Cyber Risk is the New Threat to Financial Stability
IMF Blog, December 7, 2020
Source details
- Canonical URL
- Cyber Risk is the New Threat to Financial Stability
Other formats
Bibliographic details
- Authors: Jennifer Elliott, Nigel Jenkinson
- Published: December 7, 2020
Overview
- Authors: Jennifer Elliott, Nigel Jenkinson
- Date: December 7, 2020
- Core premise: As reliance on digital banking and payments increases, cybersecurity has become a threat to financial stability; the number of cyberattacks "has tripled over the last decade," and financial services remain the most targeted industry.
- Systemic risk mechanism described: a successful attack on a major financial institution, or on a core system or service used by many, could quickly spread through the entire financial system causing widespread disruption and loss of confidence, trapped liquidity, failed transactions, and loss of access to deposits and payments. Under extreme scenarios, investors and depositors may demand their funds or try to cancel accounts or services.
Key findings
- The number of cyberattacks "has tripled over the last decade."
- Financial services is the most targeted industry.
- Hacking tools are now cheaper, simpler and more powerful, enabling lower-skilled hackers to do more damage at lower cost.
- Expansion of mobile-based services increases opportunities for hackers and affects users for whom mobile is the only technological platform.
- Attackers operate across borders and target large and small institutions in both rich and poor countries.
- Individual firm incentives to invest in protection are insufficient; regulation and public policy intervention are needed to guard against underinvestment and protect the broader financial system.
- Many national financial systems are not yet ready to manage attacks, and international coordination is still weak.
Six major strategies to strengthen cybersecurity and financial stability
- Cyber mapping and risk quantification
- Map key operational and technological interconnections and critical infrastructure to better understand global financial system interdependencies.
- Incorporate cyber risk into financial stability analysis to improve understanding and mitigation of system-wide risk.
- Quantify potential impact to focus responses and promote stronger commitment.
- Note: work is nascent due to data shortcomings on the impact of cyber events and modelling challenges, and "must be accelerated."
- Converging regulation
- Promote more internationally consistent regulation and supervision to reduce compliance costs and enable stronger cross-border cooperation.
- International bodies mentioned as already beginning to strengthen coordination and foster convergence: Financial Stability Board, Committee on Payments and Market Infrastructure, and Basel Committee.
- National authorities need to work together on implementation.
- Capacity to respond
- Develop response and recovery strategies so the financial system can resume operations quickly after successful attacks, safeguarding stability.
- Response and recovery strategies are still incipient, particularly in low-income countries, which need support.
- International arrangements are necessary to support response and recovery for cross-border institutions and services.
- Willingness to share
- Increase information-sharing on threats, attacks, and responses across private and public sectors to enhance deterrence and response.
- Barriers to sharing include national security concerns and data protection laws.
- Supervisors and central banks should develop information sharing protocols and practices that work within these constraints.
- Potential measures: a globally agreed template for information sharing, increased use of common information platforms, and expansion of trusted networks.
- Stronger deterrence
- Make cyberattacks more expensive and riskier through measures to confiscate crime proceeds and prosecute criminals.
- Step up international efforts to prevent, disrupt and deter attackers through cooperation between law enforcement agencies and national authorities responsible for critical infrastructure or security.
- Emphasis: "Since hackers know no borders, global crime requires global enforcement."
- Capacity development
- Help developing and emerging economies build cybersecurity capacity to strengthen financial stability and support financial inclusion.
- Low-income countries are particularly vulnerable to cyber risk.
- The COVID-19 crisis highlighted the decisive role of connectivity in the developing world; harnessing technology safely and securely is central to development.
- Analogy: "As with any virus, the proliferation of cyber threats in any given country makes the rest of the world less safe."
Policy implications and recommended actions
- Public policy and regulation should address underinvestment in cybersecurity by individual firms to protect the broader financial system.
- International coordination and consistent regulation/supervision are required to reduce cross-border vulnerabilities and compliance frictions.
- Investment in mapping, data collection, and modelling of cyber risk is needed to enable quantification and inclusion in financial stability analysis.
- Develop and support response and recovery frameworks, particularly for low-income countries and cross-border financial infrastructure.
- Create protocols and practical mechanisms for information sharing that respect national security and data protection constraints.
- Strengthen international law enforcement cooperation to deter attackers and reduce the profitability of cybercrime.
- Prioritize capacity development efforts in developing and emerging economies to safeguard financial inclusion and global stability.
IMF role described
- The IMF is focusing efforts on low-income countries by providing capacity development to financial supervisors.
- The IMF aims to bring the issues and perspectives of low-income countries to international bodies and policy discussions where they are not adequately represented.
Source: Cyber Risk is the New Threat to Financial Stability (IMF, December 7, 2020).