Spatial financeWhere capital meets hazard, exposure and transition
Cybersecurity for financial systems
Cybersecurity and cryptography protect the confidentiality, integrity and availability of financial systems. In this field they are applied to understand how a compromise at one firm, provider or software component propagates through trusted connections, and which testing, detection and recovery capabilities limit the damage.
Cybersecurity and cryptography protect information systems and data from unauthorised access, disruption and manipulation. They address threats that can spread rapidly across interconnected digital and physical systems. In capital markets and investment, cyber and digital resilience and digital public infrastructure, cybersecurity analysis identifies how a single compromise can propagate across sectors that share software, vendors or networks. It informs resilience requirements and cyber insurance. The canonical description is on the STEM Commons.
Threat-led penetration testing
Red teams emulate the tactics of threat actors relevant to the institution against live production systems, following frameworks such as TIBER-EU and the testing requirements of DORA, and findings feed remediation plans.
Supply chain and dependency analysis
Software components, managed service providers and shared platforms are mapped so that a vulnerability or compromise can be traced to every service that depends on it.
Cryptographic inventory and quantum readiness
Algorithms, keys and certificates used in payments and authentication are inventoried, so migration to post-quantum cryptography can be planned and data at long-term risk identified.
03Exposure model
How a local shock becomes a system outage.
How much of the networks an operator, insurer or lender depends on stays working after a local shock, and how much the coupling between them amplifies it. Teaching model with stated illustrative values, not a prediction.
Controls
Assets per layer
18
Hazard footprint
8% of area
Assets that depend on another layer
60%
Spare capacity (tolerance)
30%
Readouts
Assets hit by the hazard
13%
Assets still working
11%
Amplification of the initial damage
6.9 times
Steps to settle
4
Numbers, methods and sources
Step
Data centres working (%)
Networks working (%)
Power working (%)
0
89
89
83
1
72
39
56
2
50
17
33
3
22
17
22
4
22
0
11
Methods
Interdependent networks Buldyrev and others (2010), Catastrophic cascade of failures in interdependent networks, Nature 464
Overload cascades Motter and Lai (2002), Physical Review E 66
Betweenness load Brandes (2001), Journal of Mathematical Sociology 25
Multilayer networks Kivela and others (2014), Journal of Complex Networks 2
Infrastructure interdependencies Rinaldi, Peerenboom and Kelly (2001), IEEE Control Systems 21(6)
Uncertainty fan (parameter Monte Carlo) Spiegelhalter, Pearson and Short (2011), Visualising uncertainty about the future, Science 333
One-at-a-time sensitivity (tornado) Saltelli and others (2008), Global Sensitivity Analysis: The Primer, Wiley
Data
The model runs on the teaching values set by the controls. To calibrate it for a place, read it against these admitted layers and series, which this page's map can draw:
Natural events (NASA EONET) NASA EONET · register nasa.eonet.events
How a local shock becomes a system outage. Illustrative teaching model: it runs on the values set by the controls, not on measured data. Methods: Interdependent networks (Buldyrev and others (2010), Catastrophic cascade of failures in interdependent networks, Nature 464); Overload cascades (Motter and Lai (2002), Physical Review E 66); Betweenness load (Brandes (2001), Journal of Mathematical Sociology 25).
Datasets and records used by cybersecurity and cryptography on this platform, with the role each plays and the label its values carry. Sources are listed in the source register.
Data
Role
Label
Security event and incident logs
Detection and incident analysis
OBSERVED
CISA Known Exploited Vulnerabilities and the NIST National Vulnerability Database
Vulnerability prioritisation
Published statistics
MITRE ATT&CK knowledge base
Mapping adversary techniques
REPORTED
Supervisory incident reports
Sector incident patterns
Published statistics
Threat intelligence sharing (FS-ISAC and national CSIRTs)
Emerging threats and indicators of compromise
REPORTED
05Exposure, loss and capital
What cybersecurity for financial systems means for exposure, loss and capital.
The exposure, loss, scenario and capital views a risk officer, supervisor or ministry of finance would ask for, with the frameworks they report against. Structures follow supervisory and actuarial practice. Values are illustrative: never prices, ratings or advice.
Transmission channels
How a shock in cybersecurity for financial systems reaches credit, market, underwriting, liquidity and operational risk, and feeds back.
Channel structure after the Basel Committee's work on climate-related risk drivers and transmission channels; links shown are typical paths, not estimated exposures.
NGFS climate scenarios · Network for Greening the Financial SystemIFRS S2 Climate-related Disclosures · ISSBTCFD recommendations · Financial Stability Board TCFDPrinciples for the effective management of climate-related financial risks · Basel Committee on Banking Supervision
06Validation
How results are checked.
Controls are tested through red-team exercises, audits and formal analysis of cryptographic schemes. Incident data are used to check whether defences performed as intended.
Check
How it is done
Scenario realism
Test scenarios are drawn from current threat intelligence, not generic checklists
Detection validation
Controls are exercised with simulated attack techniques to confirm alerts fire and are acted on
Recovery exercises
Backups and failover are restored in practice, with time to recovery recorded against tolerance
Independent assurance
Testers and internal audit are independent of the teams that run the controls
Adversaries adapt, so historical data may not reflect future attacks. Software supply chains and legacy systems introduce weaknesses that are hard to inventory.
What are the limits of cybersecurity and cryptography in this field?
Adversaries adapt, so historical data may not reflect future attacks. Software supply chains and legacy systems introduce weaknesses that are hard to inventory.
How are results checked?
Controls are tested through red-team exercises, audits and formal analysis of cryptographic schemes. Incident data are used to check whether defences performed as intended.
Are the values on this page real?
The data names, roles and checks are real descriptions of practice. The canvas shows a design of the method's use, not a run; no result is reported here.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
Global Risks AllianceFintech NexusExponential TechnologyFinance and Insurance Readiness
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Fintech Nexus
Bring an exposure or capital question to the Alliance.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.
Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.
This site uses only strictly necessary cookies to work and to remember your privacy choices. Nothing loads from other companies, and we never sell or share your personal information.
Details
This site uses only strictly necessary cookies to work and to remember your privacy choices. Nothing loads from other companies, and we never sell or share your personal information. We run no advertising. You can review your choices at any time through Privacy choices at the foot of every page.
