Cyber risk has become one of the most significant operational risks facing financial institutions. It consistently ranks as the top concern in risk management surveys.

The Cyber Threat Landscape

Types of Cyber Threats

  • Ransomware: Encrypting data and demanding payment
  • Phishing/Social Engineering: Tricking employees into revealing credentials
  • DDoS Attacks: Overwhelming systems with traffic
  • Data Breaches: Unauthorized access to sensitive information
  • Insider Threats: Malicious or negligent employees
  • Supply Chain Attacks: Compromising through third-party software

Threat Actors

  • State-sponsored groups (APTs)
  • Organized criminal networks
  • Hacktivists
  • Insider threats
  • Opportunistic attackers

Cyber Risk Management Framework

NIST Cybersecurity Framework

Five core functions:

  1. Identify: Asset management, risk assessment, governance
  2. Protect: Access controls, security training, data protection
  3. Detect: Monitoring, detection processes, anomaly identification
  4. Respond: Response planning, communications, analysis, mitigation
  5. Recover: Recovery planning, improvements, communications

Defense in Depth

Multiple layers of security controls:

  • Network perimeter security
  • Endpoint protection
  • Application security
  • Data encryption
  • Identity and access management
  • Monitoring and logging

Regulatory Expectations

Financial regulators increasingly focus on cyber resilience:

  • SEC: Cybersecurity disclosure rules
  • DORA (EU): Digital Operational Resilience Act
  • NYDFS: Cybersecurity Regulation 23 NYCRR 500
  • BCBS: Cyber resilience principles
  • PRA/FCA (UK): Operational resilience requirements

Cyber Risk Quantification

Measuring cyber risk is challenging but essential:

  • Scenario-based: Expert assessment of cyber event impacts
  • FAIR (Factor Analysis of Information Risk): Structured framework for quantifying cyber risk
  • Insurance pricing: Cyber insurance as a market-based measure
  • Event databases: Learning from industry incidents

Building Cyber Resilience

  1. Assume breach: Plan for when, not if, an attack succeeds
  2. Incident response planning: Having tested playbooks ready
  3. Tabletop exercises: Regular simulations of cyber attack scenarios
  4. Red teaming: Authorizing simulated attacks to test defenses
  5. Business continuity: Ensuring critical operations continue during cyber events

Third-Party Cyber Risk

Third-party providers expand the attack surface:

  • Vendors with network access
  • Cloud service providers
  • Software supply chain
  • Fourth-party risk (vendors of vendors)

Prepare for cyber risk questions in the FRM exam with our practice tests!