## Cyber Defense Must Be Global

_IMF Blog, October 26, 2017_

## Source details

**Canonical URL:** [Cyber Defense Must Be Global](https://www.imf.org/en/blogs/articles/2017/10/26/cyber-defense-must-be-global)

## Other formats

- [Markdown version](/en/blogs/articles/2017/10/26/cyber-defense-must-be-global/index.md)
- [Structured JSON version](/en/blogs/articles/2017/10/26/cyber-defense-must-be-global/index.json)
- [Bundle manifest](/en/blogs/articles/2017/10/26/cyber-defense-must-be-global/bundle-manifest.json)

## Bibliographic details
- Authors: Emanuel Kopp, Lincoln Kaffenberger, Christopher Wilson
- Published: October 26, 2017

---

### Overview
- Authors: Emanuel Kopp, Lincoln Kaffenberger, Christopher Wilson
- Date: October 26, 2017
- Core proposition: Cyber risk is a permanent, global threat to financial institutions and the interconnected financial system; international institutions can play a key coordinating and risk-mitigation role.

### High-profile examples and scale
- Equifax breach compromised the confidentiality of "143 million Americans’ credit information."
- Theft from Bangladesh Bank: "US$81 million" stolen.
- Finding: "Banks of all sizes experience cyberattacks every day."

### Sophisticated attack types and data limitations
- Examples of dangerous cyberattacks:
  - Attacks on money transfer and ATM operations.
  - Malicious software introduced into bank systems.
  - Destruction of files and hardware.
  - Extortionary events that disrupt internal operations.
- Data and disclosure issues:
  - Current environment described as a "patchwork of national regulation and industry self-policing."
  - Comprehensive data are lacking; "the risk is likely underestimated."
  - Firms often withhold information about cyber events, sometimes disclosing breaches only "months or years later."

### Limits of security measures and private-sector responses
- Common security measures: firewalls, data encryption, training, business continuity planning.
  - Trade-off: Necessary but "costly" and may impede routine operations.
- Risk transfer and market limitations:
  - Firms can transfer risk to insurers or outside cybersecurity vendors.
  - Market frictions: "asymmetries and a lack of information" and "generally little experience with this kind of economic risk."
  - Firms tend to "underestimate their exposure to cyber risk" and "overestimate their ability to defend" and the coverage of cyber insurance policies.
  - Insurance pricing: "insurance companies are pricing a cushion into premiums to account for uncertainty."

### Systemic risk channels
- Third parties (insurers, cybersecurity vendors) may become hacker targets and, if concentrated, "could become a source of systemic risk throughout the financial system."
- Concentration of IT within the financial system:
  - Common operating systems and programs, cloud servers, electronic network hubs.
  - Interbank and transfer-market connections could enable rapid shock transmission.
- Cyber insurance market dynamics:
  - "Popularity of cyber insurance policies has created a fast-growing market," but "the continuing buildup of cyber risk in the insurance sector can itself become a systemic risk."
- Public-sector role: There is "a clear role for the public sector to ensure that losses from cyberattacks do not give rise to systemic risk."

### Regulatory agenda and international coordination
- National-level measures recommended:
  - Provide incentives to ensure cyberattacks are "reported promptly and accurately."
  - Collect loss data "systematically."
  - Enable banking regulators to coordinate rapidly with law enforcement agencies because "cyberattacks are criminal in nature."
  - Ensure regulators "have the ability and the authority to adapt their responses quickly as cyberthreats evolve."
- International-level measures and institutions:
  - Cyber risk "has no geographical borders, and the threat is global," so international institutions are "crucial."
  - International organizations cited as able to help: Bank for International Settlements, Financial Stability Board, and the IMF.
  - Roles for international bodies include: supporting information sharing, designing coordinated policies, helping resolve disputes, and containing systemic risk.
  - Existing efforts: "International bodies like the Financial Stability Board and international forums like the Group of Seven are leading an effort to disseminate information among members and foster policy coordination among countries."

*Source: Cyber Defense Must Be Global — IMF blog post (October 26, 2017) by Emanuel Kopp, Lincoln Kaffenberger, Christopher Wilson.*

---

## Content in this bundle

- **网络防御必须扩及全球; IMF博客 ; 2017 年10 月26 日**
  - [网络防御必须扩及全球; IMF博客 ; 2017 年10 月26 日 (Markdown version)](/external/chinese/np/blog/2017/102717c.pdf.md){rel="alternate" type="text/markdown"}
  - [网络防御必须扩及全球; IMF博客 ; 2017 年10 月26 日 (PDF)](/external/chinese/np/blog/2017/102717c.pdf){rel="external" type="application/pdf"}
- **サイバー攻撃への防御はグローバルであるべき;  エマヌエル・コップ、リンカーン・カフェンバーガー、クリストファー･ウィルソン  IMF ブログ 2017年10月26日掲載**
  - [サイバー攻撃への防御はグローバルであるべき;  エマヌエル・コップ、リンカーン・カフェンバーガー、クリストファー･ウィルソン  IMF ブログ 2017年10月26日掲載 (Markdown version)](/external/japanese/np/blog/2017/102617j.pdf.md){rel="alternate" type="text/markdown"}
  - [サイバー攻撃への防御はグローバルであるべき;  エマヌエル・コップ、リンカーン・カフェンバーガー、クリストファー･ウィルソン  IMF ブログ 2017年10月26日掲載 (PDF)](/external/japanese/np/blog/2017/102617j.pdf){rel="external" type="application/pdf"}
- **Киберзащита должна иметь глобальный характер**
  - [Киберзащита должна иметь глобальный характер (Markdown version)](/external/russian/np/blog/2017/102617r.pdf.md){rel="alternate" type="text/markdown"}
  - [Киберзащита должна иметь глобальный характер (PDF)](/external/russian/np/blog/2017/102617r.pdf){rel="external" type="application/pdf"}

---

## References

- [عربي](https://blog-montada.imf.org/?p=5662)
- [https://www.imf.org/wp-content/uploads/2017/10/BLOG-1024x600-cyber-hacking-photo-solarseven-iStock-488690699.jpg](https://www.imf.org/wp-content/uploads/2017/10/BLOG-1024x600-cyber-hacking-photo-solarseven-iStock-488690699.jpg)
- [IMF Working Paper](http://www.imf.org/en/Publications/WP/Issues/2017/08/07/Cyber-Risk-Market-Failures-and-Financial-Stability-45104)
- [https://www.imf.org/wp-content/uploads/2017/10/ENG-Oct26-Cyber-risks_chart.jpg](https://www.imf.org/wp-content/uploads/2017/10/ENG-Oct26-Cyber-risks_chart.jpg)

_Source: https://www.imf.org/en/blogs/articles/2017/10/26/cyber-defense-must-be-global_