Will the next systemic crisis be cyber?

Publicité

Publicité

Publicité

Publicité

Publicité

Publicité

Publicité

Publicité

Publicité

Publicité

Publicité

Publicité

1
Will the next systemic crisis be cyber?
Arrow Institute conference
25th
September 2014
Laure Molinier
Yannic Dulieu

2
Agenda
• Why could a cyber attack cause the next systemic crisis?
• How can Operational Risk management cover cyber risk...

A constantly evolving
threats landscape
Cyber « Hacktivism »
Cyber War
(Governments, army)
Cyber Espionage
“Script kiddies...

4
Cyber threats are diverse and continually evolving…
• Cyber-protests, or “hacktivism”, have become popular and continue
...

Companies are evolving…
• Less control on the provider (no penetration-test allowed,…);
• Centralization of data from mult...

How much does it cost? We don’t know exactly
but…
Costs of cyber-crime to society are substantial.
Some studies cite figur...

7
How can Operational Risk manage cyber risks?
• Euroclear case study
• Enterprise Risk Management (ERM) framework and cyb...

88
A growingly interconnected world
• Euroclear is the world’s largest provider of
settlement and related services for dom...

9
Market Infrastructure:
Multicurrency settlement and asset servicing
International CSDCentral Securities Depository
(CSD)...

10
Enterprise Risk Management (ERM)
What is the goal? Organise the chaos to ensure continuity
Regulation
Competition
Indus...

11
The Euroclear Enterprise Risk Management (ERM) framework
covers these areas of focus and ensures:
• the right ownership...

• What are the relevant
potential threats?
• Horizon scanning
• Business
engagement
• Risk and scenario-based
assessments ...

BOARD
Management Committee
Group Risk Committee
Local MC/ Division Heads/Risk Mgt
Business
Continuity
Personnel
Security
P...

14
Awareness is key…
• Global security awareness programme
• « One Minute Security Managers »
• E-learning modules and tes...

Understanding the cyber threats
Information Security risks
(Reporting in Risk Management - Risk Universe)
Logical security...

Finding your way through many
information sources…
Establishing a cyber threat list
Mitigation factors reference source is...

About 100 cyber threats grouped in 10 families:
1. Threats to building infrastructure (including SCADA) & personnel
2. Thr...

Perform the risk assessment
• Measure coverage and effectiveness of controls
• Determine maturity levels
• Combine self as...

Complement with scenario based
analysis
Developing realistic scenarios around key business services and
measuring readines...

Measure & report
• Merge results from both approaches (technical assessment + scenarios)
• Measure company’s readiness to ...

Security incidents’ response
• Escalation
structure
integrated into
crisis
management
• Managing
« potential » risks
Respo...

22
Integration into company’s crisis
management structureRespond

23
Corporate response
plans
•Company’s corporate response plans
covering
►Situation assessment
►Strategic intent!
►Technic...

24
A few challenges
•Monitoring the threats to adapt strategies to their rapid evolution:
► Finding your way through multi...

25
Conclusions
•The risk framework needs to be adapted to better capture and report on
cyber related risks (threats, contr...

Partager Slideshare

LinkedIn
Facebook
Twitter

Intégrer

Taille (px)

Afficher les Slideshows associés à la fin

Code abrégé pour WordPress

Lien

Partager
E-mail

Gestion des risques opérationnels: ... by Arrow Institute 1754 views
Amplexor Customer Experience Manage... by Amplexor 1100 views
Evolution des risques opérationnels... by Arrow Institute 974 views
Quel Cadre opérationnel cohérent po... by Arrow Institute 839 views
Rapport final - Mémoire de fin d'ét... by Youcef Benchicou 15909 views
[Gestion des risques et conformite]... by onepoint x weave 8322 views

Afficher sur Slideshare

1 sur 26 Publicité

Afficher sur Slideshare

1 sur 26 Publicité