Presentation provided at the Annual ICC Banking Commission Meeting by Sukand Ramachandran on 11 April 2019.

1. Scenarios
Threat Actors
Attack Vectors Vulnerabilities
Cyber threat scenarios … … act on assets …
… to create a financial impact
Datacentres
Infrastructure
BU 1
Apps
+
Data
BU 2
Apps
+
Data
BU 3
Apps
+
Data
BU 4
Apps
+
Data
Cyber control environment

2. NIST is an industry standard framework for categorising Cyber controls
Governance
Outlines key governance processes that must be in place to manage cybersecurity environments,
centered around strategy, policy and audit
Identify
Assists in developing controls required to identify where a cybersecurity event may take place, and
understand the risk to systems, people, assets, data, and capabilities
Protect
Outlines appropriate safeguards to ensure delivery of critical infrastructure services, and supports
the ability to limit or contain the impact of a potential cybersecurity event
Detect
Defines the appropriate activities to identify the occurrence of a cybersecurity event, driving to
timely discovery of cybersecurity events
Respond
Includes appropriate activities to take action regarding a detected cybersecurity incident, including
how to contain the impact of a potential cybersecurity incident.
Recover
Identifies appropriate activities to maintain plans for resilience and to restore any capabilities or
services that were impaired due to a cybersecurity incident
Explains how to manage and minimise supply chain and third party dependency risks that
organisations have less control over
Supply chain/dep.
management

3. Estimating the impact of cybersecurity events …
… enables clear communication
of impact/mitigations
Taking a methodology
we're comfortable with …
Expected Loss =
Likelihood of Default x
Impact given Default
Likelihood of success x
Financial Impact =
Exposure
ThreatIntensity
(ThreatActors+AttackVectors)
Vulnerability
(as a function of controls)
…and applying it to different
types of cyber risk
Allows estimation of
loss impacts on
assets …
… and how to reduce
impact through cyber
mitigations

4. Call To Action!
We need alignment
on taxonomy …
...and to use similar
methodologies