An international strategy
To achieve more effective protection of the global financial system against
cyber threats, the Carnegie Endowment for International Peace released a
report in November 2020 titled “International Strategy to Better Protect
the Global Financial System against Cyber Threats.” Developed in
collaboration with the World Economic Forum, the report recommends specific
actions to reduce fragmentation by fostering more collaboration, both
internationally and among government agencies, financial firms, and tech
companies.
The strategy is based on four principles: first, greater clarity about roles and responsibilities is required. Only
a handful of countries have built effective domestic relationships among
their financial authorities, law enforcement, diplomats, other relevant
government actors, and industry. Existing fragmentation hampers
international cooperation and weakens the international system’s collective
resilience, recovery, and response capabilities.
Second, international collaboration is necessary and urgent. Given
the scale of the threat and the system’s globally interdependent nature,
individual governments, financial firms, and tech companies cannot
effectively protect against cyber threats if they work alone.
Third,
reducing fragmentation will free up capacity to tackle the problem.
Many initiatives are underway to better protect financial institutions, but
they remain siloed. Some of these efforts duplicate each other, increasing
transaction costs. Several of these initiatives are mature enough to be
shared, better coordinated, and further internationalized.
Fourth,
protecting the international financial system can be a model for other
sectors.
The financial system is one of the few areas in which countries have a
clear shared interest in cooperation, even when geopolitical tensions are
high. Focusing on the financial sector provides a starting point and could
pave the way to better protection of other sectors in the future.
Among actions for strengthening cyber resilience, the report recommends
that the FSB develop a basic framework for supervising cyber risk
management at financial institutions. Governments and industry should
strengthen security by sharing information on threats and by creating
financial computer emergency response teams (CERTs), modeled on Israel’s
FinCERT.
Financial authorities should also prioritize increasing the financial
sector’s resilience against attacks targeting data and algorithms. This
should include secure, encrypted data vaulting that allows members to
securely back up customer account data overnight. Regular exercises to
simulate cyberattacks should be employed to identify weaknesses and develop
action plans.
To reinforce international norms, the report recommends that governments
make clear how they will apply international law to cyberspace and
strengthen norms to protect the integrity of the financial system. The
governments of Australia, The Netherlands, and the United Kingdom have
already taken a first step with statements indicating that cyberattacks
from abroad may be regarded as illegal use of force or intervention in the
domestic affairs of another state.
Cyber resilience and strengthened international norms can facilitate
collective response through law enforcement actions or multilateral
reaction with industry. Responses can include sanctions, arrests, and asset
seizures.
Governments can support these efforts by establishing entities to assist in
assessing threats and coordinating responses. Intelligence gathering should
include a focus on threats to the financial system, and governments should
share such intelligence with allies and like-minded countries.