The Bank of England has published the findings of its Waking Shark II cyber attack exercise, revealing better communication between entities is needed to fend off threats.
The simulation, which took place towards the end of last year, was designed to test the responses of the wholesale banks sector, including investment banks and other key financial market infrastructure, in the event of a state-sponsored cyber attack.
According to the report's author, Chris Keeling, Waking Shark II was not intended to scrutinise each individual firm's reaction, but see how the sector could work together to understand and minimise an attack's impact.
The report states significant improvements had been made since 2011's Waking Shark I exercise, particularly with regard to the use of the Cyber Security Information Sharing Partnership (CISP) initiative, which was introduced in March 2013.
CISP allows organisations and the Government to share information and intelligence on cyber threats and is supported by a Fusion Cell' a cyber attack monitoring operations room run by the Security Service, GCHQ and the National Crime Agency.
However, while Keeling commended the level of collaboration and communication, he said this was hampered by the lack of a central framework for sharing information and communication across the financial sector.
"Whilst there was some communication between the participating firms and the [financial market infrastructures] and good communications with the authorities, it was identified that there is no formal communication coordination within the wider sector," said Keeling.
He noted while there are a number of sector groups that provide a communications framework for their members, there is no overarching platform.
"Consideration will be given to the identification of a single coordination body from industry to manage communications across the sector during an incident," said Keeling.
Keeling also warned not all firms were aware of their responsibilities to report major incidents to their regulators as soon as possible and also expressed concern they may not be aware of the need to independently report an attack to the police.
The full report is available to read in PDF form here.
