Well worth a read. For those not familiar with the UK Bank of England’s CBEST program, it’s run annually by UK security services and (In line with

← Back to Blog

Well worth a read. For those not familiar with the UK Bank of England’s CBEST program, it’s run annually by UK security services and (In line with NIS 2) uses TLPT to test the cybersecurity of UK systemically important banks and infrastructures. This years results are rather interesting.In short – the headmaster says they could do better. The tests identified more poor practices than good.1. Inadequate Identify and Access Management controls.2. Weak configuration management practices.3. Ineffective network and service segmentation.4. Ineffective network monitoring.5. Weaknesses in staff awareness and education.6. Insufficient detection of adverse events.7. Poor communication channels during incident response.One wonders if the wording of the report reflects the gravity of the situation. Sitting on the outside looking in is easy, however having ran and been privy to pen tests on systemically important banks, these findings raise concerns. A reason for EU DORA and associated civil and criminal penalties.Its only money……..@Thaddeus Dziekanowski Brian D. McCarthy Faisal KhanVeritas GRC Bank of England National Cyber Security Centre#cybersecurity #cyberriskmanagement #cyberregulation

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7276213792269631488