Identity and privileged access
Controls on administrator accounts, multi-factor authentication and help desk procedures are examined as common points of compromise in financial firms.
GRA · Financial Cyber and Operational Resilience
Spatial financeWhere capital meets hazard, exposure and transition
Cybersecurity and cryptography for financial cyber and operational resilience
Cybersecurity protects systems, data and people against attack. On this platform it covers threats to financial firms, the controls that prevent and detect attacks, threat-led testing and recovery, with attention to governance and evidence rather than technical detail.
01Register
Cybersecurity and cryptography for financial cyber and operational resilience on the record.
Method recordSTEM method
- MethodCybersecurity and cryptography
- Applied inFinancial Cyber and Operational Resilience
- Data3 inputs
- Checks3 validation steps
- Canonical pageSTEM Commons
02Application
What cybersecurity and cryptography does here.
Cybersecurity and cryptography protect information systems and data from unauthorised access, disruption and manipulation. They address threats that can spread rapidly across interconnected digital and physical systems. In cyber and digital resilience, financial stability and critical infrastructure, cybersecurity analysis identifies how a single compromise can propagate across sectors that share software, vendors or networks. It informs resilience requirements and cyber insurance. The canonical description is on the STEM Commons.
Detection and response capability
Detection coverage, alert handling and response playbooks are compared against common attack techniques to find gaps before an incident.
Threat-led testing
Red-team exercises based on current threat intelligence test whether people, processes and technology detect and contain a realistic attack.
03Exposure model
How a local shock becomes a system outage.
How much of the networks an operator, insurer or lender depends on stays working after a local shock, and how much the coupling between them amplifies it. Teaching model with stated illustrative values, not a prediction.
Controls
- Assets per layer
- 18
- Hazard footprint
- 8% of area
- Assets that depend on another layer
- 60%
- Spare capacity (tolerance)
- 30%
Readouts
- Assets hit by the hazard
- 13%
- Assets still working
- 80%
- Amplification of the initial damage
- 1.6 times
- Steps to settle
- 1
Numbers, methods and sources
| Step | Data centres working (%) | Networks working (%) | Power working (%) |
|---|---|---|---|
| 0 | 94 | 78 | 89 |
| 1 | 89 | 72 | 78 |
Methods
- Interdependent networks Buldyrev and others (2010), Catastrophic cascade of failures in interdependent networks, Nature 464
- Overload cascades Motter and Lai (2002), Physical Review E 66
- Betweenness load Brandes (2001), Journal of Mathematical Sociology 25
- Multilayer networks Kivela and others (2014), Journal of Complex Networks 2
- Infrastructure interdependencies Rinaldi, Peerenboom and Kelly (2001), IEEE Control Systems 21(6)
- Uncertainty fan (parameter Monte Carlo) Spiegelhalter, Pearson and Short (2011), Visualising uncertainty about the future, Science 333
- One-at-a-time sensitivity (tornado) Saltelli and others (2008), Global Sensitivity Analysis: The Primer, Wiley
Data
The model runs on the teaching values set by the controls. To calibrate it for a place, read it against these admitted layers and series, which this page's map can draw:
- Major roads Natural Earth
- Railways Natural Earth
- Seaports Natural Earth
- Airports Natural Earth
- Urban extents Natural Earth
- Night lights tonight, outages (VIIRS Day/Night Band) NASA/NOAA VIIRS (Suomi NPP) · register nasa.gibs.context-live-layers
- Natural events (NASA EONET) NASA EONET · register nasa.eonet.events
Across the six pillars, led by Nexus Consortium
- Experiments Labs
- Built in Financial Cyber and Operational Resilience in Foundry
- Tested at Financial Cyber and Operational Resilience in Universe
- Codified in Digital, Cyber and AI in Standards
- Published in Financial Cyber and Operational Resilience in Reports
- Taught in Faculty of Technology and Digital Systems in Academy
04Data
What the method consumes.
Datasets and records used by cybersecurity and cryptography on this platform, with the role each plays and the label its values carry. Sources are listed in the source register.
| Data | Role | Label |
|---|---|---|
| Threat landscape reports | Threat context | REPORTED |
| Control test results | Control effectiveness | DECLARED |
| Incident records | Attack outcomes | REPORTED |
05Exposure, loss and capital
What it means for exposure, loss and capital.
The exposure, loss, scenario and capital views a risk officer, supervisor or ministry of finance would ask for, with the frameworks they report against. Structures follow supervisory and actuarial practice. Values are illustrative: never prices, ratings or advice.
Transmission channels
How a shock in cybersecurity and cryptography for financial cyber and operational resilience reaches credit, market, underwriting, liquidity and operational risk, and feeds back.
NGFS climate scenarios · Network for Greening the Financial SystemIFRS S2 Climate-related Disclosures · ISSBTCFD recommendations · Financial Stability Board TCFDPrinciples for the effective management of climate-related financial risks · Basel Committee on Banking Supervision
06Validation
How results are checked.
Controls are tested through red-team exercises, audits and formal analysis of cryptographic schemes. Incident data are used to check whether defences performed as intended.
| Check | How it is done |
|---|---|
| Threat relevance | Controls are assessed against current threats to the sector |
| Evidence of operation | Controls are tested in operation, not only by design |
| Independent challenge | Findings are reviewed by parties outside the tested team |
Adversaries adapt, so historical data may not reflect future attacks. Software supply chains and legacy systems introduce weaknesses that are hard to inventory.
08Stewardship
Who maintains the method.
Cybersecurity and Digital Resilience stewards cybersecurity and cryptography for the Consortium and reviews how it is applied across platforms.
09Connected
Where this page leads across the Consortium.
10Questions
Questions and answers.
What are the limits of cybersecurity and cryptography in this field?
Adversaries adapt, so historical data may not reflect future attacks. Software supply chains and legacy systems introduce weaknesses that are hard to inventory.
How are results checked?
Controls are tested through red-team exercises, audits and formal analysis of cryptographic schemes. Incident data are used to check whether defences performed as intended.
Are the values on this page real?
The data names, roles and checks are real descriptions of practice. The canvas shows a design of the method's use, not a run; no result is reported here.
Where else is this method applied?
The canonical method page lists every platform that applies it.
ReportsContribute
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
Global Risks AllianceFinancial Cyber and Operational ResilienceScenario and Stress-TestStrategic Systems
- EmailGateway GW-GRASend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGlobal Risks AllianceSee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Financial Cyber and Operational Resilience
Bring an exposure or capital question to the Alliance.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.