Cyber Defense Must Be Global

IMF Blog, October 26, 2017

Source details

Authors: Emanuel Kopp, Lincoln Kaffenberger, Christopher Wilson
Date: October 26, 2017
Core proposition: Cyber risk is a permanent, global threat to financial institutions and the interconnected financial system; international institutions can play a key coordinating and risk-mitigation role.

Equifax breach compromised the confidentiality of "143 million Americans’ credit information."
Theft from Bangladesh Bank: "US$81 million" stolen.
Finding: "Banks of all sizes experience cyberattacks every day."

Examples of dangerous cyberattacks:
- Attacks on money transfer and ATM operations.
- Malicious software introduced into bank systems.
- Destruction of files and hardware.
- Extortionary events that disrupt internal operations.
Data and disclosure issues:
- Current environment described as a "patchwork of national regulation and industry self-policing."
- Comprehensive data are lacking; "the risk is likely underestimated."
- Firms often withhold information about cyber events, sometimes disclosing breaches only "months or years later."

Common security measures: firewalls, data encryption, training, business continuity planning.
- Trade-off: Necessary but "costly" and may impede routine operations.
Risk transfer and market limitations:
- Firms can transfer risk to insurers or outside cybersecurity vendors.
- Market frictions: "asymmetries and a lack of information" and "generally little experience with this kind of economic risk."
- Firms tend to "underestimate their exposure to cyber risk" and "overestimate their ability to defend" and the coverage of cyber insurance policies.
- Insurance pricing: "insurance companies are pricing a cushion into premiums to account for uncertainty."

Third parties (insurers, cybersecurity vendors) may become hacker targets and, if concentrated, "could become a source of systemic risk throughout the financial system."
Concentration of IT within the financial system:
- Common operating systems and programs, cloud servers, electronic network hubs.
- Interbank and transfer-market connections could enable rapid shock transmission.
Cyber insurance market dynamics:
- "Popularity of cyber insurance policies has created a fast-growing market," but "the continuing buildup of cyber risk in the insurance sector can itself become a systemic risk."
Public-sector role: There is "a clear role for the public sector to ensure that losses from cyberattacks do not give rise to systemic risk."

National-level measures recommended:
- Provide incentives to ensure cyberattacks are "reported promptly and accurately."
- Collect loss data "systematically."
- Enable banking regulators to coordinate rapidly with law enforcement agencies because "cyberattacks are criminal in nature."
- Ensure regulators "have the ability and the authority to adapt their responses quickly as cyberthreats evolve."
International-level measures and institutions:
- Cyber risk "has no geographical borders, and the threat is global," so international institutions are "crucial."
- International organizations cited as able to help: Bank for International Settlements, Financial Stability Board, and the IMF.
- Roles for international bodies include: supporting information sharing, designing coordinated policies, helping resolve disputes, and containing systemic risk.
- Existing efforts: "International bodies like the Financial Stability Board and international forums like the Group of Seven are leading an effort to disseminate information among members and foster policy coordination among countries."

Source: Cyber Defense Must Be Global — IMF blog post (October 26, 2017) by Emanuel Kopp, Lincoln Kaffenberger, Christopher Wilson.