The Global Cyber Threat to Financial Systems

Source details

Canonical URL

The Global Cyber Threat to Financial Systems

Other formats

• Markdown version
• Structured JSON version
• Bundle manifest

Bibliographic details

• Authors: TIM MAURER, ARTHUR NELSON
• Published: March 1, 2021

Overview

• Cyber threats to the financial system are growing, and the global community must cooperate to protect it.
• Opinions expressed are those of the authors and do not necessarily reflect IMF policy.
• Key illustrative events:
  • In February 2016, hackers targeted the central bank of Bangladesh and exploited vulnerabilities in SWIFT, attempting to steal $1 billion; $101 million disappeared.
  • In February 2020, Christine Lagarde warned that a cyberattack could trigger a serious financial crisis.
  • In April 2020, the Financial Stability Board (FSB) warned that “a major cyber incident, if not properly contained, could seriously disrupt financial systems, including critical financial infrastructure, leading to broader financial stability implications.”
  • The Bank for International Settlements reports the financial sector experienced the second-largest share of COVID-19–related cyberattacks, behind only the health sector.

Threat landscape

• Two ongoing trends exacerbate cyber risk:
  • Rapid digital transformation of the global financial system, accelerated by the COVID-19 pandemic (greater demand for online financial services, remote work, consideration of central bank digital currencies, and modernization of payment systems).
  • Malicious actors exploiting digital transformation; the pandemic has supplied fresh targets.
• Types and actors of concern:
  • Attacks corrupting the integrity of financial data (records, algorithms, transactions) are particularly worrisome because few technical solutions currently exist to address them.
  • Malicious actors include criminals, states, and state-sponsored attackers.
  • The Carbanak group targeted financial institutions to steal more than $1 billion during 2013–18.
  • North Korea has stolen some $2 billion from at least 38 countries in the past five years.
  • Attacks are global and affect low- and lower-middle-income countries, which often leapfrogged to digital financial services and thus present “target-rich” environments.
  • Example: The October 2020 hack of Uganda’s largest mobile money networks, MTN and Airtel, resulted in a major four-day disruption of service transactions.

The responsibility gap

• Despite increasing reliance on digital infrastructure, it is unclear who is responsible for protecting the global financial system.
• The core challenge is organizational and a collective action problem, not primarily a lack of resources or technical capability within the financial community.
• Fragmentation and siloed approaches:
  • Financial supervisors emphasize resilience.
  • Diplomats focus on norms of state behavior.
  • National security agencies seek deterrence of malicious activity.
  • Industry executives focus on firm-specific risks.
• Disconnects between finance, national security, and diplomatic communities impede an effective response; geopolitical mistrust limits cooperation and narrows circles of trust.
• Result: uncertainty about roles and mandates fuels risk and undermines coordinated protection.

International strategy (based on Carnegie Endowment report, November 2020)

• Four guiding principles:
  • Greater clarity about roles and responsibilities is required; only a handful of countries have built effective domestic relationships among financial authorities, law enforcement, diplomats, other relevant government actors, and industry.
  • International collaboration is necessary and urgent given the scale of the threat and the system’s global interdependence.
  • Reducing fragmentation will free up capacity; many initiatives are siloed, duplicate efforts, and raise transaction costs.
  • Protecting the international financial system can be a model for other sectors, as countries have a clear shared interest in cooperation even when geopolitical tensions are high.
• Recommended actions to strengthen cyber resilience and norms:
  • The FSB should develop a basic framework for supervising cyber risk management at financial institutions.
  • Governments and industry should strengthen security by sharing information on threats and by creating financial computer emergency response teams (CERTs), modeled on Israel’s FinCERT.
  • Financial authorities should prioritize resilience against attacks targeting data and algorithms, including:
  • Secure, encrypted data vaulting to allow members to securely back up customer account data overnight.
  • Regular exercises to simulate cyberattacks to identify weaknesses and develop action plans.
  • Governments should clarify how they will apply international law to cyberspace and strengthen norms to protect the integrity of the financial system.
  • Australia, The Netherlands, and the United Kingdom have taken initial steps with statements indicating cyberattacks from abroad may be regarded as illegal use of force or intervention in domestic affairs.
  • Collective response options can include law enforcement actions, multilateral reactions with industry, sanctions, arrests, and asset seizures.
  • Governments should establish entities to assist in assessing threats and coordinating responses, and intelligence gathering should focus on threats to the financial system with sharing among allies and like-minded countries.

Building capacity

• Workforce and talent pipeline:
  • Elevated unemployment due to the pandemic presents an opportunity for training and hiring to strengthen the cybersecurity workforce.
  • Financial services firms should invest in building the talent pipeline through high school, apprenticeship, and university programs.
• International capacity building:
  • The IMF and other international organizations received many requests for cybersecurity assistance, particularly after the 2016 Bangladesh incident.
  • G20 governments and central banks could create an international mechanism to build cybersecurity capacity for the financial sector, with an international agency such as the IMF designated to coordinate.
  • The Organisation for Economic Co-operation and Development and international financial institutions should make cybersecurity capacity building part of development assistance packages and significantly increase assistance to countries in need.
• Protecting financial inclusion:
  • Maintain progress in financial inclusion by strengthening connections between financial inclusion and cybersecurity, especially in Africa where many countries are undergoing significant transformation toward digital financial services.
  • Recommendation: create a network of experts focusing specifically on cybersecurity in Africa.

Conclusion

• The time has come for the international community—including governments, central banks, supervisors, industry, and other relevant stakeholders—to come together to address the urgent challenge.
• A well-thought-out strategy provides a blueprint for turning words into action.

Source: The Global Cyber Threat to Financial Systems – IMF F&D (March 2021), Tim Maurer and Arthur Nelson.

Content in this bundle

• التهديد السيبراني العالمي
  • التهديد السيبراني العالمي (Markdown version)
  • التهديد السيبراني العالمي (PDF)
• 全球网络威胁 - 金融与发展 - 国际货币基金组织季刊 -2021年3月号·第58卷
  • 全球网络威胁 - 金融与发展 - 国际货币基金组织季刊 -2021年3月号·第58卷 (Markdown version)
  • 全球网络威胁 - 金融与发展 - 国际货币基金组织季刊 -2021年3月号·第58卷 (PDF)
• The Global Cyber Threat to Financial Systems – IMF F&D
  • The Global Cyber Threat to Financial Systems – IMF F&D (Markdown version)
  • The Global Cyber Threat to Financial Systems – IMF F&D (PDF)
• 世界に広がるサイバー攻撃の脅威
  • 世界に広がるサイバー攻撃の脅威 (Markdown version)
  • 世界に広がるサイバー攻撃の脅威 (PDF)
• Глобальная киберугроза – Финансы и развитие – март 2021 года
  • Глобальная киберугроза – Финансы и развитие – март 2021 года (Markdown version)
  • Глобальная киберугроза – Финансы и развитие – март 2021 года (PDF)