Credit: Dreamstime
Cyber security consultancy MWR InfoSecurity has praised Singapore for its development of a set of security assessment guidelines aimed at strengthening the cyber resilience of the financial sector.
The guidelines, known as the Adversarial Attack Simulation Exercises (AASE) guidelines or “Red Teaming” guidelines, were developed by the Association of Banks in Singapore (ABS) with support from the Monetary Authority of Singapore (MAS), which recently launched a $30 million cyber security grant for the finance sector.
The intent of these guidelines are to provide financial institutions with best practices and guidance on planning and conducting Red Teaming exercises to enhance their security testing.
“Cyber security attacks against financial institutions are evolving in scope, complexity and sophistication,” said Ong–Ang Ai Boon, director of ABS in a recent statement.
“Financial institutions are already deploying layers of defensive 2 measures, solutions and controls to reduce their exposure to attacks and improve their response readiness.
“We hope that the AASE guidelines will complement the financial institutions’ existing cyber security testing programmes and further strengthen their ability to assess the effectiveness of their cyber security measures to detect and respond to very sophisticated incidents."
Specifically, AASE is a form of cyber security assessment designed to test the robustness of financial institutions’ cyber defences through a simulated cyber-attack using tactics, techniques and procedures that are commonly employed by threat actors.
The exercise is conducted in the financial institution’s actual operating environment, allowing financial institutions to identify gaps in their people, processes and technologies.
“A key aspect of AASE is the use of cyber threat intelligence to design realistic exercise scenarios that mirror actual threat actors and their actions to uncover vulnerabilities that may impact the financial institutions critical functions or business criticality,” clarified ABS in a recent statement.
Founded in 2003, MWR InfoSecurity provides specialist advice and solutions in all areas of security, from professional and managed services, through to developing commercial and open source security tools.
Benjamin Harris, technical director, MWR InfoSecurity said that ABS and MAS should be lauded for this initiative as it is “highly relevant as cybercriminals are operating on unprecedented scales targeting organisations of all sizes, with varying motivations and objectives.”
“As these criminals have increased their focus on cybercrime, financial institutions have increasingly become targets of major cyber attacks around the world," Harris said.
"From state-sponsored adversaries attempting significant thefts from central banks to numerous complex and aggressive attacks on various global banks, the threat landscape continues to evolve in both sophistication and audacity.
"The uptick in aggression and sophistication demonstrates that adversaries are evolving and refining their tactics, techniques and procedures to keep up with the advances and evolutions of organisational defence.
"Similarly, as adversaries evolve, organisations must continue to evolve their cyber security discipline to ensure they are resilient to the changing threats."
AASE, said Harris, employ a holistic approach when compared to traditional penetration testing exercises.
“Where penetration testing focuses on validating technical controls or identifying technical weaknesses in specific assets, AASE place emphasis on the target organisation’s ability to prevent, detect and respond to adversaries targeting critical functions, across multiple technical and non-technical domains,” said Harris.
“These assessments look to stress the defensive capabilities of an organisation, with the view to ultimately identifying areas for enhancement and strengthening within these capabilities."
Harris further said that MWR InfoSecurity is pleased to have shared insights from the company’s experience of having run successful AASE throughout the world with ABS and MAS during the development of the guidelines.
“MWR InfoSecurity was able to share insights from our involvement with similar exercises globally, including similar regulator-led exercises,” he said, adding that the company’s views on how these exercises can be conducted to yield the most value to strengthen an organisations’ resilience were also shared.
“Certainly, these guidelines will further contribute to the enhancement of security and operational integrity of the financial sector in Singapore, cementing Singapore’s position as a leading financial hub within the Asia-Pacific region and throughout the world."
