Page 4 sur 6
information to measure the intensity and sophistication of threats and their
evolution. The indicators requested vary from one report to another and this
limits the scope of diagnosis and comparisons. The institutions themselves
can struggle to transmit information about their incidents in different formats
and with different details to the various authorities in charge. FSB agreed on a
“cyber lexicon”.
1
As we have done in the past for operational risk, I
recommend that we work on a common categorization of cyber incidents to
better measure the impacts of attacks, and better understand their evolution.
About information sharing and threat intelligence. As evidenced by panel
4, little information on cybersecurity is actually shared, due to sensitivity issues
and trust. A pragmatic approach is for financial authorities to engage bilaterally
in Memoranda of Understanding (MOUs) with authorities with whom they
share mutual trust. Singapore and Hong-Kong already paved the way. This
can be done between G7 countries and among other trusted countries as well.
III. Preparation for cyber crisis management through large scale
exercises
The third panel showed how valuable crisis simulations are in the building of
an operational preparatory capacity. The exercises organized so far, at
domestic or regional levels, allowed us to acquire experience in coordinating a
response and the recovery during a major incident. Our ambition must be as
high as the risks to which our evolving and interconnected financial systems
are exposed to, due to the increasing sophistication of cyber-attacks. In other
words, and this is something that clearly emerged from today’s discussions, a
more global approach to cyber resilience exercises is needed.
In this regard, let me briefly insist on the G7 joint crisis management exercise
to be held in early June, coordinated by Banque de France. We will have an
excellent opportunity to assess our ability to exchange information and take
collective decisions in a mock crisis situation. Good and clear communication
1
FSB, 12 November 2018.