Cloud and security · Banking
Cyber resilience engineering for banks
We provide cyber resilience engineering for banks: support for cyber resilience assessments such as HKMA's C-RAF, monitoring and detection engineering, preparation for intelligence-led attack simulation, incident response playbooks that have been exercised, and recovery capability that survives ransomware, including immutable backups and clean-room restoration. The aim is a bank that can keep serving customers through an attack, and you own the controls and the code.
Checklist · Cloud and resilience
Cloud migration and resilience checklist for regulated firms
A checklist for regulated firms planning a cloud migration, a resilience programme or a security uplift: workload assessment, landing zone, data residency, resilience, security, delivery, third-party risk and evidence.- 01Eight areas that supervisors and auditors ask about, with testable checks.
- 02Resilience and recovery items that are easy to leave untested.
- 03Third-party, exit and data residency questions for the board.
- 04Seven questions to put to any vendor or engineering partner.
Free download
Get it on screen in a few seconds.
What the system does, module by module.
- 01
Cyber risk and maturity assessment
Assessment of inherent risk and maturity against a supervisory framework such as C-RAF, with a plan that ranks improvements by risk reduction. - 02
Asset, identity and attack surface management
Continuous inventory of assets and exposed services, strong identity and privileged access controls and reduction of the attack surface. - 03
Detection engineering
Detections mapped to attacker techniques, tuned on the bank's own telemetry, with coverage measured against a framework such as MITRE ATT&CK. - 04
Security operations and response
Monitoring workflows, triage, escalation and automation in the security operations centre, with clear roles and decision rights for incidents. - 05
Threat intelligence
Intelligence relevant to the bank and its sector turned into detections, hunts and defensive actions, and shared through trusted channels. - 06
Intelligence-led testing
Preparation, scoping and remediation for intelligence-led attack simulation programmes, and purple-team exercises that improve detection. - 07
Ransomware and destructive-attack readiness
Segmentation, privileged access limits, immutable and isolated backups, and recovery plans for the systems that carry critical services. - 08
Crisis management and exercises
Playbooks and exercises that include executives, communications, legal and regulators, with measured outcomes and follow-up actions. - 09
Metrics and board reporting
Cyber risk indicators, control effectiveness and testing results reported to the board and risk committee in terms they can act on.
Reference architecture.
Standards and interfaces
What we design against.
- HKMA Cyber Resilience Assessment Framework (C-RAF 2.0)
- The HKMA's framework for assessing inherent risk and maturity, with the iCAST intelligence-led attack simulation testing, used by authorised institutions in Hong Kong.
- TIBER-EU, CBEST and equivalents
- Intelligence-led red-team testing frameworks used by supervisors in Europe and the UK, and the model for similar programmes elsewhere.
- NIST Cybersecurity Framework 2.0
- Govern, identify, protect, detect, respond and recover functions used to structure the programme and its reporting.
- MITRE ATT&CK
- A knowledge base of attacker techniques for mapping detections, hunts and test scenarios.
- ISO/IEC 27001 and 27035
- Information security management and incident management guidance.
- Sector information sharing
- Participation in financial sector information sharing and analysis arrangements.
Data model
The core entities.
- Asset and exposure
- Asset, owner, criticality, internet exposure, vulnerabilities and controls.
- Detection rule and coverage
- Rule, technique mapped, data source, tuning, false-positive rate and test result.
- Alert and case
- Source, severity, analysis, response actions, timeline and closure.
- Threat intelligence item
- Source, relevance, indicators, techniques and the detection or hunt it produced.
- Test and finding
- Scenario, techniques used, detections observed, gaps and remediation.
- Recovery plan and test
- Critical service, recovery path, backup status, last test and outcome.
- Exercise and action
- Scenario, participants, decisions, issues found and the actions assigned.
When custom development is the right call.
Controls designed in, not added later.
Privileged access control
Tiered administration, just-in-time access and separate credentials for the systems that attackers target first.Immutable and isolated backups
Backups that cannot be altered or deleted by a compromised administrator, stored apart from production and tested for restoration.Segmentation
Network and identity segmentation that limits movement and keeps critical services separate from general IT.Tested response
Playbooks are exercised with the people who will use them, including executives and communications.Safe testing
Attack simulations run under agreed rules with safeguards for production, and findings are fixed and retested.
From discovery to a system you run.
- 01
Assessment and priorities
We assess maturity against the framework and the threats most relevant to the bank, and agree a ranked improvement plan. - 02
Foundations: identity, visibility and backups
Privileged access, telemetry coverage and recoverable backups are brought to a baseline, because most other controls depend on them. - 03
Detection and response engineering
Detections, playbooks and automation are built and tested with the security operations team. - 04
Testing and exercises
Purple-team and intelligence-led tests and crisis exercises are run, with findings fixed and retested. - 05
Recovery proof and continuous improvement
Recovery from a destructive scenario is demonstrated, and the programme runs as a cycle of testing and improvement.
Relevant work
Where to see our work.
Common questions.
- What is C-RAF?
- The Cyber Resilience Assessment Framework issued by the Hong Kong Monetary Authority. Banks assess their inherent cyber risk and their maturity against it, and the HKMA uses the results, together with intelligence-led attack simulation testing, in its supervision.
- Can you run the intelligence-led penetration tests?
- Accredited testers carry out those tests. We prepare the bank, help scope them, build the detections and fix what the tests find, so the exercise improves the bank's defences.
- How do you protect backups from ransomware?
- With immutable storage, separation from production credentials, isolated recovery environments and regular restoration tests. Backups that have never been restored are a hope, not a control.
- Do you operate a security operations centre?
- We build and improve detection, automation and response capability with your team, and integrate with managed services where you use them. Ongoing 24-hour monitoring is normally provided by your own centre or a managed provider.
- Who owns the detections and playbooks?
- You do. The detections, the playbooks, the code and the data stay yours.