Bank of England launches cyber security test framework

CBEST testing framework will use government intelligence to identify vulnerabilities in financial sector

The Bank of England has created a cyber intelligence network and testing framework to help identify where the banking sector is most vulnerable to cyber attacks.

The CBEST framework will bring together expertise from government and the private sector to help improve defences against an increasingly mature cyber threat.

It was developed alongside the Council for Registered Ethical Security Testers (CREST), a not-for-profit organisation that represents the technical information security industry, Her Majesty's Treasury and the Financial Conduct Authority (FCA), as well as cyber intelligence firm, Digital Shadows.

Speaking at a British Bankers' Association event today, Andrew Gracie, executive director for resolution at the Bank of England, said: "The idea of CBEST is to bring together the best available threat intelligence from government and elsewhere, tailored to the business model and operations of individual firms, to be delivered in live tests, within a controlled testing environment,"

"The results should provide a direct readout on a firm's capability to withstand cyber-attacks that on the basis of current intelligence have the most potential, combining probability and impact, to have an adverse impact on financial stability."

The framework will help improve understanding of the fast-evolving cyber threat among banks at board level, with banks coming under increasing attack from cyber criminals, nation states and hacktivists. A recent survey by PwC, 70 percent of bank CEOs identify cyber security as a threat to their growth prospects, and the Bank of England has previously indicated that several major banks have had services disrupted due to attacks.

According to the Bank of England CBEST will differ from other security testing, because it uses real threat intelligence and "focuses on more sophisticated and persistent threats on critical systems and essential services".

"Although existing penetration testing services in the financial services sector have provided a good level of assurance against traditional attacks, they do not address more sophisticated cyber attacks on critical assets," said Ian Glover, president of CREST. "CBEST tests have been designed to replicate the behaviours of serious threat actors, assessed by Government and commercial intelligence providers as posing a genuine threat to important financial institutions."

The announcement forms part of the Bank of England's response to the Financial Policy Committee's recommendation to test and improve resilience to cyber-attacks, made last year.

In recent months there have been increasing calls for better collaboration between banks, central government, regulators and the private sector to improve cyber defences. The findings of a Bank of England-led cyber security exercise, named Operation Waking Shark, revealed a lack of formal communication channels between banks and the wider sector when cyber attacks occur.

Join the CSO newsletter!

Error: Please check your email address.

Tags Bank of EnglandinfrastructuresecurityTreasury

More about Andrew Corporation (Australia)PricewaterhouseCoopers

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Matthew Finnegan

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place