Cybersecurity Threats Call for a Global Response

IMF Blog, January 13, 2020

Source details

Operation Taiex (Last March) led to the arrest of the gang leader behind the Carbanak and Cobalt malware attacks on over 100 financial institutions worldwide.
The operation included the Spanish national police, Europol, FBI, the Romanian, Moldovan, Belarusian, and Taiwanese authorities, as well as private cybersecurity companies.
Investigators found out that hackers were operating in at least 15 countries.
Observation: cybercrime moves quickly and collaborates rapidly across borders; the response must match that speed and global integration.

Private sector: developing technical and risk management standards, convening information-sharing forums, and spending considerable resources.
International bodies: the Group of 7 Cyber Experts group and the Basel Committee are creating awareness and identifying sound practices for financial sector supervisors.
Conclusion: existing efforts are important but insufficient from a global perspective; more coordination is needed.

First, develop a greater understanding of the risks:
- Better data on threats and on the impact of successful attacks to understand how they might impact financial stability.
Second, improve collaboration on threat intelligence, incident reporting and best practices in resilience and response:
- Improve information sharing between the private and public sector.
- Reduce barriers to banks reporting issues to financial supervisors and law enforcement.
- Ensure seamless communication among different public agencies within a country.
- Improve information sharing between countries.
Third, achieve greater consistency in regulatory approaches:
- Countries currently have different standards, regulations, and terminology; reducing inconsistency will facilitate more communication.
Fourth, prepare for attacks with crisis preparation and response protocols:
- Develop protocols at both the national and cross-border level to respond and recover operations as soon as possible.
- Use crisis exercises to reveal gaps and weaknesses in processes and decision making.

Cyberattacks can originate from anywhere or many places at once; crisis response protocols must be articulated within regions and globally.
Relevant authorities need to know “whom to call” during a crisis, in nearby and also in faraway countries.
Small or developing countries face particular challenges and need international attention:
- Many rely on financial services or correspondent lines provided by global banks for financial connection.
- Developing cross-border response protocols will help countries understand roles in a crisis and ensure a coordinated response.
The Group of 7 countries has made an excellent start, but efforts need to be broadened to each and every country.

The IMF can raise concerns of emerging-market and developing countries to a global level due to its broad representation.
It is in the interest of advanced economies to work with other countries to share information, coordinate actions, and build capacity because attacks can start anywhere.
The IMF works with countries to build capacity: developing skills and expertise needed to recognize and effectively counter cybersecurity threats.
The IMF’s international partners are doing the same, and the IMF works regularly with an array of stakeholders in the public and private sector.

Successful cyberattacks have the potential to hamper financial development by creating distrust, especially if personal and financial data are compromised.
To reap benefits of new technologies that can develop markets and expand financial inclusion, it is necessary to preserve trust and ensure the security of information and communications technologies.
Final note: with cybersecurity, there is always more to be done simply because the pace of change is breathtakingly fast.

David Lipton, January 13, 2020 — Cybersecurity Threats Call for a Global Response