The Vulnerability of the Financial System to a Systemic Cyberattack
Bobby Vedral · 2021
The financial industry is a prime target of cybercriminal activity, mainly due to the nature of its underlying business (`that's where the money is').This was the reply of 1930s US bank robber Willie Sutton when asked why he robbed banks. He later coauthored a book titled Where the Money Was. See FBI History of Famous Cases & Criminals, https://www.fbi.gov/history/famous-cases [accessed 1 March 2021]., the sector's global interconnectedness, and its high level of digitalization. In response, the private sector has invested vast sums into cybersecurity, and regulators have started to worry about systemic risk. The latter comes in two forms. The first is the risk of a successful cyberattack against a specific financial institution `spilling over' into the broader financial system, hence unintentionally becoming systemic. The second is the national security concern of a systemic cyberattack launched specifically to disrupt the target's financial ecosystem and therefore the real economy. In both cases, the historic evidence is clear: neither type of event has been recorded thus far. Those who consider warnings of systemic cyberattacks to be little more than threat inflation see that as vindication. This paper takes the opposite view and argues that the probability of a systemic cyberattack is significant enough to warrant a higher degree of crossdisciplinary research and preparedness. To support its main argument, this paper proposes a conceptual framework that focuses on answering two key questions. First, are there sufficient known structural vulnerabilities in the financial ecosystem that could be exploited by a willing adversary? And second, are there plausible scenarios that could see an adversarial nation-state launch such an attack? The answer to both is positive. Given the lack of data, this analysis is largely qualitative, based on discussions with regulators, chief risk officers, academic experts, and the author's own multi-decade experience as an active participant in the financial market.