering security intelligence throughout the sector, more needs to be done to gather data on cyber attacks - even if they are not successful. This will help authorities in developing a better knowledge of the scale of threat facing businesses in the UK, he said.

"We don't have a repository to collectively gather that information, and that is a weakness.

"I know we have CISP, CERT UK, the NCA, the National Fraud Investigation Bureau, and Action Fraud is now part of the City of London Police. But we have got to find a way of joining this up and understanding the [cyber attack] attempts and suspicions because that is how we get the knowledge, and we don't have that at the moment."

Earlier this week the Bank of England announced the launch of a new cyber security testing framework that is aimed at improving the defences of UK banks and understanding the level of risk.