Pierluigi Paganini February 10, 2020

The president of the European Central Bank (ECB), Christine Lagarde, is warning that a cyber-attack on a major financial institution could trigger a liquidity crisis.

The president of the European Central Bank (ECB), Christine Lagarde, has warned that a coordinated cyber-attack on major banks could trigger a liquidity crisis.

President Lagarde cited findings of a report by the European Systemic Risk Board (ESRB) that estimate the global cost of cyber attacks at between $45bn and $654bn.

Lagarde warns that operational outages that encrypted or destroyed balance accounts at a major bank could trigger a liquidity crisis.

“As an operator of critical infrastructures, the ECB obviously takes such threats very seriously,” Lagarde said in France on Wednesday evening.

“History shows that liquidity crises can quickly become systemic crises,” she added. “The ECB is well aware that it has a duty to be prepared and to act pre-emptively.”

President Lagarde remarked that global risks are linked, a concept is yearly illustrated in the report published by the World Economic Forum.

Below two eloquent graphs included in the Global Risks Report 2020 that show that the risk of cyber-attack has a high likelihood and a high impact.

The second graph shows the strict link between the risk of cyber attacks and other risks such as “Critical infrastructure failure” and “Social instability Social instability,” and “Fiscal crises.”

At a recent board meeting, the European Systemic Risk Board (ESRB)  warned that cyber warfare represents a major source of risk to the financial system.

“Last year, the G7 announced a joint cross-border crisis management exercise on a cyber incident affecting the financial system that it carried out in June 2019, saying that cyber risks were increasing and posed a “genuine and growing threat” to the stability and integrity of the financial sector.” reported the Independent. “It was the first exercise of its kind to be by finance ministries, central banks, regulators and financial market authorities. It did not reveal the the G7 asked its Cyber Experts Group to review financial regulation, and to look at whether the impacts could be measured better.”

In 2018, the European Central Bank has published the European framework for testing financial sector resilience to cyber attacks.

The framework aims to simulate the effects of cyber attacks on critical systems in the banking industry in the European Union.

The move is the response to the numerous cyberheists that hit the financial industry in the past years, like the attacks against the SWIFT system and the assault against online and mobile services at the Netherlands’ three top banks.

The framework also includes the involvement of “red teams” for vulnerability assessments and penetration tests of systems used by companies in the financial sector.

“The European Central Bank (ECB) today publishes the European Framework for Threat Intelligence-based Ethical Red Teaming (TIBER-EU), which is the first Europe-wide framework for controlled and bespoke tests against cyber attacks in the financial market.” reads the announcement published by the ECB.

“The TIBER-EU framework facilitates a harmonised European approach towards intelligence-led tests which mimic the tactics, techniques and procedures of real hackers who can be a genuine threat. TIBER-EU based tests simulate a cyber attack on an entity’s critical functions and underlying systems, such as its people, processes and technologies. This helps the entity to assess its protection, detection and response capabilities against potential cyber attacks.”

In May 2018, the European Central Bank (ECB) published the European Framework for Threat Intelligence-based Ethical Red Teaming (TIBER-EU), which is the first Europe-wide framework for controlled and bespoke tests against cyber attacks in the financial market.

The main goal for the Framework is to facilitate testing for cross-border entities under oversight of several authorities, it aims to help organizations measure their ability in detecting and responding cyber attacks.

The instructions on how to “How to implement the European framework for Threat Intelligence-based Ethical Red Teaming” are available here.

In August 2019, the European Central Bank (ECB) announced that threat actors had access for months to the contact information of hundreds of financial industry subscribers to its newsletter.

The good news is that the BIRD website was run on an external server that is separated from the ECB infrastructure, according to the bank neither internal systems nor market-sensitive data were affected.

Pierluigi Paganini

(SecurityAffairs – ECB, cyber security)

[adrotate banner=”5″]

[adrotate banner=”13″]