Endpoint control frameworks
Security controls required of participants connecting to payment networks are examined for coverage of known fraud techniques.
GRA · 支付与市场基础设施
空间金融资本与危害、风险暴露和转型的交汇之处
面向支付与市场基础设施的网络安全与密码学
Cybersecurity protects 系统 and data against attack. On this platform it covers threats to payment and settlement infrastructure, endpoint security, threat-led testing and recovery from attacks that corrupt data or halt operations.
02申请
What cybersecurity and cryptography does here.
Cybersecurity and cryptography protect information 系统 and data from unauthorised access, disruption and manipulation. They address threats that can spread rapidly across interconnected digital and physical systems. In financial stability, cyber and digital resilience and digital public infrastructure, cybersecurity analysis identifies how a single compromise can propagate across sectors that share software, vendors or networks. It informs resilience requirements and cyber insurance. The canonical description is on STEM Commons.
Threat-led testing
Red-team methods based on real attacker techniques are explained, with how scope and safety are controlled in production.
Destructive attack recovery
Recovery from ransomware and integrity attacks is analysed, including clean-room rebuilds and reconciliation of balances.
控制措施
- 外部资产下降
- 2.0%
- 杠杆率（资产与权益之比）
- 10 倍
- 银行间资产占比
- 10%
- 银行间债权的回收
- 40%
- 体系内的银行
- 20
- 核心银行
- 占银行的 20%
读数
- 初始冲击造成的权益损失
- 18.0%
- 传染后的权益损失
- 45.0%
- 传染新增（DebtRank）
- 27.0 个点
- 违约银行
- 0
数字、方法与来源
| 轮次 | 系统权益损失（%） | 违约银行 |
|---|---|---|
| 0 | 18.00 | 0 |
| 1 | 28.80 | 0 |
| 2 | 35.28 | 0 |
| 3 | 39.17 | 0 |
| 4 | 41.50 | 0 |
| 5 | 42.90 | 0 |
| 6 | 43.74 | 0 |
| 7 | 44.24 | 0 |
| 8 | 44.55 | 0 |
| 9 | 44.73 | 0 |
| 10 | 44.84 | 0 |
| 11 | 44.90 | 0 |
| 12 | 44.94 | 0 |
| 13 | 44.96 | 0 |
| 14 | 44.98 | 0 |
| 15 | 44.99 | 0 |
| 16 | 44.99 | 0 |
| 17 | 45.00 | 0 |
| 18 | 45.00 | 0 |
| 19 | 45.00 | 0 |
| 20 | 45.00 | 0 |
| 21 | 45.00 | 0 |
| 22 | 45.00 | 0 |
| 23 | 45.00 | 0 |
| 24 | 45.00 | 0 |
| 25 | 45.00 | 0 |
| 26 | 45.00 | 0 |
| 27 | 45.00 | 0 |
| 28 | 45.00 | 0 |
| 29 | 45.00 | 0 |
| 30 | 45.00 | 0 |
方法
- DebtRank Battiston 等（2012），Scientific Reports 2:541
- 差异化 DebtRank Bardoscia and others (2015), PLOS ONE 10
- 金融网络中的传染 Gai and Kapadia (2010), Proc. R. Soc. A 466
- 金融网络中的清算 Eisenberg 和 Noe（2001），Management Science 47
- 不确定性扇形图（参数蒙特卡罗） Spiegelhalter, Pearson and Short (2011), Visualising uncertainty about the future, Science 333
- 单因素敏感性（龙卷风图） Saltelli and others (2008), Global Sensitivity Analysis: The Primer, Wiley
数据
No observed data enters this model: it runs on the teaching values set by the controls, to be replaced with a programme’s own evidence.
贯穿六大支柱，由 Nexus Consortium 牵头
04数据
该方法使用的输入。
Datasets and records used by cybersecurity and cryptography on this platform, with the role each plays and the label its values carry. Sources are listed in 来源登记册.
| 数据 | 角色 | 标签 |
|---|---|---|
| Threat intelligence reports | Threat landscape | 已报告 |
| Test framework documents | Testing methods | 已发布统计 |
| Incident reports | Attack outcomes | 已报告 |
05风险暴露、损失与资本
What it means for exposure, loss and capital.
风险官、监管者或财政部会要求的风险暴露、损失、情景和资本视图，以及它们据以报告的框架。结构遵循监管和精算实务。数值为说明性：绝非价格、评级或建议。
传导渠道
How a shock in cybersecurity and cryptography for payments and market infrastructure reaches credit, market, underwriting, liquidity and operational risk, and feeds back.
NGFS 气候情景 · 央行与监管机构绿色金融网络IFRS S2 气候相关披露 · ISSBTCFD 建议 · 金融稳定理事会 TCFD有效管理气候相关金融风险的原则 · 巴塞尔银行监管委员会
06验证
结果如何核查。
Controls are tested through red-team exercises, audits and formal analysis of cryptographic schemes. Incident data are used to check whether defences performed as intended.
| 核查 | 如何开展 |
|---|---|
| Threat relevance | Scenarios are based on current, sector-relevant threats |
| Safety controls | Tests document controls that protect production |
| 独立审查 | Findings are reviewed by parties outside the tested team |
Adversaries adapt, so historical data may not reflect future attacks. Software supply chains and legacy systems introduce weaknesses that are hard to inventory.
08管理责任
由谁维护该方法。
网络安全与数字韧性 stewards cybersecurity and cryptography for the Consortium and reviews how it is applied across platforms.
09已关联
本页在整个联合体中通向何处。
10问题
问题与解答。
What are the limits of cybersecurity and cryptography in this field?
Adversaries adapt, so historical data may not reflect future attacks. Software supply chains and legacy systems introduce weaknesses that are hard to inventory.
结果如何核查？
Controls are tested through red-team exercises, audits and formal analysis of cryptographic schemes. Incident data are used to check whether defences performed as intended.
本页面上的数值是真实的吗？
The data names, roles and checks are real descriptions of practice. The canvas shows a design of the method’s use, not a run; no result is reported here.
该方法还应用于何处？
维持社会运转的各个 规范方法页面 列出应用该方法的每个平台。
报告贡献
从本页贡献证据。
报告 is the Consortium’s quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
全球风险联盟（Global Risks Alliance）支付与市场基础设施战略系统情景与压力测试
- 电子邮件门户 GW-GRA从本页发送证据、更正、案例、方法、审查、翻译或概况投稿。它会带上本页标签送达，由负责的编辑接收。
- Zenodo开放存缴存缴并提交到社区用您的 ORCID iD 在 Zenodo 上发布您自己的记录，然后提交到那里的 Reports 社区。由策展人审核；DOI 仍归您所有。
- 报告全球风险联盟（Global Risks Alliance）查看所有贡献方式贡献类型、各自的评审方式、您获得的署名、许可协议，以及绝不接受的内容。
切勿发送个人数据、敏感基础设施细节或您无权分享的任何内容。贡献在使用前会经过审查；发送贡献不赋予署名权或编辑权，赞助也绝不能换取研究结论。
法律
法律文件。
本网站上的地图、数据和图表仅作为背景和一般信息展示。它们不是建议、预测或预警；信息的局限见免责声明和数据说明。