FSI paper details ‘red team testing’

A new paper by the Financial Stability Institute details how “red team testing” is used in different jurisdictions to assess the cyber defences of financial institutions.

In the latest in a series of FSI Insights papers, Jermy Prenio, Jeffery Yong and Raymond Kleijmeer present the results of a study based on eight different financial authorities.

A red team test involves a group of hackers trying to break into a firm’s systems and make off with “flags” or key pieces of data, as a simulation of a real cyber attack. The scenarios are conducted without the bank’s cyber teams knowing they are happening.

“An effective red team test is characterised by both firms and authorities being open about the results, learning from the weaknesses exposed and taking appropriate remedial actions,” the FSI authors say.

Various authorities are involved to different degrees. Some play a close role in managing the testing process, while others play a more limited part in ensuring post-test recommendations are implemented.

The FSI team says there could be scope for red team testing to be conducted across borders, and it might be possible for one jurisdiction to approve a firm tested in another “if certain conditions are met”.