Charta is on Google Play: practise on the go. Get the app
Charta

Outline the nature of the cyber risks and the ICT (information and communication technology) risks to which financial institutions are exposed.

FRM® Part II · Current Issues in Financial Markets · Digital Resilience and Financial Stability: The Quest for Policy Tools in the Financial Sector · FRM2.CI.8.a

The idea

Cyber risk is the risk of loss from malicious, intentional acts against information systems: ransomware, data theft, denial-of-service attacks, account takeover, fraud through compromised credentials and misuse by insiders. ICT risk is wider. It is the risk of loss from any failure, misuse or compromise of information and communication technology, so it also covers accidental outages, faulty software changes, legacy systems, poor data quality, weak governance and the failure of third-party or cloud providers. Cyber risk is therefore the intentional subset of ICT risk. Impact is usually described by three properties: confidentiality (data not exposed), integrity (data not altered) and availability (services usable when needed). Financial institutions are exposed because their business is digital, they are tightly connected through payment and settlement systems, and many rely on the same few vendors. Exam point: do not equate ICT risk with cyber attacks.

A practice question

From the question bank, with the reason each wrong option is wrong.

Which statement best distinguishes cyber risk from ICT risk at a financial institution?

  1. Cyber risk arises from malicious acts on information systems; ICT risk also covers accidental failures. - correct
  2. Cyber risk covers accidental system outages, whereas ICT risk covers only intentional attacks carried out by outsiders.Why not: Reverses the two terms: it is cyber risk that requires malicious intent, and ICT risk that is the broader category.
  3. ICT risk applies only to services outsourced to vendors, whereas cyber risk applies only to systems that are run in-house.Why not: Splits the terms by who operates the system rather than by cause; both apply to in-house and outsourced technology.
  4. The two terms are identical and differ only in which regulator or standard-setter happens to use each of them.Why not: Ignores that ICT risk includes non-malicious failures such as faulty changes and outages, which are not cyber events.

Cyber risk is the intentional (malicious) subset of ICT risk. ICT risk also covers accidents, faulty software changes, legacy systems and third-party failure, so the two are not interchangeable.

A harder one

A bank's trading platform is unavailable for six hours after its own IT team deploys a faulty software update. No external party was involved. How is this event best classified?

  1. A cyber risk event, because any outage of a networked system is a cyber incident.Why not: Treats every technology failure as cyber; cyber risk requires an intentional malicious act.
  2. An ICT event but not a cyber event, because there was no malicious actor. - correct
  3. Neither, because without a loss of data there is no ICT risk.Why not: Wrongly requires data loss; an availability failure from a bad change is itself an ICT risk event.
  4. A cyber risk event, because software changes are deployed over the bank's network.Why not: Confuses the delivery channel with the cause; the cause here was an internal error, not an attack.

The cause was an internal change failure with no adversary, so it is an ICT incident (availability) but not a cyber incident. ICT risk is the broader category.

The hardest tier

A bank's incident log for the year contains four events: (i) ransomware encrypts file servers; (ii) a vendor's faulty patch crashes a settlement server; (iii) an employee sells client lists to a competitor; (iv) a data-centre flood. Which events are cyber risk events (malicious), given that all four are ICT events?

  1. (i) onlyWhy not: Counts only external attackers and overlooks deliberate misuse of data by an insider, which is also malicious.
  2. (i), (ii) and (iii)Why not: Treats an accidental vendor patch fault as malicious; the patch crash has no adversary.
  3. (i) and (iii) - correct
  4. All four eventsWhy not: Treats ICT risk and cyber risk as the same set; a flood and a faulty patch are non-malicious ICT events.

Cyber risk requires malicious intent: ransomware (i) and insider theft of data (iii). The faulty patch (ii) and the flood (iv) are accidental or physical ICT events.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Digital Resilience and Financial Stability: The Quest for Policy Tools in the Financial Sector