BSP prepared for cyber threats – Fonacier
By Lee C. Chipongian
Bangko Sentral ng Pilipinas (BSP) Deputy Governor Chuchi G. Fonacier said with tighter reporting of cyber-related threats and attacks, the central bank ensures prompt response to control – as best they can – the extent of disruption and damage once an incident is reported to them.
BSP Deputy Governor Chuchi G. Fonacier. (Bloomberg Photo)
Fonacier said any BSP supervisory action is dependent on how fast they could get to information presented by banks hit by cyber attacks.
“It depends on the nature and circumstances surrounding the incident as well as the remedial action or how fast is the response of the bank to the incident,” said Fonacier.
Last week, the BSP announced that the Monetary Board approved changes to existing cybersecurity rules particularly on the reporting by banks of cyber-related issues which should be within two hours of first detecting the incident, followed up by updates inside the first 24 hours.
Fonacier said the BSP will do the necessary procedures and will do it faster, but again this will depend on the extent of disruption and affected sectors.
“The BSP has to verify the matter especially if it will require for us to conduct on-site verification. So, it will really depend on specific incident involve and also on how fast the bank has responded to the incident or situation,” she added.
Before the circular amendment, banks were ordered to report to the BSP any cybersecurity issues within 10 days of the incident.
With the new rules, the BSP said that after the initial notification which is within two hours of the incident, banks should submit a more detailed report within 24 hours containing information such as the manner and time of initial detection, impact of the incident, and initial remedial response.
The BSP then will assess the situation and proceed with necessary “appropriate supervisory actions if warranted, until full resolution of the incident.”
It added that they may “swiftly issue appropriate advisories, security bulletins, and/or policies to prevent recurrence of the incident and promote enterprise and industry-wide operational resilience.”
The quick access to information on these incidents will enable the BSP to alert other banks, industry associations and other relevant stakeholders that may be affected by a specific attack.
Banks are expected to fully comply with the rules stated under BSP Circular No. 982 or the cybersecurity risk management framework, by the end of November. The circular is the updated version of BSP Circular No. 808 – that the BSP first released in 2013 to address the multi-layered security controls for cyber-risk prevention.
The BSP said earlier that the new guidelines are the “right balance” of managing cyber-related risks without hampering innovations.
Basically, the enhanced IT security rules put extra emphasis on the information security governance and a “strong security culture” in banking networks.
Since timeliness is crucial in detecting cyber crimes, as well as identifying, preventing, responding and recovering from threats, the BSP has mandated banks to manage information security risks and exposures, specifically to improve on “situational awareness capabilities” along with ensuring they are equipped with advanced cybersecurity controls and countermeasures.
To this end, banks are required to implement a 24/7 security operations center or SOC to “proactively monitor emerging and highly sophisticated cyber-threats and attacks.”
The IT profile classification has also been expanded from two to three classifications as complex, moderate and simple. Banks deemed complex will be required to adopt advanced cybersecurity tools and processes such as an SOC.
Primarily, the BSP wants banks to be prepared against the fast-evolving cyber-threats that continue to hit both global and local financial sectors on a daily basis.