A new framework for sharing threat intelligence and testing cyber security defences has been developed for the UK's financial services sector.

CREST, the not-for-profit organisation that represents the technical information security industry, has been working with the Bank of England, the Treasury and the Financial Conduct Authority to develop the system called CBEST.

CBEST has been mooted as the first initiative of its type to be led by any of the world’s central banks. In a speech today to the British Bankers Association, Andrew Gracie, executive director resolution at the Bank of England, stressed the importance of CBEST to help FS firms protect against increasingly sophisticated cyber attacks on their core systems.

CBEST will identify areas of vulnerability and benchmark how effective companies’ detection and recovery processes are. FS organisations will also have access to advanced and detailed cyber threat intelligence, as well as cyber defence analysts.

The system is designed to help the boards of financial firms, infrastructure providers and regulators improve their understanding of the types of cyber attack that could undermine financial stability in the UK.

Ian Glover, president of CREST, said: “Although existing penetration testing services in the financial services sector have provided a good level of assurance against traditional attacks, they do not address more sophisticated cyber attacks on critical assets.

“CBEST tests have been designed to replicate the behaviours of serious threat actors, assessed by government and commercial intelligence providers as posing a genuine threat to important financial institutions.”

Share Story: