By Sep­tem­ber, the Cen­tral Bank of T&T should pro­vide a se­cu­ri­ty frame­work for fi­nan­cial in­sti­tu­tions in the coun­try.

In a we­bi­nar en­ti­tled “Cy­ber­se­cu­ri­ty in Fi­nan­cial In­sti­tu­tions: Best Prac­tices” host­ed by the Cen­tral Bank last week, Cen­tral Bank Gov­er­nor Dr Alvin Hi­laire not­ed that as the world grows more de­pen­dent on tech­nol­o­gy, the im­por­tance of cy­ber­se­cu­ri­ty is grow­ing par­tic­u­lar­ly among fi­nan­cial in­sti­tu­tions.

Hi­laire said, “It is no ex­ag­ger­a­tion that our fi­nan­cial in­sti­tu­tions across the world are heav­i­ly de­pen­dent on tech­nol­o­gy. It is quite re­mark­able to think that just some time ago, you didn’t have on­line trans­ac­tions, but now, this is the world that we live in and it’s hard to imag­ine any­thing with­out on­line trans­ac­tions, ATMs and so forth.”

He con­tin­ued, “In fact, as a coun­try be­comes more mod­ern, its fi­nan­cial in­sti­tu­tions be­come more savvy, there’s in­tense com­pe­ti­tion and they go to­geth­er. And so tech­nol­o­gy re­in­forces fi­nan­cial sta­bil­i­ty and they can’t go with­out mov­ing hand in hand. But they al­so may threat­en each oth­er and here is where it is im­por­tant to be on top of the game.”

He point­ed out that in mod­ern times, a bank rob­bery is less like­ly to be phys­i­cal.

“We have to be aware of the im­por­tance of tech­nol­o­gy but al­so the threats to fi­nan­cial sta­bil­i­ty. Now, let me give you an ex­am­ple of what we used to think about as a typ­i­cal bank rob­bery that you will see on TV. So some­body comes in in a mask, they give a note. And then they say well give me your mon­ey and they have a get­away car and they get away or they don’t get away,” said Hi­laire.

“So this is our typ­i­cal bank rob­bery. You still have that but now, guess what. Peo­ple could rob a whole bank with­out be­ing in the coun­try. The ban­dits could be in Ko­rea, the could be in Aus­tralia. They have a cy­ber at­tack the whole fi­nan­cial in­sti­tu­tion could be com­pro­mised.”

Hi­laire point­ed out there were sev­er­al strate­gies now that could al­low the theft of per­son­al in­for­ma­tion and fi­nan­cial in­sti­tu­tions around the world and lo­cal fi­nan­cial in­sti­tu­tions have to be mind­ful of these threats.

These threats to per­son­al in­for­ma­tion could come from ran­somware, iden­ti­ty theft or from oth­er means, the Gov­er­nor said.

These threats do not even have to be on land, as some­one could launch a cy­ber at­tacks in a sub­ma­rine or by ma­nip­u­lat­ing a satel­lite in out­er space, said Hi­laire.

“This is how se­ri­ous or how anony­mous this thing could be. So we have to be very care­ful as some of the things that we are ac­cus­tomed to think­ing about in the cy­ber threat land­scape in­clude card skim­ming, iden­ti­ty theft, ran­somware, and all those, so let’s be ful­ly aware of this,” he said.

Cen­tral banks around the world have been tak­ing coun­ter­mea­sures.

Hi­laire con­firmed dur­ing the sem­i­nar that the Cen­tral Bank was in­deed work­ing on the frame­work, which he hoped would not just be adopt­ed by the ma­jor com­mer­cial banks, but al­so by cred­it unions and oth­er fi­nan­cial in­sti­tu­tions in our coun­try.

“Do­mes­ti­cal­ly we are al­so work­ing to­wards im­prov­ing our cy­ber­se­cu­ri­ty de­fences. Let me men­tion three as­pects. One is ed­u­ca­tion. So peo­ple should be aware of cy­ber threats. One such is where our na­tion­al fi­nan­cial lit­er­a­cy pro­gramme comes in.

“The sec­ond is re­dress where peo­ple could have some way of deal­ing with it. And our Of­fice of the Fi­nan­cial Ser­vices Om­buds­man will be deal­ing more with that.

“And the third is mar­ket con­duct or how in­sti­tu­tions be­have. And this is what we are talk­ing about to­day.”

The Cen­tral Bank Gov­er­nor ex­plained that the Cen­tral Bank had been work­ing with the In­ter­na­tion­al Mon­e­tary Fund (IMF) to de­vel­op the frame­work so that lo­cal in­sti­tu­tions would be prop­er­ly guid­ed in the in­stance of a cy­ber at­tack.

Hi­laire said, “The Cen­tral Bank of T&T has been ac­tive­ly think­ing about cy­ber­se­cu­ri­ty for quite some time. If you look at our strate­gic plan some years ago, and the cur­rent strate­gic plan, it fea­tures very promi­nent­ly.

“Now most re­cent­ly, in or­der to boost this, we have in­vit­ed the IMF for tech­ni­cal as­sis­tance and we had a re­al­ly tremen­dous ex­pe­ri­ence with them and I must com­mend the al­ready ded­i­cat­ed team from the fund for be­ing with us to look at two as­pects. One is the cy­ber­se­cu­ri­ty of our own op­er­a­tions. And the sec­ond is the cy­ber­se­cu­ri­ty of fi­nan­cial in­sti­tu­tions.”

He said in that re­gard, the Cen­tral Bank is work­ing to­wards a guide­line that would be giv­en to fi­nan­cial in­sti­tu­tions that they will be able to utilise for their own op­er­a­tions.

Hi­laire said the reg­u­la­tor of fi­nan­cial in­sti­tu­tions wants to go a step fur­ther not on­ly for li­censees but for oth­er in­sti­tu­tions such as cred­it unions.

“We hope that the cred­it unions will adopt this in a mean­ing­ful fash­ion and we will all have a cer­tain com­mon set of stan­dards. So our ex­pec­ta­tions to­day are quite high for this en­deav­our,” said Hi­laire.

He ex­plained that the we­bi­nar served a dual pur­pose as it not on­ly sought to ex­plain these threats but would al­so en­ter­tain ques­tions which would fur­ther in­form the Cen­tral Bank’s ap­proach.

He said, “We will be able to is­sue the guide­lines by, I would say, mid-Sep­tem­ber.”

Keisha Lash­ley, as­sis­tant man­ag­er, In­for­ma­tion and Cy­ber­se­cu­ri­ty not­ed that every­day fi­nan­cial in­sti­tu­tions were un­der at­tack. She said it was there­fore im­por­tant that con­sumers al­so know what their op­tions were should their bank come un­der at­tack.

“You wake up one morn­ing, and you learn as your fi­nan­cial’s in­sti­tu­tions da­ta is avail­able for sale on the dark web. You go to their ap­pli­ca­tion and it is un­avail­able. You go to their web­site, and it has been de­faced. What would you do?

“These are some of the at­tacks that fi­nan­cial in­sti­tu­tions face on a dai­ly ba­sis. And even in this cli­mate, they are still ex­pect­ed to de­liv­er a ser­vice that is both re­silient and se­cure. We know that tech­nol­o­gy al­lows us to ex­e­cute our func­tions, to be in­no­v­a­tive, to be cre­ative, just to do things bet­ter,” said Lash­ley.

“There’s a lot of con­ver­sa­tion now about ar­ti­fi­cial in­tel­li­gence and ma­chine learn­ing, and how these su­per­com­put­ers will change very near that we do things. These are ex­cit­ing times for us. But we know that even though tech­nol­o­gy brings op­por­tu­ni­ties, there are al­so risks, and as the gov­er­nor said, crim­i­nals are not re­strained to our bor­ders. In fact when we look at some of the at­tacks that are hap­pen­ing right here.”

Lash­ley stressed that as Trinidad and To­ba­go moved clos­er to be­com­ing a cash­less so­ci­ety, these counter mea­sures have to be im­ple­ment­ed soon­er rather than lat­er.

She said, “We want to move to a cash­less so­ci­ety. And I know that just as they de­mand a lot of us, they al­so de­mand a lot of you our fi­nan­cial in­sti­tu­tions. And one thing that is con­sis­tent is that the at­tacks are so­phis­ti­cat­ed, and they hap­pen all day, every day.”

Michelle Fran­cis-Pan­tor, deputy in­spec­tor of Fi­nan­cial In­sti­tu­tions for Cen­tral Bank, ex­plained that the frame­work would be de­vel­oped with care­ful con­sid­er­a­tion of the range and scope of each fi­nan­cial in­sti­tu­tion.

“The cy­ber­se­cu­ri­ty frame­work to be es­tab­lished should be pro­por­tion­ate to the size of busi­ness ac­tiv­i­ties and risks faced by the fi­nan­cial in­sti­tu­tion. In this re­gard, the draft guide­line will set out the bank’s ex­pec­ta­tions for fi­nan­cial in­sti­tu­tions with re­spect to cy­ber­se­cu­ri­ty, will strike a bal­ance be­tween prin­ci­ples and pre­scrip­tion in recog­ni­tion of the dif­fer­ent lev­els of so­phis­ti­ca­tion and in­sti­tu­tions and will cov­er key ar­eas such as gov­er­nance, risk man­age­ment, IT re­silience and third par­ty risks.”

She ex­plained that these guide­lines would al­so in­form the train­ing re­quired for all work­ers at fi­nan­cial in­sti­tu­tions.